@nocobase/plugin-ai 2.2.0-alpha.1 → 2.2.0-alpha.11

package/dist/ai/docs/nocobase/data-sources/main/mariadb.md

@@ -0,0 +1,59 @@
+---
+pkg: "@nocobase/plugin-data-source-manager"
+title: "Main data source - MariaDB"
+description: "Learn the supported version, plugin installation, usage, and field mapping for MariaDB as the NocoBase main database."
+keywords: "main data source,MariaDB,main database,field mapping,NocoBase"
+---
+
+# MariaDB
+
+## Introduction
+
+MariaDB can be used as the NocoBase main database. It stores NocoBase system-table data and business data in the main data source. Configure it when deploying NocoBase; it cannot be deleted after the application is running.
+
+| Setting | Description |
+| --- | --- |
+| Supported version | >= 10.9. |
+| Commercial editions | Community, Standard, Professional, and Enterprise. |
+| Database type | MariaDB. |
+
+MariaDB is similar to MySQL and is suitable as the main database for regular business systems.
+
+## Plugin installation
+
+MariaDB is built in and does not require a separate plugin.
+
+## Usage
+
+1. Select or enter MariaDB connection settings when deploying NocoBase.
+2. After NocoBase starts, open **Data source management**, select **Main**, and manage collections and fields in the main database.
+3. To connect tables that already exist in the database, use **Sync from database** on the main-database management page.
+4. When configuring fields, use [Collections](../data-modeling/collection.md) and [Collection fields](../data-modeling/collection-fields/index.md) to choose Field types and Field interfaces.
+
+## Field type mapping
+
+When you create a field in NocoBase, NocoBase creates the corresponding MariaDB column. When you synchronize an existing table, NocoBase maps the MariaDB column type to a suitable Field type and Field interface. You can adjust the display interface in field configuration.
+
+| MariaDB type | NocoBase Field type | Available Field interfaces |
+| --- | --- | --- |
+| `TINYINT`, `SMALLINT`, `MEDIUMINT` | `integer`, `boolean`, `sort` | Integer, Sort, Checkbox, Switch, Select, Radio group. |
+| `INT`, `INTEGER` | `integer`, `unixTimestamp`, `sort` | Integer, Sort, Unix timestamp, Select, Radio group. |
+| `BIGINT` | `bigInt`, `snowflakeId`, `unixTimestamp`, `sort` | Integer, Sort, Unix timestamp, Created at, Updated at. |
+| `FLOAT`, `DOUBLE` | `float` | Number, Percent. |
+| `DECIMAL` | `decimal` | Number, Percent, Currency. |
+| `CHAR`, `VARCHAR` | `string`, `uuid`, `nanoid`, `encryption` | Input, Email, Phone, Password, Color, Icon, Select, Radio group, UUID, Nano ID. |
+| `TINYTEXT`, `TEXT`, `MEDIUMTEXT`, `LONGTEXT` | `text` | Textarea, Markdown, Vditor, Rich text, URL. |
+| `DATE` | `dateOnly` | Date. |
+| `TIME` | `time` | Time. |
+| `DATETIME` | `datetimeNoTz`, `datetimeTz`, `date` | Date, Time, Created at, Updated at. |
+| `TIMESTAMP` | `datetimeTz`, `date` | Date, Time, Created at, Updated at. |
+| `YEAR` | `string`, `integer` | Input, Integer, Date. |
+| `JSON` | `json`, `array` | JSON. |
+
+:::warning Note
+
+Unsupported MariaDB types are shown separately in field configuration. They require development support before they can be used as normal NocoBase fields.
+
+:::
+
+For common configuration, see [Main database](./index.md).

