@nocobase/flow-engine 2.2.0-beta.5 → 2.2.0-beta.7

package/lib/utils/runjsModuleLoader.js

@@ -34,27 +34,6 @@ __export(runjsModuleLoader_exports, {
 module.exports = __toCommonJS(runjsModuleLoader_exports);
 var import_runjsLibs = require("../runjsLibs");
 var import_resolveModuleUrl = require("./resolveModuleUrl");
-var import_safeGlobals = require("./safeGlobals");
-function snapshotOwnKeys(obj) {
-  try {
-    if (!obj || typeof obj !== "object" && typeof obj !== "function") return [];
-    return Object.getOwnPropertyNames(obj);
-  } catch (_) {
-    return [];
-  }
-}
-__name(snapshotOwnKeys, "snapshotOwnKeys");
-function diffAddedKeys(afterKeys, beforeKeys) {
-  if (!afterKeys.length) return [];
-  if (!beforeKeys.length) return [...afterKeys];
-  const beforeSet = new Set(beforeKeys);
-  const added = [];
-  for (const k of afterKeys) {
-    if (!beforeSet.has(k)) added.push(k);
-  }
-  return added;
-}
-__name(diffAddedKeys, "diffAddedKeys");
 async function withRunjsModuleLoadLock(task) {
   const g = globalThis;
   g.__nocobaseRunjsModuleLoadLock = (g.__nocobaseRunjsModuleLoadLock || Promise.resolve()).catch(() => {
@@ -222,8 +201,6 @@ async function prefetchEsmModule(url, options) {
 __name(prefetchEsmModule, "prefetchEsmModule");
 async function runjsRequireAsync(requirejs, url) {
   return await withRunjsModuleLoadLock(async () => {
-    const beforeWinKeys = typeof window !== "undefined" ? snapshotOwnKeys(window) : [];
-    const beforeDocKeys = typeof document !== "undefined" ? snapshotOwnKeys(document) : [];
     let result;
     let error;
     try {
@@ -242,13 +219,6 @@ async function runjsRequireAsync(requirejs, url) {
       });
     } catch (e) {
       error = e;
-    } finally {
-      const afterWinKeys = typeof window !== "undefined" ? snapshotOwnKeys(window) : [];
-      const afterDocKeys = typeof document !== "undefined" ? snapshotOwnKeys(document) : [];
-      const addedWinKeys = diffAddedKeys(afterWinKeys, beforeWinKeys);
-      const addedDocKeys = diffAddedKeys(afterDocKeys, beforeDocKeys);
-      (0, import_safeGlobals.registerRunJSSafeWindowGlobals)(addedWinKeys);
-      (0, import_safeGlobals.registerRunJSSafeDocumentGlobals)(addedDocKeys);
     }
     if (error) throw error;
     return result;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/flow-engine",
-  "version": "2.2.0-beta.5",
+  "version": "2.2.0-beta.7",
   "private": false,
   "description": "A standalone flow engine for NocoBase, managing workflows, models, and actions.",
   "main": "lib/index.js",
@@ -8,8 +8,8 @@
   "dependencies": {
     "@formily/antd-v5": "1.x",
     "@formily/reactive": "2.x",
-    "@nocobase/sdk": "2.2.0-beta.5",
-    "@nocobase/shared": "2.2.0-beta.5",
+    "@nocobase/sdk": "2.2.0-beta.7",
+    "@nocobase/shared": "2.2.0-beta.7",
     "ahooks": "^3.7.2",
     "axios": "^1.7.0",
     "dayjs": "^1.11.9",
@@ -37,5 +37,5 @@
   ],
   "author": "NocoBase Team",
   "license": "Apache-2.0",
-  "gitHead": "81eab2cfa9d3d989e99ba0c914807b38db55f023"
+  "gitHead": "e6a3fa8963a73cd9ddfc1273d71b0012483e1ad8"
 }

package/src/JSRunner.ts

@@ -39,6 +39,117 @@ export function shouldPreprocessRunJSTemplates(
   return options?.version !== 'v2';
 }
 
