@nocobase/plugin-ai 2.2.0-beta.8 → 2.3.0-alpha.1

package/dist/ai/docs/nocobase/building-tips/operations-dashboard.md

@@ -0,0 +1,513 @@
+---
+title: "Use NocoBase to build a linkable operational dashboard"
+description: "Taking the work order operation dashboard as an example, the chart block, filter block and JS block are combined to achieve unified filtering, KPI, chart drill-down and custom styles."
+keywords: "NocoBase, operational dashboard, data visualization, chart block, filter block, JS block, chart drill-down"
+---
+
+# Use NocoBase to build a linkable operational dashboard
+
+This article takes the operation dashboard of the "work order system" as an example to introduce how to use NocoBase's chart block, filter block and JS block in combination to build a data dashboard that supports filter linkage, chart drill-down and custom styles.
+
+Although the examples are from work order scenarios, these methods are also applicable to business systems such as CRM, equipment operations, project management, approval flow, customer success, etc.
+
+:::tip
+What this article wants to introduce is not "how to use JS blocks to write a large screen", but how to combine NocoBase's native block capabilities and JS blocks: Let the native blocks be responsible for standard capabilities, and let the JS blocks complement the personalized experience.
+:::
+
+![](https://static-docs.nocobase.com/202607121920705.png)
+
+## scene target
+
+We hope to build an Operations dashboard to help the operation or service team quickly determine the current workload:
+
+- How many open work orders are there currently?
+- Which work orders are at SLA risk?
+- What is the trend in new work orders?
+- What is the status and priority distribution of work orders?
+- After clicking on a chart, you can view the corresponding details
+
+The page can be roughly divided into four layers:
+
+1. Top filter area: time, service group, request type, priority, SLA status
+2. KPI statistics area: Open backlog, Unassigned, SLA warning, etc.
+3. Chart analysis area: trend, status, SLA, priority distribution
+4. Drill-down detail area: Click on the chart to display matching records
+
+## First, clarify a construction idea
+
+When many people make data dashboards, they tend to think of the problem as one of two options:
+
+Either use all NocoBase's native blocks, which are simple to configure, but worry that the style and interaction are not flexible enough; or simply write a large JS block and control the query, chart, filtering, and drill-down by yourself, but this will lose the convenience brought by low-code configuration.
+
+In fact, the more recommended way is to combine the two.
+
+In this Operations dashboard, we did not write the entire page as a large JS screen, but split it according to responsibilities:
+
+- Top filtering uses the filtering block that comes with the NocoBase system;
+- Trend charts, status distribution, and SLA distribution use native chart blocks;
+- KPI cards and drill-down details use JS blocks;
+- Filter blocks affect both chart blocks and JS blocks;
+- After the chart is clicked, the drill-down conditions are passed to the JS detail block below.
+
+The advantage of this is that standard statistics and filtering still retain the configuration capabilities of NocoBase, while personalized display and complex interactions are completed by JS blocks. The page is neither "configurable only" nor "all code", but configuration and code each perform their own duties.
+
+---
+
+## 1. How to customize the style of the chart block
+
+![](https://static-docs.nocobase.com/202607121920941.png)
+
+The chart block of NocoBase can first use Query builder to define the statistical caliber, and then use the custom ECharts option to adjust the style.
+
+Taking "work order status statistics" as an example, Query builder can be configured as:
+
+- Datasheet: tickets
+- Metrics: id count, alias ticketCount
+- Dimensions: status
+
+The key is that when customizing the style, you do not need to rewrite the query, you only need to process the chart display based on `ctx.data.objects`.
+
+```javascript
+const rows = Array.isArray(ctx.data?.objects) ? ctx.data.objects : [];
+```
+
+This line of code reads the chart query results. Then define status labels and colors:
+
+```javascript
+const labels = {
+  new: ctx.t('New'),
+  open: ctx.t('Open'),
+  pending_customer: ctx.t('Pending customer'),
+  resolved: ctx.t('Resolved'),
+  closed: ctx.t('Closed'),
+};
+
+const colors = {
+  new: '#1677ff',
+  open: '#22a06b',
+  pending_customer: '#f59f00',
+  resolved: '#13c2c2',
+  closed: '#8c8c8c',
+};
+```
+
+It is recommended that all visible copywriting use `ctx.t()` to facilitate subsequent multi-language support.