package/dist/ai/docs/nocobase/data-sources/main/mysql.md

@@ -0,0 +1,59 @@
+---
+pkg: "@nocobase/plugin-data-source-manager"
+title: "Main data source - MySQL"
+description: "Learn the supported version, plugin installation, usage, and field mapping for MySQL as the NocoBase main database."
+keywords: "main data source,MySQL,main database,field mapping,NocoBase"
+---
+
+# MySQL
+
+## Introduction
+
+MySQL can be used as the NocoBase main database. It stores NocoBase system-table data and business data in the main data source. Configure it when deploying NocoBase; it cannot be deleted after the application is running.
+
+| Setting | Description |
+| --- | --- |
+| Supported version | >= 8.0.17. |
+| Commercial editions | Community, Standard, Professional, and Enterprise. |
+| Database type | MySQL. |
+
+MySQL is suitable as the main database for regular business systems.
+
+## Plugin installation
+
+MySQL is built in and does not require a separate plugin.
+
+## Usage
+
+1. Select or enter MySQL connection settings when deploying NocoBase.
+2. After NocoBase starts, open **Data source management**, select **Main**, and manage collections and fields in the main database.
+3. To connect tables that already exist in the database, use **Sync from database** on the main-database management page.
+4. When configuring fields, use [Collections](../data-modeling/collection.md) and [Collection fields](../data-modeling/collection-fields/index.md) to choose Field types and Field interfaces.
+
+## Field type mapping
+
+When you create a field in NocoBase, NocoBase creates the corresponding MySQL column. When you synchronize an existing table, NocoBase maps the MySQL column type to a suitable Field type and Field interface. You can adjust the display interface in field configuration.
+
+| MySQL type | NocoBase Field type | Available Field interfaces |
+| --- | --- | --- |
+| `TINYINT`, `SMALLINT`, `MEDIUMINT` | `integer`, `boolean`, `sort` | Integer, Sort, Checkbox, Switch, Select, Radio group. |
+| `INT`, `INTEGER` | `integer`, `unixTimestamp`, `sort` | Integer, Sort, Unix timestamp, Select, Radio group. |
+| `BIGINT` | `bigInt`, `snowflakeId`, `unixTimestamp`, `sort` | Integer, Sort, Unix timestamp, Created at, Updated at. |
+| `FLOAT`, `DOUBLE` | `float` | Number, Percent. |
+| `DECIMAL` | `decimal` | Number, Percent, Currency. |
+| `CHAR`, `VARCHAR` | `string`, `uuid`, `nanoid`, `encryption` | Input, Email, Phone, Password, Color, Icon, Select, Radio group, UUID, Nano ID. |
+| `TINYTEXT`, `TEXT`, `MEDIUMTEXT`, `LONGTEXT` | `text` | Textarea, Markdown, Vditor, Rich text, URL. |
+| `DATE` | `dateOnly` | Date. |
+| `TIME` | `time` | Time. |
+| `DATETIME` | `datetimeNoTz`, `datetimeTz`, `date` | Date, Time, Created at, Updated at. |
+| `TIMESTAMP` | `datetimeTz`, `date` | Date, Time, Created at, Updated at. |
+| `YEAR` | `string`, `integer` | Input, Integer, Date. |
+| `JSON` | `json`, `array` | JSON. |
+
+:::warning Note
+
+Unsupported MySQL types are shown separately in field configuration. They require development support before they can be used as normal NocoBase fields.
+
+:::
+
+For common configuration, see [Main database](./index.md).