+const RUNJS_BROWSER_GLOBAL_NAMES = [
+  'fetch',
+  'localStorage',
+  'sessionStorage',
+  'XMLHttpRequest',
+  'WebSocket',
+  'Worker',
+  'SharedWorker',
+  'ServiceWorker',
+  'BroadcastChannel',
+  'EventSource',
+  'indexedDB',
+  'caches',
+  'Function',
+  'eval',
+  'globalThis',
+  'Intl',
+  'Blob',
+  'URL',
+  'location',
+] as const;
+
+export const RUNJS_ALLOWED_BARE_GLOBAL_NAMES = [
+  'ctx',
+  'console',
+  'window',
+  'document',
+  'navigator',
+  'setTimeout',
+  'clearTimeout',
+  'setInterval',
+  'clearInterval',
+  'Array',
+  'ArrayBuffer',
+  'BigInt',
+  'BigInt64Array',
+  'BigUint64Array',
+  'Boolean',
+  'DataView',
+  'Date',
+  'Error',
+  'EvalError',
+  'FinalizationRegistry',
+  'Float32Array',
+  'Float64Array',
+  'Int8Array',
+  'Int16Array',
+  'Int32Array',
+  'Map',
+  'Math',
+  'Number',
+  'Object',
+  'Promise',
+  'Proxy',
+  'RangeError',
+  'ReferenceError',
+  'Reflect',
+  'RegExp',
+  'Set',
+  'String',
+  'Symbol',
+  'SyntaxError',
+  'TypeError',
+  'URIError',
+  'Uint8Array',
+  'Uint8ClampedArray',
+  'Uint16Array',
+  'Uint32Array',
+  'WeakMap',
+  'WeakRef',
+  'WeakSet',
+  'JSON',
+  'decodeURI',
+  'decodeURIComponent',
+  'encodeURI',
+  'encodeURIComponent',
+  'isFinite',
+  'isNaN',
+  'parseFloat',
+  'parseInt',
+  'undefined',
+  'NaN',
+  'Infinity',
+  ...RUNJS_BROWSER_GLOBAL_NAMES,
+] as const;
+
+function collectRunJSBrowserGlobals(providedGlobals: Record<string, unknown> = {}) {
+  const windowGlobal = providedGlobals.window;
+  if (!windowGlobal || typeof windowGlobal !== 'object') {
+    return {};
+  }
+
+  const windowRecord = windowGlobal as Record<string, unknown>;
+  const globals: Record<string, unknown> = {};
+  RUNJS_BROWSER_GLOBAL_NAMES.forEach((name) => {
+    if (Object.prototype.hasOwnProperty.call(providedGlobals, name)) {
+      return;
+    }
+    try {
+      const value = windowRecord[name];
+      if (typeof value === 'undefined') {
+        return;
+      }
+      globals[name] = name === 'fetch' && typeof value === 'function' ? value.bind(windowGlobal) : value;
+    } catch {
+      // Ignore browser globals that cannot be read in the current environment.
+    }
+  });
+  return globals;
+}
+
 // Heuristic: detect likely bare `{{ctx.xxx}}` usage in executable positions (not quoted string literals).
 const BARE_CTX_TEMPLATE_RE = /(^|[=(:,[\s)])(\{\{\s*(ctx(?:\.|\[|\?\.)[^}]*)\s*\}\})/m;
 
@@ -98,31 +209,7 @@ export class JSRunner {
     };
 
     const providedGlobals = options.globals || {};
-    const liftedGlobals: Record<string, any> = {};
-
-    // Auto-lift selected globals from safe window into top-level sandbox globals
-    // so user code can access them directly (e.g. `new Blob(...)`).
-    if (!Object.prototype.hasOwnProperty.call(providedGlobals, 'Blob')) {
-      try {
-        const blobCtor = (providedGlobals as any).window?.Blob;
-        if (typeof blobCtor !== 'undefined') {
-          liftedGlobals.Blob = blobCtor;
-        }
-      } catch {
-        // ignore when window proxy blocks property access
-      }
-    }
-
-    if (!Object.prototype.hasOwnProperty.call(providedGlobals, 'URL')) {
-      try {
-        const urlCtor = (providedGlobals as any).window?.URL;
-        if (typeof urlCtor !== 'undefined') {
-          liftedGlobals.URL = urlCtor;
-        }
-      } catch {
-        // ignore when window proxy blocks property access
-      }
-    }
+    const liftedGlobals = collectRunJSBrowserGlobals(providedGlobals);
 
     this.globals = {
       console,

package/src/__tests__/JSRunner.test.ts

@@ -9,7 +9,6 @@
 
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { JSRunner, shouldPreprocessRunJSTemplates } from '../JSRunner';
-import { createSafeWindow } from '../utils';
 
 describe('JSRunner', () => {
   let originalSearch: string;
@@ -68,7 +67,7 @@ describe('JSRunner', () => {
 
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
       },
     });
 
@@ -84,7 +83,7 @@ describe('JSRunner', () => {
 
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
         Blob: explicitBlob,
       },
     });
@@ -97,7 +96,7 @@ describe('JSRunner', () => {
   it('auto-lifts URL from injected window to top-level globals', async () => {
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
       },
     });
 
