@nocobase/flow-engine 2.3.0-alpha.1 → 2.3.0-beta.2

package/lib/views/createViewMeta.js

@@ -33,6 +33,13 @@ __export(createViewMeta_exports, {
 });
 module.exports = __toCommonJS(createViewMeta_exports);
 var import_variablesParams = require("../utils/variablesParams");
+function buildPopupSourceRecordRef(ref) {
+  if ((ref == null ? void 0 : ref.sourceId) == null || ref.sourceId === "" || typeof ref.associationName !== "string") return void 0;
+  const collection = ref.associationName.split(".")[0];
+  if (!collection) return void 0;
+  return { collection, dataSourceKey: ref.dataSourceKey || "main", filterByTk: ref.sourceId };
+}
+__name(buildPopupSourceRecordRef, "buildPopupSourceRecordRef");
 function isDefined(value) {
   return value !== void 0 && value !== null;
 }
@@ -306,9 +313,11 @@ function createPopupMeta(ctx, anchorView) {
             let level = 1;
             let parentRef = await getParentRecordRef(level, c);
             while (parentRef) {
-              if (!cur.parent) cur.parent = {};
-              cur.parent.record = parentRef;
-              cur = cur.parent;
+              const parent = { record: parentRef };
+              const sourceRecord = buildPopupSourceRecordRef(parentRef);
+              if (sourceRecord) parent.sourceRecord = sourceRecord;
+              cur.parent = parent;
+              cur = parent;
               level += 1;
               parentRef = await getParentRecordRef(level, c);
             }
@@ -317,19 +326,12 @@ function createPopupMeta(ctx, anchorView) {
           (_b = (_a = c.logger) == null ? void 0 : _a.debug) == null ? void 0 : _b.call(_a, { err }, "[FlowEngine] buildVariablesParams: build parent-chain failed");
         }
         try {
-          const srcId = inputArgs == null ? void 0 : inputArgs.sourceId;
-          const assoc = inputArgs == null ? void 0 : inputArgs.associationName;
-          const dsKey = (inputArgs == null ? void 0 : inputArgs.dataSourceKey) || "main";
-          if (srcId != null && srcId !== "" && assoc && typeof assoc === "string") {
-            const parentCollectionName = String(assoc).split(".")[0];
-            if (parentCollectionName) {
-              params.sourceRecord = {
-                collection: parentCollectionName,
-                dataSourceKey: dsKey,
-                filterByTk: srcId
-              };
-            }
-          }
+          const sourceRecord = buildPopupSourceRecordRef({
+            sourceId: inputArgs == null ? void 0 : inputArgs.sourceId,
+            associationName: inputArgs == null ? void 0 : inputArgs.associationName,
+            dataSourceKey: inputArgs == null ? void 0 : inputArgs.dataSourceKey
+          });
+          if (sourceRecord) params.sourceRecord = sourceRecord;
         } catch (err) {
           (_d = (_c = c.logger) == null ? void 0 : _c.debug) == null ? void 0 : _d.call(_c, { err }, "[FlowEngine] buildVariablesParams: infer sourceRecord failed");
         }
@@ -426,10 +428,11 @@ function createPopupMeta(ctx, anchorView) {
 }
 __name(createPopupMeta, "createPopupMeta");
 async function buildPopupRuntime(ctx, view) {
-  var _a;
+  var _a, _b, _c;
   const stack = getViewStack(view);
   const currentIndex = getAnchoredViewStackIndex(view, stack);
-  const openerUids = (_a = view == null ? void 0 : view.inputArgs) == null ? void 0 : _a.openerUids;
+  const sourceRecord = (_b = (_a = view == null ? void 0 : view.inputArgs) == null ? void 0 : _a.parentItem) == null ? void 0 : _b.value;
+  const openerUids = (_c = view == null ? void 0 : view.inputArgs) == null ? void 0 : _c.openerUids;
   const hasOpener = Array.isArray(openerUids) && openerUids.length > 0;
   const hasStackPopup = currentIndex >= 1;
   const isPopup = hasStackPopup || hasOpener;
@@ -446,16 +449,17 @@ async function buildPopupRuntime(ctx, view) {
         associationName: args.associationName,