package/dist/ai/docs/nocobase/data-sources/main/oceanbase.md

@@ -0,0 +1,62 @@
+---
+pkg: "@nocobase/plugin-data-source-oceanbase"
+title: "Main data source - OceanBase"
+description: "Learn the supported version, plugin installation, usage, and field mapping for OceanBase as the NocoBase main database."
+keywords: "main data source,OceanBase,main database,field mapping,NocoBase"
+---
+
+# OceanBase
+
+## Introduction
+
+OceanBase can be used as the NocoBase main database. It stores NocoBase system-table data and business data in the main data source. Configure it when deploying NocoBase; it cannot be deleted after the application is running.
+
+| Setting | Description |
+| --- | --- |
+| Supported version | >= 4.3. |
+| Commercial editions | Enterprise. |
+| Database type | MySQL compatibility mode. |
+
+:::warning Note
+
+OceanBase is supported as the main database only in MySQL compatibility mode.
+
+:::
+
+## Plugin installation
+
+OceanBase is provided by `@nocobase/plugin-data-source-oceanbase` and requires a commercial license.
+
+## Usage
+
+1. Select or enter OceanBase connection settings when deploying NocoBase.
+2. After NocoBase starts, open **Data source management**, select **Main**, and manage collections and fields in the main database.
+3. To connect tables that already exist in the database, use **Sync from database** on the main-database management page.
+4. When configuring fields, use [Collections](../data-modeling/collection.md) and [Collection fields](../data-modeling/collection-fields/index.md) to choose Field types and Field interfaces.
+
+## Field type mapping
+
+When you create a field in NocoBase, NocoBase creates the corresponding OceanBase column. When you synchronize an existing table, NocoBase uses MySQL-compatible mapping to select a suitable Field type and Field interface. You can adjust the display interface in field configuration.
+
+| OceanBase type | NocoBase Field type | Available Field interfaces |
+| --- | --- | --- |
+| `TINYINT`, `SMALLINT`, `MEDIUMINT` | `integer`, `boolean`, `sort` | Integer, Sort, Checkbox, Switch, Select, Radio group. |
+| `INT`, `INTEGER` | `integer`, `unixTimestamp`, `sort` | Integer, Sort, Unix timestamp, Select, Radio group. |
+| `BIGINT` | `bigInt`, `snowflakeId`, `unixTimestamp`, `sort` | Integer, Sort, Unix timestamp, Created at, Updated at. |
+| `FLOAT`, `DOUBLE` | `float` | Number, Percent. |
+| `DECIMAL` | `decimal` | Number, Percent, Currency. |
+| `CHAR`, `VARCHAR` | `string`, `uuid`, `nanoid`, `encryption` | Input, Email, Phone, Password, Color, Icon, Select, Radio group, UUID, Nano ID. |
+| `TEXT` | `text` | Textarea, Markdown, Vditor, Rich text, URL. |
+| `DATE` | `dateOnly` | Date. |
+| `TIME` | `time` | Time. |
+| `DATETIME` | `datetimeNoTz`, `datetimeTz`, `date` | Date, Time, Created at, Updated at. |
+| `TIMESTAMP` | `datetimeTz`, `date` | Date, Time, Created at, Updated at. |
+| `JSON` | `json`, `array` | JSON. |
+
+:::warning Note
+
+Unsupported OceanBase types are shown separately in field configuration. They require development support before they can be used as normal NocoBase fields.
+
+:::
+
+For common configuration, see [Main database](./index.md).

package/dist/ai/docs/nocobase/data-sources/main/postgresql.md

@@ -0,0 +1,61 @@
+---
+pkg: "@nocobase/plugin-data-source-manager"
+title: "Main data source - PostgreSQL"
+description: "Learn the supported version, plugin installation, usage, and field mapping for PostgreSQL as the NocoBase main database."
+keywords: "main data source,PostgreSQL,main database,field mapping,NocoBase"
+---
+
+# PostgreSQL
+
+## Introduction
+
+PostgreSQL can be used as the NocoBase main database. It stores NocoBase system-table data and business data in the main data source. Configure the main database when deploying NocoBase; it cannot be deleted after the application is running.
+
+| Setting | Description |
+| --- | --- |
+| Supported version | >= 10. |
+| Commercial editions | Community, Standard, Professional, and Enterprise. |
+| Database type | PostgreSQL. |
+
+PostgreSQL supports inheritance collections, which are suitable for data models that need inheritance.
+
+## Plugin installation
+
+PostgreSQL is built in and does not require a separate plugin.
+
+## Usage
+
+1. Select or enter PostgreSQL connection settings when deploying NocoBase.
+2. After NocoBase starts, open **Data source management**, select **Main**, and manage collections and fields in the main database.
+3. To connect tables that already exist in the database, use **Sync from database** on the main-database management page.
+4. When configuring fields, use [Collections](../data-modeling/collection.md) and [Collection fields](../data-modeling/collection-fields/index.md) to choose Field types and Field interfaces.
+
+## Field type mapping
+
+When you create a field in NocoBase, NocoBase creates the corresponding PostgreSQL column. When you synchronize an existing table, NocoBase maps the PostgreSQL column type to a suitable Field type and Field interface. You can adjust the display interface in field configuration.
+
+| PostgreSQL type | NocoBase Field type | Available Field interfaces |
+| --- | --- | --- |
+| `BOOLEAN` | `boolean` | Checkbox, Switch. |
+| `SMALLINT`, `INTEGER`, `SERIAL`, `SMALLSERIAL` | `integer`, `boolean`, `sort` | Integer, Sort, Checkbox, Switch, Select, Radio group. |
+| `BIGINT`, `BIGSERIAL` | `bigInt`, `sort` | Integer, Sort, Checkbox, Switch, Select, Radio group, Unix timestamp, Created at, Updated at. |
+| `REAL` | `float` | Number, Percent. |
+| `DOUBLE PRECISION` | `double` | Number, Percent. |
+| `DECIMAL`, `NUMERIC` | `decimal` | Number, Percent, Currency. |
+| `VARCHAR`, `CHAR` | `string`, `password`, `uuid`, `nanoid` | Input, Email, Phone, Password, Color, Icon, Select, Radio group, UUID, Nano ID. |
+| `TEXT` | `text`, `json` | Textarea, Markdown, Vditor, Rich text, URL, JSON. |
+| `UUID` | `uuid` | UUID. |
+| `JSON`, `JSONB` | `json` | JSON. |
+| `TIMESTAMP` | `date` | Date, Time, Created at, Updated at. |
+| `DATE` | `dateOnly` | Date. |
+| `TIME` | `time` | Time. |
+| `POINT`, `LINESTRING`, `POLYGON`, `CIRCLE` | `point`, `lineString`, `polygon`, `circle` | Point, Line string, Polygon, Circle, JSON. |
+| `ARRAY` | `array` | Multiple select, Checkbox group. |
+
+:::warning Note
+
+Unsupported PostgreSQL types are shown separately in field configuration. They require development support before they can be used as normal NocoBase fields.
+
+:::
+
+For common configuration, see [Main database](./index.md).