@@ -114,7 +113,7 @@ describe('JSRunner', () => {
 
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
         URL: explicitURL,
       },
     });

package/src/__tests__/flowContext.test.ts

@@ -177,6 +177,49 @@ describe('FlowContext properties and methods', () => {
     });
   });
 
+  it('should expose current role as a top-level variable', async () => {
+    const engine = new FlowEngine();
+    const ctx = engine.context;
+    ctx.defineProperty('api', { value: { auth: { role: 'admin' } } });
+
+    expect(ctx.role).toBe('admin');
+    await expect(ctx.resolveJsonTemplate('{{ ctx.role }}')).resolves.toBe('admin');
+
+    const roleNode = ctx.getPropertyMetaTree().find((node) => node.name === 'role');
+    expect(roleNode).toMatchObject({
+      name: 'role',
+      title: '{{t("Current role")}}',
+      paths: ['role'],
+    });
+  });
+
+  it('should expose actual role names for union role mode', async () => {
+    const engine = new FlowEngine();
+    const ctx = engine.context;
+    ctx.defineProperty('api', { value: { auth: { role: '__union__' } } });
+    ctx.defineProperty('user', {
+      value: {
+        roles: [
+          { name: 'admin', title: 'Admin' },
+          { name: 'member', title: 'Member' },
+        ],
+      },
+    });
+
+    expect(ctx.role).toEqual(['admin', 'member']);
+    await expect(ctx.resolveJsonTemplate('{{ ctx.role }}')).resolves.toEqual(['admin', 'member']);
+  });
+
+  it('should expose an empty role list for union role mode without user roles', async () => {
+    const engine = new FlowEngine();
+    const ctx = engine.context;
+    ctx.defineProperty('api', { value: { auth: { role: '__union__' } } });
+    ctx.defineProperty('user', { value: {} });
+
+    expect(ctx.role).toEqual([]);
+    await expect(ctx.resolveJsonTemplate('{{ ctx.role }}')).resolves.toEqual([]);
+  });
+
   it('should throw sync error in get', () => {
     const ctx = new FlowContext();
     ctx.defineProperty('error', {

package/src/__tests__/flowModel.openView.navigation.test.ts

@@ -104,4 +104,32 @@ describe('FlowModelContext.openView - navigation enforcement', () => {
     expect(child.dispatchEvent).toHaveBeenCalledTimes(1);
     expect(child.dispatchEvent.mock.calls[0][0]).toBe('click');
   });
+
+  it('inherits current model input args when opening an external popup', async () => {
+    const { parent, child } = setup();
+    parent['getInputArgs'] = vi.fn(() => ({
+      filterByTk: 2,
+      sourceId: 10,
+      defaultInputKeys: ['filterByTk', 'sourceId'],
+    }));
+
+    await (parent.context as any).openView('child-uid', { mode: 'dialog' });
+
+    expect(child.dispatchEvent).toHaveBeenCalledTimes(1);
+    expect(child.dispatchEvent.mock.calls[0][1]).toMatchObject({
+      mode: 'dialog',
+      filterByTk: 2,
+      sourceId: 10,
+    });
+    expect(child.dispatchEvent.mock.calls[0][1]).not.toHaveProperty('defaultInputKeys');
+  });
+
+  it('does not debounce external popup dispatches', async () => {
+    const { parent, child } = setup();
+
+    await (parent.context as any).openView('child-uid', { mode: 'dialog', filterByTk: 1 });
+
+    expect(child.dispatchEvent).toHaveBeenCalledTimes(1);
+    expect(child.dispatchEvent.mock.calls[0][2]).toBeUndefined();
+  });
 });

package/src/components/dnd/index.tsx

@@ -35,6 +35,10 @@ type ToolbarDragAnchorDetail = {
   point: ToolbarDragAnchorPoint | null;
 };
 