         filterByTk: args.filterByTk,
         sourceId: args.sourceId
-      }
+      },
+      ...typeof sourceRecord !== "undefined" ? { sourceRecord } : {}
     };
   }
   const buildNode = /* @__PURE__ */ __name(async (idx) => {
-    var _a2, _b, _c, _d, _e, _f;
+    var _a2, _b2, _c2, _d, _e, _f;
     if (idx < 0 || !((_a2 = stack[idx]) == null ? void 0 : _a2.viewUid)) return void 0;
     const viewUid = stack[idx].viewUid;
-    let model = (_b = ctx.engine) == null ? void 0 : _b.getModel(viewUid, true);
+    let model = (_b2 = ctx.engine) == null ? void 0 : _b2.getModel(viewUid, true);
     if (!model) {
-      model = await ((_c = ctx.engine) == null ? void 0 : _c.loadModel({ uid: viewUid }));
+      model = await ((_c2 = ctx.engine) == null ? void 0 : _c2.loadModel({ uid: viewUid }));
     }
     const p = ((_d = model == null ? void 0 : model.getStepParams) == null ? void 0 : _d.call(model, "popupSettings", "openView")) || {};
     const collectionName = p == null ? void 0 : p.collectionName;
@@ -475,16 +479,43 @@ async function buildPopupRuntime(ctx, view) {
     return node;
   }, "buildNode");
   const currentNode = await buildNode(currentIndex);
+  if (currentNode && typeof sourceRecord !== "undefined") {
+    currentNode.sourceRecord = sourceRecord;
+  }
   return currentNode;
 }
 __name(buildPopupRuntime, "buildPopupRuntime");
 function registerPopupVariable(ctx, view) {
   const POPUP_SERVER_PATH_RE = /^(?:record|sourceRecord)(?:\.|$)|^parent(?:\.parent)*(?:\.(?:record|sourceRecord))(?:\.|$)/;
+  const shouldResolveSourceRecordOnServer = /* @__PURE__ */ __name((path) => {
+    var _a, _b;
+    if (path !== "sourceRecord" && !path.startsWith("sourceRecord.")) return false;
+    const parentItem = (_a = view == null ? void 0 : view.inputArgs) == null ? void 0 : _a.parentItem;
+    if (typeof (parentItem == null ? void 0 : parentItem.value) === "undefined") return true;
+    const sourcePath = path === "sourceRecord" ? "" : path.slice("sourceRecord.".length);
+    if (!sourcePath) return false;
+    const parentItemResolver = (_b = view == null ? void 0 : view.inputArgs) == null ? void 0 : _b.parentItemResolver;
+    if (typeof parentItemResolver === "function") {
+      return parentItemResolver(`value.${sourcePath}`);
+    }
+    const segments = sourcePath.split(".").filter(Boolean);
+    let current = parentItem.value;
+    for (const segment of segments) {
+      if (current === null || typeof current !== "object" || !(segment in current)) {
+        return true;
+      }
+      current = current[segment];
+    }
+    return false;
+  }, "shouldResolveSourceRecordOnServer");
   ctx.defineProperty("popup", {
     get: /* @__PURE__ */ __name(async () => buildPopupRuntime(ctx, view), "get"),
     meta: createPopupMeta(ctx, view),
     resolveOnServer: /* @__PURE__ */ __name((p) => {
       try {
+        if (p === "sourceRecord" || p.startsWith("sourceRecord.")) {
+          return shouldResolveSourceRecordOnServer(p);
+        }
         return !!p && POPUP_SERVER_PATH_RE.test(p);
       } catch (_) {
         return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/flow-engine",
-  "version": "2.3.0-alpha.1",
+  "version": "2.3.0-beta.2",
   "private": false,
   "description": "A standalone flow engine for NocoBase, managing workflows, models, and actions.",
   "main": "lib/index.js",
@@ -8,8 +8,8 @@
   "dependencies": {
     "@formily/antd-v5": "1.x",
     "@formily/reactive": "2.x",
-    "@nocobase/sdk": "2.3.0-alpha.1",
-    "@nocobase/shared": "2.3.0-alpha.1",
+    "@nocobase/sdk": "2.3.0-beta.2",
+    "@nocobase/shared": "2.3.0-beta.2",
     "ahooks": "^3.7.2",
     "axios": "^1.7.0",
     "dayjs": "^1.11.9",
@@ -37,5 +37,5 @@
   ],
   "author": "NocoBase Team",
   "license": "Apache-2.0",
-  "gitHead": "2377df8ceb12549149017f7f14a61207bf6e49a2"
+  "gitHead": "2e5b43a39d3f3e7cff58cb5e5a36a8c8e599dfb5"
 }