package/dist/ai/docs/nocobase/development/index.md

@@ -2,8 +2,8 @@
 pageType: home
 pageName: development
 title: "NocoBase Development Guide"
-description: "NocoBase development guide: plugin development, FlowEngine, RunJS, block/field/action extensions, data source extensions, workflow extensions, authentication extensions."
-keywords: "NocoBase,development guide,plugin development,FlowEngine,RunJS,NocoBase extensions"
+description: "NocoBase development guide: plugin development, shared components, FlowEngine, RunJS, block/field/action extensions, data source extensions, workflow extensions, authentication extensions."
+keywords: "NocoBase,development guide,plugin development,shared components,FlowEngine,RunJS,NocoBase extensions"
 features:
   - title: Core Development
     details: Master NocoBase's underlying extension mechanism and advanced development capabilities, including the plugin system, AI assistance, FlowEngine and RunJS environment, to build a solid development foundation.
@@ -24,6 +24,10 @@ features:
         details: JavaScript execution environment for JS blocks, JS fields, and JS actions, and similar scenarios.
         link: /runjs
         showOnHome: true
+      - title: Shared Components
+        details: Reuse the built-in form, filter, table, and icon components in NocoBase client v2 when building plugin pages.
+        link: /shared-components
+        showOnHome: true
   - title: Plugin Ecosystem
     details: Extend the capabilities of existing plugins through other plugins, building a hierarchical and modular plugin ecosystem to enhance system extensibility and collaboration.
     items:
@@ -46,4 +50,7 @@ features:
       - title: File Preview Extension
         details: Extend file preview capabilities to support online preview and rendering of more file formats.
         link: /file-manager/development
+      - title: Knowledge Base Extension
+        details: Connect external knowledge bases or custom retrieval services to extend RAG retrieval sources for AI employees.
+        link: /ai-employees/knowledge-base/dev/external-knowledge-base
 ---

package/dist/ai/docs/nocobase/file-manager/field-attachment.md

@@ -1,5 +1,11 @@
 # Attachment
 
+:::warning Note
+
+The Attachment field will be deprecated in a future version. For new apps or when adjusting existing business flows, migrate to a custom file collection as early as possible and manage related files with association fields.
+
+:::
+
 ## Introduction
 
 The system has a built-in "Attachment" field type to support file uploads in custom collections.

package/dist/ai/docs/nocobase/file-manager/file-preview/index.md

@@ -12,17 +12,8 @@ Currently, NocoBase provides the following file preview plugins:
 
 ## PDF preview with external storage
 
-PDF preview uses PDF.js to render files in the browser. The browser must first read the PDF file content and then pass it to PDF.js for rendering. Therefore, when files are stored in external storage such as OSS, S3, COS, or a CDN, and the file access domain is different from the NocoBase site domain, the external storage must allow the NocoBase site to read files across origins.
+NocoBase previews PDFs through a browser iframe. Some browsers or PDF readers may support scripts, forms, or other interactive content inside PDF files. If the previewed file comes from an untrusted source, pay attention to the security boundary for script execution.
 
-If CORS is not configured, PDF downloads can still work normally, but preview may fail with a file loading error.
+We recommend isolating the file access domain from the NocoBase site and API domains. For example, serve files from OSS, S3, COS, or a CDN through a dedicated domain, instead of sharing the same origin with the NocoBase frontend or API.
 