+const getToolbarModelUidFromNode = (node: HTMLElement | null): string | null => {
+  return node?.closest<HTMLElement>('.nb-toolbar-container[data-model-uid]')?.getAttribute('data-model-uid') || null;
+};
+
 export const resolveOverlayAnchorTransform = ({
   activeId,
   active,
@@ -62,7 +66,7 @@ export const resolveOverlayAnchorTransform = ({
 const resolveDraggableHostNode = (activatorNode: HTMLElement | null) => {
   const ownerDocument = activatorNode?.ownerDocument;
   const floatToolbarContainer = activatorNode?.closest<HTMLElement>('.nb-toolbar-container[data-model-uid]');
-  const toolbarModelUid = floatToolbarContainer?.getAttribute('data-model-uid');
+  const toolbarModelUid = getToolbarModelUidFromNode(activatorNode);
 
   if (!ownerDocument || !toolbarModelUid) {
     return activatorNode;
@@ -95,6 +99,7 @@ export const DragHandler: FC<{ model: FlowModel; children?: React.ReactNode }> =
   const dragHandlerRef = useRef<HTMLSpanElement | null>(null);
   const draggableNodeRef = useRef<HTMLElement | null>(null);
   const pointerPressCleanupRef = useRef<(() => void) | null>(null);
+  const toolbarDragModelUidRef = useRef<string | null>(null);
   const isDraggingRef = useRef(isDragging);
   const isPointerPressActiveRef = useRef(false);
   const isToolbarDragActiveRef = useRef(false);
@@ -126,9 +131,13 @@ export const DragHandler: FC<{ model: FlowModel; children?: React.ReactNode }> =
         return;
       }
 
+      const toolbarModelUid =
+        getToolbarModelUidFromNode(dragHandlerRef.current) || toolbarDragModelUidRef.current || model.uid;
+      toolbarDragModelUidRef.current = active ? toolbarModelUid : null;
+
       ownerDocument.dispatchEvent(
         new CustomEvent(TOOLBAR_DRAG_ACTIVITY_EVENT, {
-          detail: { active, modelUid: model.uid },
+          detail: { active, modelUid: toolbarModelUid },
         }),
       );
     },

package/src/components/settings/wrappers/contextual/FlowsFloatContextMenu.tsx

@@ -11,6 +11,7 @@ import React, { useState, useCallback, useRef, useEffect, useMemo } from 'react'
 import { createPortal } from 'react-dom';
 import { Alert, Space } from 'antd';
 import { css } from '@emotion/css';
+import { useMemoizedFn } from 'ahooks';
 import { FlowModel } from '../../../../models';
 import { ToolbarItemConfig } from '../../../../types';
 import { useFlowModelById } from '../../../../hooks';
@@ -394,6 +395,49 @@ const isModelByIdProps = (props: FlowsFloatContextMenuProps): props is ModelById
   return 'uid' in props && 'modelClassName' in props && Boolean(props.uid) && Boolean(props.modelClassName);
 };
 
+const stopResizeInteractionEvent = (event?: MouseEvent | React.MouseEvent) => {
+  if (!event) {
+    return;
+  }
+
+  event.preventDefault();
+  event.stopPropagation();
+
+  const nativeEvent = 'nativeEvent' in event ? event.nativeEvent : event;
+  nativeEvent.stopImmediatePropagation?.();
+};
+
+const pendingResizeClickSuppressions = new WeakMap<
+  Document,
+  { listener: (event: MouseEvent) => void; timer: number }
+>();
+
+const clearPendingResizeClickSuppression = (ownerDocument: Document) => {
+  const pending = pendingResizeClickSuppressions.get(ownerDocument);
+  if (!pending) {
+    return;
+  }
+
+  ownerDocument.removeEventListener('click', pending.listener, true);
+  (ownerDocument.defaultView || window).clearTimeout(pending.timer);
+  pendingResizeClickSuppressions.delete(ownerDocument);
+};
+
+const suppressNextResizeClick = (ownerDocument: Document) => {
+  clearPendingResizeClickSuppression(ownerDocument);
+
+  const listener = (event: MouseEvent) => {
+    stopResizeInteractionEvent(event);
+    clearPendingResizeClickSuppression(ownerDocument);
+  };
+  const timer = (ownerDocument.defaultView || window).setTimeout(() => {
+    clearPendingResizeClickSuppression(ownerDocument);
+  }, 0);
+
+  pendingResizeClickSuppressions.set(ownerDocument, { listener, timer });
+  ownerDocument.addEventListener('click', listener, true);
+};
+
 /**
  * FlowsFloatContextMenu组件 - 悬浮配置工具栏组件
  *
@@ -442,55 +486,80 @@ const ResizeHandles: React.FC<{
   const isDraggingRef = useRef<boolean>(false);
   const dragTypeRef = useRef<'left' | 'right' | null>(null);
   const dragStartPosRef = useRef<{ x: number; y: number }>({ x: 0, y: 0 });
+  const dragOwnerDocumentRef = useRef<Document | null>(null);
   const { onDragStart, onDragEnd } = props;
 