package/src/__tests__/createViewMeta.popup.test.ts

@@ -11,7 +11,7 @@ import { describe, it, expect, vi } from 'vitest';
 import { FlowContext } from '../flowContext';
 import { FlowEngine } from '../flowEngine';
 import type { FlowView } from '../views/FlowView';
-import { buildPopupRuntime, createPopupMeta } from '../views/createViewMeta';
+import { buildPopupRuntime, createPopupMeta, registerPopupVariable } from '../views/createViewMeta';
 
 describe('createPopupMeta - popup variables', () => {
   function makeCtx() {
@@ -167,6 +167,7 @@ describe('createPopupMeta - popup variables', () => {
   it('buildPopupRuntime anchors current popup even when the navigation stack already has a child popup', async () => {
     const { engine, ctx } = makeCtx();
     const parentView = makeNestedPopupView('parent-popup-uid', 13);
+    parentView.inputArgs.parentItem = { value: { id: 13, phone: '9999' } };
     mockNestedPopupModels(engine);
 
     const popup = await buildPopupRuntime(ctx, parentView);
@@ -179,6 +180,7 @@ describe('createPopupMeta - popup variables', () => {
       filterByTk: 13,
       sourceId: 13,
     });
+    expect(popup?.sourceRecord).toEqual({ id: 13, phone: '9999' });
   });
 
   it('buildVariablesParams(record) keeps the parent view record when a child popup is open', async () => {
@@ -314,4 +316,85 @@ describe('createPopupMeta - popup variables', () => {
     const props = typeof meta.properties === 'function' ? await (meta.properties as any)() : meta.properties || {};
     expect(props.record).toBeUndefined();
   });
+
+  it('uses the current parent item value for popup sourceRecord fields', async () => {
+    const { ctx } = makeCtx();
+    const parentItemResolver = vi.fn(() => false);
+    const anchorView: FlowView = {
+      type: 'dialog',
+      inputArgs: {
+        openerUids: ['opener-uid-1'],
+        viewUid: 'popup-uid',
+        dataSourceKey: 'main',
+        collectionName: 'roles',
+        associationName: 'users.roles',
+        sourceId: 1,
+        parentItem: { value: { id: 1, phone: '9999' } },
+        parentItemResolver,
+      },
+      Header: null,
+      Footer: null,
+      close: () => void 0,
+      update: () => void 0,
+    } as any;
+
+    registerPopupVariable(ctx, anchorView);
+
+    await expect(ctx.popup).resolves.toMatchObject({
+      sourceRecord: { id: 1, phone: '9999' },
+    });
+    expect(ctx.getPropertyOptions('popup')?.resolveOnServer?.('sourceRecord.phone')).toBe(false);
+    expect(parentItemResolver).toHaveBeenCalledWith('value.phone');
+  });
+
+  it('resolves a popup sourceRecord field from the current parent item without a server request', async () => {
+    const engine = new FlowEngine();
+    const ctx = engine.context;
+    const anchorView: FlowView = {
+      type: 'dialog',
+      inputArgs: {
+        openerUids: ['opener-uid-1'],
+        viewUid: 'popup-uid',
+        dataSourceKey: 'main',
+        collectionName: 'roles',
+        associationName: 'users.roles',
+        sourceId: 1,
+        parentItem: { value: { id: 1, phone: '9999' } },
+        parentItemResolver: () => false,
+      },
+      Header: null,
+      Footer: null,
+      close: () => void 0,
+      update: () => void 0,
+    } as any;
+
+    registerPopupVariable(ctx, anchorView);
+
+    await expect(ctx.resolveJsonTemplate('{{ ctx.popup.sourceRecord.phone }}')).resolves.toBe('9999');
+  });
+
+  it('keeps server resolution for popup sourceRecord association subpaths', async () => {
+    const { ctx } = makeCtx();
+    const anchorView: FlowView = {
+      type: 'dialog',
+      inputArgs: {
+        openerUids: ['opener-uid-1'],
+        viewUid: 'popup-uid',
+        dataSourceKey: 'main',
+        collectionName: 'roles',
+        associationName: 'users.roles',
+        sourceId: 1,
+        parentItem: { value: { id: 1, departmentId: 2 } },
+        parentItemResolver: (path: string) => path === 'value.department.title',
+      },
+      Header: null,
+      Footer: null,
+      close: () => void 0,
+      update: () => void 0,
+    } as any;
+
+    registerPopupVariable(ctx, anchorView);
+
+    expect(ctx.getPropertyOptions('popup')?.resolveOnServer?.('sourceRecord.department.title')).toBe(true);
+  });
 });