-The CORS configuration for external storage or CDN should include:
-
-```http
-Access-Control-Allow-Origin: https://your-nocobase-domain
-Access-Control-Allow-Methods: GET, HEAD
-Access-Control-Allow-Headers: *
-Access-Control-Expose-Headers: Content-Length, Content-Range, Accept-Ranges, Content-Disposition, Content-Type
-```
-
-`Access-Control-Allow-Origin` should be set to the actual domain used to access NocoBase. Avoid using `*` for non-public files over the long term, because it expands the range of sites that can read the files.
+If the file domain is different from the API domain, and the API does not enable CORS access for the file domain, scripts running in the PDF preview environment are usually restricted by the browser's same-origin policy. They cannot directly read the NocoBase page, browser storage, or API responses.

package/dist/ai/docs/nocobase/file-manager/stable-url.md

@@ -0,0 +1,87 @@
+---
+pkg: '@nocobase/plugin-file-manager'
+title: "Stable URL (proxy URL)"
+description: "Explains NocoBase stable file URLs, access permissions, redirects, temporary Office preview URLs, and behavior across file-related features."
+keywords: "stable URL,proxy URL,permanent URL,file access,file permissions,Office preview,NocoBase"
+---
+
+# Stable URL
+
+Files managed by a NocoBase storage engine are accessed through a **stable URL**. The URL first reaches NocoBase, where the file record and access permissions are checked, and then redirects to the actual URL generated by the storage engine.
+
+## URL format
+
+```text
+/files/<app>/<dataSource>/<collection>/<id><extname>
+```
+
+For example:
+
+```text
+/files/main/main/attachments/42.pdf
+```
+
+When `APP_PUBLIC_PATH=/nocobase` is configured, the URL starts with `/nocobase/files/`. The path identifies the app, data source, file collection, record ID, and extension. The ID and extension cannot be changed after creation, which keeps the URL stable for the lifetime of the record.
+
+## URL variants
+
+| Purpose | URL | Behavior |
+|---|---|---|
+| Open or embed | `/files/.../42.pdf` | Checks permission and redirects to the actual file URL |
+| Preview | `/files/.../42.png?preview=1` | Redirects to the preview or thumbnail URL |
+| Download | `/files/.../42.pdf?download=1` | Redirects with download semantics |
+| Office preview | `/files/.../42.xlsx?temporaryAccessToken=...` | Allows Microsoft Office Online Viewer to fetch one file for a short time |
+
+:::tip
+
+Use the `url` and `preview` values returned by NocoBase. Application code normally should not construct `/files` URLs or their query parameters.
+
+:::
+
+## Behavior across NocoBase
+
+- Attachment fields and file collections return stable URLs after upload and when records are queried
+- [HTTP API](./http-api.md) responses no longer expose local paths, storage domains, or presigned download URLs
+- Markdown uploads store the stable URL, including files in private S3, OSS, COS, or S3 Pro storage
+- Attachment URL fields store a stable URL for managed uploads, while manually entered external URLs remain unchanged
+- Image, PDF, audio, video, and text previews use the stable URL and the current NocoBase login session
+- Public forms grant limited access to files uploaded in the current public-form browser session; this does not create a generally public link
+
+## Office preview
+
+Microsoft Office Online Viewer fetches the file from Microsoft servers and cannot use the user's NocoBase cookie. When the user opens an Office preview, NocoBase first checks the user's file permission and then issues a temporary URL for that file.
+
+The URL is valid for 10 minutes by default. `TEMPORARY_FILE_ACCESS_EXPIRES_IN` may be set from 5 to 10 minutes. It is requested again when the preview is reopened and must never be saved in an attachment field, Markdown content, or a business record.
+
+## Permissions and redirects
+
+Logged-in requests use the current app credentials and role. After permission is granted, NocoBase responds with `302` and redirects to the local or object-storage URL.
+
+Stable URLs support `GET` and `HEAD`. Other methods return `405`. A command-line client must follow redirects, for example:
+
+```bash
+curl -L \
+  -H "Authorization: Bearer <JWT>" \
+  "https://example.com/files/main/main/attachments/42.pdf"
+```
+
+## Important notes
+
+- Stable does not mean public; recipients still need permission to view the file
+- Deleting the record or changing its app, data source, or collection context invalidates the old URL
+- Do not persist `temporaryAccessToken` or use it as a sharing link
+- Do not cache the `302 Location` as a permanent URL because storage signatures can expire
+- Do not rewrite the app, data source, collection, ID, or extension in the path
+- Reverse proxies must forward the `/files/` route under `APP_PUBLIC_PATH` to NocoBase. For subpath deployments, keep a compatible root-level `/files/` route as well. Configurations generated by the NocoBase CLI include both routes automatically
+- Deployments where the pages access the API cross-origin (with `API_BASE_URL` pointing to another origin) must add the page origin to `CORS_ORIGIN_WHITELIST`; otherwise the login cookie is never stored and stable URLs return `403` for lack of credentials. See [Environment Variables](../get-started/installation/env.md#api_base_url)
+- Use a different `hostname` for each independent NocoBase service instead of separating services only by port. Browser cookies are not isolated by port; see [Production Environment Deployment](../get-started/deployment/production.md)
+- Sub-apps in the same NocoBase deployment are distinguished by app name and do not need separate hostnames. However, an independent service on another port still needs hostname isolation if it contains a main app or sub-app with the same name
+- Custom `fetch()` code may also need object-storage CORS after following the redirect
+- Use a dedicated sharing or public-access feature when a long-lived public link is required
+
+## Related links
+
+- [HTTP API](./http-api.md) — Upload and query files through the API
+- [File preview](./file-preview/index.md) — Preview behavior for supported file types
+- [Office file preview](./file-preview/ms-office.md) — Configure Microsoft Office Online Viewer
+- [Storage engines](./storage/index.md) — Configure local and object storage