   // 把拖拽位移转成上层已约定的 resize 事件。
-  const handleDragMove = useCallback(
-    (e: MouseEvent) => {
-      if (!isDraggingRef.current || !dragTypeRef.current) return;
-
-      const deltaX = e.clientX - dragStartPosRef.current.x;
-
-      switch (dragTypeRef.current) {
-        case 'left':
-          props.model.parent.emitter.emit('onResizeLeft', { resizeDistance: -deltaX, model: props.model });
-          break;
-        case 'right':
-          props.model.parent.emitter.emit('onResizeRight', { resizeDistance: deltaX, model: props.model });
-          break;
-      }
-    },
-    [props.model],
-  );
+  const handleDragMove = useMemoizedFn((e: MouseEvent) => {
+    if (!isDraggingRef.current || !dragTypeRef.current) return;
+
+    stopResizeInteractionEvent(e);
+    const deltaX = e.clientX - dragStartPosRef.current.x;
+
+    switch (dragTypeRef.current) {
+      case 'left':
+        props.model.parent.emitter.emit('onResizeLeft', { resizeDistance: -deltaX, model: props.model });
+        break;
+      case 'right':
+        props.model.parent.emitter.emit('onResizeRight', { resizeDistance: deltaX, model: props.model });
+        break;
+    }
+  });
+
+  const handleDragEnd = useMemoizedFn((e?: MouseEvent) => {
+    if (!isDraggingRef.current) {
+      return;
+    }
+
+    stopResizeInteractionEvent(e);
+    const ownerDocument = dragOwnerDocumentRef.current || document;
+
+    ownerDocument.removeEventListener('mousemove', handleDragMove, true);
+    ownerDocument.removeEventListener('mouseup', handleDragEnd, true);
+    suppressNextResizeClick(ownerDocument);
 
-  const handleDragEnd = useCallback(() => {
     isDraggingRef.current = false;
     dragTypeRef.current = null;
     dragStartPosRef.current = { x: 0, y: 0 };
-
-    document.removeEventListener('mousemove', handleDragMove);
-    document.removeEventListener('mouseup', handleDragEnd);
+    dragOwnerDocumentRef.current = null;
 
     props.model.parent.emitter.emit('onResizeEnd');
     onDragEnd?.();
-  }, [handleDragMove, onDragEnd, props.model]);
+  });
+
+  useEffect(() => {
+    return () => {
+      const dragOwnerDocument = dragOwnerDocumentRef.current;
+      dragOwnerDocument?.removeEventListener('mousemove', handleDragMove, true);
+      dragOwnerDocument?.removeEventListener('mouseup', handleDragEnd, true);
+
+      if (isDraggingRef.current) {
+        suppressNextResizeClick(dragOwnerDocument || document);
+        props.model.parent.emitter.emit('onResizeEnd');
+        onDragEnd?.();
+      }
 
-  const handleDragStart = useCallback(
-    (e: React.MouseEvent, type: 'left' | 'right') => {
-      e.preventDefault();
-      e.stopPropagation();
+      isDraggingRef.current = false;
+      dragTypeRef.current = null;
+      dragStartPosRef.current = { x: 0, y: 0 };
+      dragOwnerDocumentRef.current = null;
+    };
+  }, [handleDragMove, handleDragEnd, onDragEnd, props.model]);
 
-      isDraggingRef.current = true;
-      dragTypeRef.current = type;
-      dragStartPosRef.current = { x: e.clientX, y: e.clientY };
+  const handleDragStart = useMemoizedFn((e: React.MouseEvent, type: 'left' | 'right') => {
+    stopResizeInteractionEvent(e);
+    const ownerDocument = e.currentTarget.ownerDocument;
 
-      document.addEventListener('mousemove', handleDragMove);
-      document.addEventListener('mouseup', handleDragEnd);
+    isDraggingRef.current = true;
+    dragTypeRef.current = type;
+    dragStartPosRef.current = { x: e.clientX, y: e.clientY };
+    dragOwnerDocumentRef.current = ownerDocument;
 
-      onDragStart?.();
-    },
-    [handleDragMove, handleDragEnd, onDragStart],
-  );
+    ownerDocument.addEventListener('mousemove', handleDragMove, true);
+    ownerDocument.addEventListener('mouseup', handleDragEnd, true);
+
+    onDragStart?.();
+  });
 
   return (
     <>
@@ -601,6 +670,7 @@ const FlowsFloatContextMenuWithModel: React.FC<ModelProvidedProps> = observer(
         getPopupContainer,
         handleSettingsMenuOpenChange,
         model,
+        modelUid,
         settingsMenuLevel,
         showCopyUidButton,
         showDeleteButton,