package/src/__tests__/flowContext.test.ts

@@ -16,6 +16,7 @@ import { RunJSContextRegistry } from '../runjs-context/registry';
 import { setupRunJSContexts } from '../runjs-context/setup';
 import { createViewScopedEngine } from '../ViewScopedFlowEngine';
 import { DATA_SOURCE_DIRTY_EVENT } from '../views/viewEvents';
+import { serializeCtxDateExpressionConfig } from '../utils/dateVariable';
 
 describe('FlowContext properties and methods', () => {
   it('should return static property value', () => {
@@ -2068,10 +2069,16 @@ describe('getPropertyMetaTree with deep delegate meta', () => {
 describe('FlowContext resolveOnServer selective server resolution', () => {
   it('resolves ctx.date expressions on client context', async () => {
     const engine = new FlowEngine();
+    const formattedToday = serializeCtxDateExpressionConfig({
+      kind: 'preset',
+      preset: 'today',
+      format: 'YYYY/MM/DD',
+    });
     const out = await (engine.context as any).resolveJsonTemplate({
       today: '{{ ctx.date.preset.today }}',
       next12: '{{ ctx.date.relative.next.day.n12 }}',
       now: '{{ ctx.date.preset.now }}',
+      formattedToday,
     });
 
     expect(typeof out.today).toBe('string');
@@ -2080,6 +2087,7 @@ describe('FlowContext resolveOnServer selective server resolution', () => {
     expect(out.next12).toMatch(/^\d{4}-\d{2}-\d{2}$/);
     expect(typeof out.now).toBe('string');
     expect(out.now.length).toBeGreaterThan(0);
+    expect(out.formattedToday).toMatch(/^\d{4}\/\d{2}\/\d{2}$/);
   });
 
   it('does not call server by default (no resolveOnServer set)', async () => {

package/src/__tests__/objectVariable.test.ts

@@ -8,6 +8,7 @@
  */
 
 import { describe, expect, it, vi } from 'vitest';
+import { generateFlowModelRdFromToken } from '@nocobase/utils/client';
 import { FlowContext } from '../flowContext';
 import { FlowEngine } from '../flowEngine';
 import {
@@ -122,7 +123,10 @@ describe('objectVariable utilities', () => {
 
     // Provide API stub to intercept variables:resolve
     const calls: any[] = [];
+    const payload = Buffer.from(JSON.stringify({ userId: 1, signInTime: 'contract-owner-test' })).toString('base64url');
+    const token = `test.${payload}.sig`;
     (ctx as any).api = {
+      auth: { token },
       request: vi.fn(async ({ url, data, method }) => {
         calls.push({ url, data, method });
         const batch = (data?.values?.batch as any[]) || [];
@@ -146,13 +150,14 @@ describe('objectVariable utilities', () => {
     });
 
     const template = { x: '{{ ctx.obj.author.name }}' } as any;
-    await (ctx as any).resolveJsonTemplate(template);
+    await (ctx as any).resolveJsonTemplate(template, { contractModelUid: 'form-grid' });
 
     // Assert variables:resolve was called with proper flattened contextParams
     expect((ctx as any).api.request).toHaveBeenCalled();
     const call = calls.find((c) => c.url === 'variables:resolve');
     expect(call).toBeTruthy();
     const batch0 = call.data?.values?.batch?.[0];
+    expect(batch0?.contractRd).toBe(generateFlowModelRdFromToken('form-grid', token));
     expect(batch0?.contextParams).toBeTruthy();
     // Flattened key should be 'obj.author'
     const cp = batch0.contextParams as Record<string, any>;