package/dist/ai/docs/nocobase/file-manager/storage/aliyun-oss.md

@@ -2,6 +2,15 @@
 
 A storage engine based on Aliyun OSS. Before use, you need to prepare the relevant account and permissions.
 
+
+:::warning Note
+
+This engine does not support private access. After a file is uploaded, NocoBase generates a directly accessible URL, and anyone who has that URL can access the file.
+
+Even if the OSS bucket itself is private, the built-in Aliyun OSS engine does not generate temporary signed URLs for file access. If you need private access, use [S3 Pro](./s3-pro). If historical files already exist, see [Migrate to S3 Pro](./migrate-to-s3-pro.md).
+
+:::
+
 ## Configuration Parameters
 
 

package/dist/ai/docs/nocobase/file-manager/storage/amazon-s3.md

@@ -2,6 +2,15 @@
 
 A storage engine based on Amazon S3. You need to prepare the relevant account and permissions before use.
 
+
+:::warning Note
+
+This engine does not support private access. After a file is uploaded, NocoBase generates a directly accessible URL, and anyone who has that URL can access the file.
+
+Even if the S3 bucket itself is private, the built-in Amazon S3 engine does not generate temporary signed URLs for file access. If you need private access, use [S3 Pro](./s3-pro). If historical files already exist, see [Migrate to S3 Pro](./migrate-to-s3-pro.md).
+
+:::
+
 ## Configuration Parameters
 
 

package/dist/ai/docs/nocobase/file-manager/storage/index.md

@@ -17,7 +17,6 @@ Currently, NocoBase has built-in support for the following engine types:
 - [S3 Pro](./s3-pro)
 
 The system automatically adds a local storage engine during installation, which can be used directly. You can also add new engines or edit the parameters of existing ones.
-
 ## Common Parameters
 
 In addition to the specific parameters for different engine types, the following are common parameters (using local storage as an example):
@@ -59,11 +58,75 @@ When checked, this is set as the system's default storage engine. When an attach
 When checked, the uploaded file in the storage engine will be kept even when the data record in the attachment or file collection is deleted. By default, this is not checked, meaning the file in the storage engine will be deleted along with the record.
 