package/src/__tests__/runjsFormSubmit.test.ts

@@ -0,0 +1,138 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { describe, expect, it, vi } from 'vitest';
+import { APIClient } from '@nocobase/sdk';
+import { FlowContext, FlowRunJSContext } from '../flowContext';
+import { JSItemRunJSContext } from '../runjs-context/contexts/JSItemRunJSContext';
+
+describe('FlowRunJSContext form submission', () => {
+  it('uses the form block RunJS submit capability without changing the native form', () => {
+    const nativeSubmit = vi.fn();
+    const getFieldsValue = vi.fn(() => ({ name: 'Alice' }));
+    const form = { submit: nativeSubmit, getFieldsValue };
+    const submitFromRunJs = vi.fn();
+    const delegate = new FlowContext();
+    delegate.defineProperty('form', { value: form });
+    delegate.defineProperty('blockModel', { value: { submitFromRunJs } });
+
+    const ctx = new JSItemRunJSContext(delegate);
+
+    expect(ctx.form.getFieldsValue()).toEqual({ name: 'Alice' });
+    ctx.form.submit();
+    expect(submitFromRunJs).toHaveBeenCalledOnce();
+    expect(nativeSubmit).not.toHaveBeenCalled();
+    expect(form.submit).toBe(nativeSubmit);
+  });
+
+  it('keeps the native submit method when the block has no RunJS submit capability', () => {
+    const nativeSubmit = vi.fn();
+    const form = { submit: nativeSubmit };
+    const delegate = new FlowContext();
+    delegate.defineProperty('form', { value: form });
+    delegate.defineProperty('blockModel', { value: {} });
+
+    const ctx = new FlowRunJSContext(delegate);
+
+    ctx.form.submit();
+    expect(nativeSubmit).toHaveBeenCalledOnce();
+  });
+
+  it('preserves nested form values and adds association paths to matching resource create calls', async () => {
+    const api = new APIClient();
+    const request = vi.spyOn(api.axios, 'request').mockResolvedValue({ data: { data: { id: 1 } } });
+    const values = { name: 'Alice', children: [{ name: 'Bob' }] };
+    const getFieldsValue = vi.fn(() => values);
+    const delegate = new FlowContext();
+    delegate.defineProperty('api', { value: api });
+    delegate.defineProperty('resource', {
+      value: {
+        getResourceName: () => 't1_user',
+        getDataSourceKey: () => 'main',
+        getUpdateAssociationValues: () => ['children'],
+      },
+    });
+    delegate.defineProperty('form', { value: { submit: vi.fn(), getFieldsValue } });
+    delegate.defineProperty('blockModel', { value: { submitFromRunJs: vi.fn() } });
+    const ctx = new FlowRunJSContext(delegate);
+
+    await ctx.api.resource('t1_user').create({ values: ctx.form.getFieldsValue(true) });
+
+    expect(getFieldsValue).toHaveBeenCalledWith(true);
+    expect(request).toHaveBeenCalledWith({
+      url: 't1_user:create',
+      method: 'post',
+      params: { updateAssociationValues: ['children'] },
+      data: values,
+    });
+  });
+
+  it('keeps explicit association params and unrelated resource calls unchanged', async () => {
+    const api = new APIClient();
+    const request = vi.spyOn(api.axios, 'request').mockResolvedValue({ data: { data: { id: 1 } } });
+    const delegate = new FlowContext();
+    delegate.defineProperty('api', { value: api });
+    delegate.defineProperty('resource', {
+      value: {
+        getResourceName: () => 't1_user',
+        getDataSourceKey: () => 'main',
+        getUpdateAssociationValues: () => ['children'],
+      },
+    });
+    delegate.defineProperty('form', { value: { submit: vi.fn() } });
+    delegate.defineProperty('blockModel', { value: { submitFromRunJs: vi.fn() } });
+    const ctx = new FlowRunJSContext(delegate);
+
+    await ctx.api.resource('t1_user').create({ values: {}, updateAssociationValues: [] });
+    await ctx.api.resource('t1_user').create({ values: {}, updateAssociationValues: null });
+    await ctx.api.resource('t1_user').create({ values: {}, updateAssociationValues: undefined });
+    await ctx.api.resource('posts').create({ values: { title: 'Post' } });
+    await ctx.api.resource('t1_user', undefined, { 'X-Data-Source': 'external' }).create({ values: { name: 'Bob' } });
+
+    expect(request.mock.calls.map(([config]) => config.params)).toEqual([
+      { updateAssociationValues: [] },
+      { updateAssociationValues: null },
+      { updateAssociationValues: undefined },
+      {},
+      {},
+    ]);
+  });
+
+  it('adds association paths only for the matching association source record', async () => {
+    const api = new APIClient();
+    const request = vi.spyOn(api.axios, 'request').mockResolvedValue({ data: { data: { id: 1 } } });
+    const delegate = new FlowContext();
+    delegate.defineProperty('api', { value: api });
+    delegate.defineProperty('resource', {
+      value: {
+        getResourceName: () => 'users.children',
+        getDataSourceKey: () => 'main',
+        getSourceId: () => 1,
+        getUpdateAssociationValues: () => ['toys'],
+      },
+    });
+    delegate.defineProperty('form', { value: { submit: vi.fn() } });
+    delegate.defineProperty('blockModel', { value: { submitFromRunJs: vi.fn() } });
+    const ctx = new FlowRunJSContext(delegate);
+
+    await ctx.api.resource('users.children', 1).create({ values: { name: 'same source' } });
+    await ctx.api.resource('users.children', 2).create({ values: { name: 'different source' } });
+
+    expect(request.mock.calls.map(([config]) => ({ url: config.url, params: config.params }))).toEqual([
+      {
+        url: 'users/1/children:create',
+        params: { updateAssociationValues: ['toys'] },
+      },
+      {
+        url: 'users/2/children:create',
+        params: {},
+      },
+    ]);
+  });
+});

package/src/acl/Acl.tsx

@@ -16,7 +16,7 @@ interface CheckOptions {
   actionName: string;
   fields?: string[];
   recordPkValue?: string | number;
-  allowedActions: any[];
+  allowedActions?: Record<string, Array<string | number>>;
 }
 
 export class ACL {
@@ -149,6 +149,41 @@ export class ACL {
     return allowed;
   }
 
+  can(options: CheckOptions): boolean {
+    const { allowAll } = this.data;
+    if (allowAll) {
+      return true;
+    }
+
+    const { actionName, allowedActions, recordPkValue } = options;
+    const hasRecordPkValue = recordPkValue !== undefined && recordPkValue !== null;
+    const recordPermission =
+      hasRecordPkValue && allowedActions ? this.verifyScope(actionName, recordPkValue, allowedActions) : null;
+    if (hasRecordPkValue && allowedActions && recordPermission !== true) {
+      return false;
+    }
+
+    const params = this.parseAction(options);
+    if (!params) {
+      return false;
+    }
+    if (!_.isEmpty(params.filter) && recordPermission !== true) {
+      return false;
+    }
+    if (!options.fields?.length) {
+      return true;
+    }
+
+    const allowedFields: string[] = []
+      .concat(params.whitelist || [])
+      .concat(params.fields || [])
+      .concat(params.appends || []);
+    if (!allowedFields.length) {
+      return true;
+    }
+    return options.fields.every((field) => allowedFields.includes(field));
+  }
+
   async aclCheck(options: CheckOptions): Promise<boolean> {
     // await this.load();
     const { allowAll } = this.data;

package/src/acl/__tests__/Acl.test.tsx

@@ -71,6 +71,76 @@ describe('ACL', () => {
     expect(notOk).toBe(false);
   });
 
+  it('checks record update scope before field permission', () => {
+    const payload = {
+      data: {
+        allowAll: false,
+        actionAlias: {},
+        resources: ['posts'],
+        actions: { 'posts:update': { whitelist: ['title'] } },
+        strategy: { actions: [] },
+      },
+    };
+    const engine = makeEngine(payload);
+    const acl = new ACL(engine);
+    acl.setData(payload.data);
+
+    const options = {
+      dataSourceKey: 'main',
+      resourceName: 'posts',
+      actionName: 'update',
+      allowedActions: {
+        update: [1],
+      },
+    };
+
+    expect(acl.can({ ...options, recordPkValue: 1, fields: ['title'] })).toBe(true);
+    expect(acl.can({ ...options, recordPkValue: 2, fields: ['title'] })).toBe(false);
+    expect(acl.can({ ...options, recordPkValue: 1, fields: ['body'] })).toBe(false);
+    expect(acl.can({ ...options, recordPkValue: 0, fields: ['title'] })).toBe(false);
+    expect(
+      acl.can({
+        dataSourceKey: 'main',
+        resourceName: 'posts',
+        actionName: 'update',
+        fields: ['title'],
+      }),
+    ).toBe(true);
+  });
+
+  it('allows every field when a scoped action has no field restriction', () => {
+    const payload = {
+      data: {
+        allowAll: false,
+        actionAlias: {},
+        resources: ['posts'],
+        actions: {
+          'posts:update': {
+            filter: { createdById: '{{ ctx.state.currentUser.id }}' },
+          },
+        },
+        strategy: { actions: [] },
+      },
+    };
+    const engine = makeEngine(payload);
+    const acl = new ACL(engine);
+    acl.setData(payload.data);
+
+    const options = {
+      dataSourceKey: 'main',
+      resourceName: 'posts',
+      actionName: 'update',
+      allowedActions: {
+        update: [1],
+      },
+      fields: ['title'],
+    };
+
+    expect(acl.can({ ...options, recordPkValue: 1 })).toBe(true);
+    expect(acl.can({ ...options, recordPkValue: 2 })).toBe(false);
+    expect(acl.can({ ...options, allowedActions: undefined, recordPkValue: undefined })).toBe(false);
+  });
+
   it('reloads permissions when auth token changes', async () => {
     const payload1 = {
       data: {