 :::info{title=Tip}
-After a file is uploaded, the final access path is constructed by concatenating several parts:
+When Original URL is selected, the final storage address is constructed from several parts:
 
 ```
 <Public URL prefix>/<Path>/<Filename><Extension>
 ```
 
 For example: `https://cdn.nocobase.com/app/user/avatar/20240529115151.png`.
-:::
+
+When NocoBase URL is selected, the file record returns a NocoBase path in the `/files/...` format. The configuration above is still used when accessing the storage service.
+:::
+
+## File URLs and access control
+
+A storage engine can return either a NocoBase URL or the storage service's original URL. NocoBase URL is the default. Select Original URL only when an external service must use the storage address directly.
+
+This configuration applies per storage engine. After it is saved, both existing files and newly uploaded files under that engine return URLs in the selected form. Files are not moved or uploaded again.
+
+![File URL configuration](https://static-docs.nocobase.com/20260723221234.png)
+
+### NocoBase URL
+
+The file record returns an access path provided by NocoBase, for example:
+
+```text
+/files/main/main/attachments/1.png
+```
+
+Requests to this URL first pass through NocoBase and follow the view permissions configured for the corresponding file record. NocoBase reads the file or redirects to the address generated by the storage service only after the permission check succeeds.
+
+This is the recommended default. The file record returns a NocoBase path, so callers do not need to know whether local or cloud storage is being used.
+
+### Original URL
+
+The file record directly returns the address generated by the storage service, for example:
+
+```text
+https://storage.example.com/path/to/file.png
+```
+
+This URL does not pass through NocoBase and does not check the file record's view permissions. For local storage, it is a local static file address. For cloud storage, it is usually an object storage or CDN address.
+
+Select Original URL only when Markdown, an external page, or a third-party service must use the storage address directly.
+
+:::warning Note
+
+After Original URL is selected, anyone with a valid URL can bypass NocoBase permission checks and access the file. If the URL has no signature or expiration, make sure the bucket and file allow public read access.
+
+:::
+
+### Allow public access
+
+Allow public access only takes effect when NocoBase URL is selected. When checked, the storage engine still returns a NocoBase URL, but NocoBase no longer checks the file record's permissions when the URL is accessed. Anyone with the URL can access the file.
+
+This option does not change the storage service's own public-read configuration. It only controls whether NocoBase checks file record permissions.
+
+### How to choose
+
+| Use case | File URL | Allow public access |
+| --- | --- | --- |
+| Files must follow role and data permissions | NocoBase URL | Unchecked |
+| A publicly shareable NocoBase file address is required | NocoBase URL | Checked |
+| Markdown, an external page, or a third-party service must read the storage address directly | Original URL | Not applicable |
+
+:::warning Note
+
+[Local Storage](./local), [Amazon S3](./amazon-s3), [Aliyun OSS](./aliyun-oss), and [Tencent COS](./tencent-cos) do not generate temporary signed URLs. Even when NocoBase URL and file record permissions are enabled, anyone who has already obtained the storage service's original address can still access the file directly.
+
+For contracts, identity documents, internal materials, or other files that should not be public, use [S3 Pro](./s3-pro) and refer to its dedicated access-control configuration.
+
+:::
+
+If you are already using a public storage engine and want to migrate existing files to S3 Pro, see [Migrate to S3 Pro](./migrate-to-s3-pro.md).

package/dist/ai/docs/nocobase/file-manager/storage/local.md

@@ -2,6 +2,17 @@
 
 Uploaded files will be saved in a local directory on the server's hard drive. This is suitable for scenarios with a small total volume of uploaded files managed by the system or for experimental purposes.
 
+
+:::warning Note
+
+Local Storage does not support private access. After a file is uploaded, NocoBase generates a directly accessible URL, and anyone who has that URL can access the file.
+
+If you need to store contracts, identity documents, internal materials, or other files that should not be public, use [S3 Pro](./s3-pro). If historical files already exist, see [Migrate to S3 Pro](./migrate-to-s3-pro.md).
+
+If you are not using Docker or the official nginx configuration and access local uploaded files through a custom proxy, make sure the `/storage/uploads/` path sets `X-Content-Type-Options: nosniff` and returns active content files such as `html`, `svg`, `xhtml`, and `pdf` as attachments. For details, see [Security guide: File storage](../../security/guide.md#file-storage).
+
+:::
+
 ## Configuration Parameters
 
 
@@ -17,4 +28,4 @@ This section only introduces parameters specific to the local storage engine. Fo
 Represents both the relative path for file storage on the server and the URL access path. For example, "`user/avatar`" (without leading or trailing slashes) represents:
 
 1. The relative path on the server where uploaded files are stored: `/path/to/nocobase-app/storage/uploads/user/avatar`.
-2. The URL prefix for accessing the files: `http://localhost:13000/storage/uploads/user/avatar`.
+2. The URL prefix for accessing the files: `http://localhost:13000/storage/uploads/user/avatar`.