package/src/components/FlowContextSelector.tsx

@@ -311,6 +311,7 @@ const FlowContextSelectorComponent: React.FC<FlowContextSelectorProps> = ({
       const path = selectedValues.map(String);
       const pathString = path.join('.');
       const isLeaf = lastOption?.isLeaf;
+      const isSelectable = lastOption?.meta?.selectable !== false;
       const now = Date.now();
 
       // 使用自定义格式化函数或默认函数
@@ -325,6 +326,10 @@ const FlowContextSelectorComponent: React.FC<FlowContextSelectorProps> = ({
       }
 
       if (isLeaf) {
+        if (!isSelectable) {
+          setTempSelectedPath(path);
+          return;
+        }
         onChange?.(formattedValue, lastOption?.meta);
         // 选中叶子节点后，可清空内部临时路径（外部 value 将驱动级联）
         setTempSelectedPath([]);
@@ -333,7 +338,8 @@ const FlowContextSelectorComponent: React.FC<FlowContextSelectorProps> = ({
 
       // 非叶子节点：检查双击
       const lastSelected = lastSelectedRef.current;
-      const isDoubleClick = !onlyLeafSelectable && lastSelected?.path === pathString && now - lastSelected.time < 300;
+      const isDoubleClick =
+        isSelectable && !onlyLeafSelectable && lastSelected?.path === pathString && now - lastSelected.time < 300;
 
       if (isDoubleClick) {
         // 双击：选中非叶子节点

package/src/components/MobilePopup.tsx

@@ -26,26 +26,38 @@ interface MobilePopupProps {
   footer?: ReactNode;
 }
 
+const getMobilePopupMaxHeight = () => {
+  if (typeof CSS !== 'undefined' && CSS.supports?.('height', '100dvh')) {
+    return 'calc(100dvh - var(--nb-mobile-page-header-height, 46px))';
+  }
+
+  return 'calc(100vh - var(--nb-mobile-page-header-height, 46px))';
+};
+
 export const MobilePopup: FC<MobilePopupProps> = (props) => {
   const { title, visible, onClose: closePopup, children, minHeight, className, footer } = props;
   const { t } = useTranslation();
   const { componentCls, hashId } = useMobileActionDrawerStyle();
 
   const bodyStyles = (props as MobilePopupProps & { styles?: { body?: React.CSSProperties } }).styles?.body;
+  const defaultMaxHeight = getMobilePopupMaxHeight();
   const popupStyle = useMemo(() => {
     return {
       minHeight: bodyStyles?.minHeight ?? minHeight,
       height: bodyStyles?.height,
-      maxHeight: bodyStyles?.maxHeight,
+      maxHeight: bodyStyles?.maxHeight ?? defaultMaxHeight,
     };
-  }, [bodyStyles?.height, bodyStyles?.maxHeight, bodyStyles?.minHeight, minHeight]);
+  }, [bodyStyles?.height, bodyStyles?.maxHeight, bodyStyles?.minHeight, defaultMaxHeight, minHeight]);
 
-  const bodyStyle = useMemo(() => {
+  const bodyStyle = useMemo<React.CSSProperties>(() => {
     return {
       padding: 0,
+      maxHeight: defaultMaxHeight,
+      overflowY: 'auto',
+      overflowX: 'hidden',
       ...bodyStyles,
     };
-  }, [bodyStyles]);
+  }, [bodyStyles, defaultMaxHeight]);
 
   const handleCloseKeyDown = useCallback(
     (event: React.KeyboardEvent<HTMLSpanElement>) => {