+
+When generating chart data, you can attach drill-down information to each chart data point:
+
+```javascript
+const data = rows.map((row) => ({
+  value: Number(row.ticketCount || 0),
+  itemStyle: {
+    color: colors[row.status] || '#8c8c8c',
+    borderRadius: [6, 6, 0, 0],
+  },
+  ticketingDrilldown: {
+    label: ctx.t('Status') + ': ' + (labels[row.status] || row.status),
+    filter: { status: { $eq: row.status } },
+  },
+}));
+```
+
+The most critical thing here is `ticketingDrilldown`. It is not a standard field of ECharts, but a business context that we put in ourselves, which will be used when clicking on the chart later.
+
+Finally return to ECharts option:
+
+```javascript
+return {
+  grid: { top: 28, right: 22, bottom: 48, left: 42 },
+  tooltip: { trigger: 'axis', axisPointer: { type: 'shadow' } },
+  xAxis: {
+    type: 'category',
+    data: rows.map((row) => labels[row.status] || row.status),
+  },
+  yAxis: {
+    type: 'value',
+    minInterval: 1,
+  },
+  series: [
+    {
+      name: ctx.t('Tickets'),
+      type: 'bar',
+      barWidth: 36,
+      data,
+    },
+  ],
+};
+```
+
+The core idea of ​​this part is:
+
+- Query builder is responsible for statistics;
+- Custom option is responsible for visual expression;
+- Custom fields are responsible for carrying drill-down context.
+
+---
+
+## 2. Let the system filter block become the observation scope of the entire page
+
+![](https://static-docs.nocobase.com/202607121920687.png)
+
+The filter area in the operational dashboard should not be just an isolated form. It represents the current observation diameter of the entire page.
+
+For example, if the user selects a service group, a request type, and a creation time, then KPIs, trend charts, status distribution, and drill-down details should all be displayed based on the same set of conditions. Otherwise, the numbers in different blocks on the page will fight with each other, and it will be difficult for users to judge which data is the result within the current range.
+
+Here we directly use the filtering block that comes with the NocoBase system instead of writing a filtering component ourselves. Native filter blocks can be naturally bound to chart blocks, allowing the chart block to continue to use the Query builder, permissions, refresh and filter mechanisms.
+
+Top `Dashboard scope` can configure these filter items:
+
+- Created at
+- Service group
+- Request type
+- Priority
+- SLA status
+
+For JS blocks, you only need to read the same set of filter conditions in the code and then convert them into query filters. In this way, KPIs and drill-down details can also be consistent with the native chart.
+
+The combination of filter conditions can be encapsulated into a small function:
+
+```javascript
+function combineFilters(...filters) {
+  const parts = filters.filter(Boolean);
+  if (!parts.length) return undefined;
+  if (parts.length === 1) return parts[0];
+  return { $and: parts };
+}
+```
+
+Count by filter:
+
+```javascript
+async function countTickets(filter) {
+  const resource = ctx.makeResource('MultiRecordResource');
+  resource.setResourceName('tickets');
+  resource.setPageSize(1);
+
+  if (filter) {
+    resource.setFilter(filter);
+  }
+
+  await resource.refresh();
+
+  const meta = resource.getMeta?.() || {};
+  return Number(meta.count || meta.total || 0);
+}
+```
+
+The key points here are:
+
+```javascript
+resource.setFilter(filter);
+await resource.refresh();
+```
+
+The JS block queries business data through resources instead of writing SQL directly. This makes it easier to keep consistent with NocoBase's permissions, data sources, and page runtimes.
+
+---
+
+## 3. Use JS blocks to display KPI cards
+
+![](https://static-docs.nocobase.com/202607121920374.png)
+
+KPIs are better suited to use JS blocks. Because KPI is usually not a single query, but a combination of multiple business calibers: unfinished, unassigned, SLA warning, SLA breached, new, resolved, etc.
+
+The JS block can requery data based on the current filtering range and render it into a statistical card.
+
+```javascript
+const { Card, Col, Row, Statistic, Tag } = ctx.libs.antd;
+
+const scopeFilter = getDashboardScopeFilter();
+
+const openBacklog = await countTickets(
+  combineFilters(scopeFilter, {
+    status: { $notIn: ['resolved', 'closed', 'cancelled'] },
+  }),
+);
+
+ctx.render(
+  <Row gutter={[12, 12]}>
+    <Col span={6}>
+      <Card size="small">
+        <Tag color="blue">{ctx.t('Active')}</Tag>
+        <Statistic title={ctx.t('Open backlog')} value={openBacklog} />
+      </Card>
+    </Col>
+  </Row>,
+);
+```
+
+The key points of JS blocks are:
+
+- Use `ctx.makeResource()` to query data;
+- Use `ctx.libs.antd` to render the interface;
+- Use `ctx.render()` to output content;
+- Re-render JS chunks after filtering changes.
+
+In a real page, the filter button and reset button can configure the event flow so that they refresh the KPI JS block and drill-down JS block at the same time after completing the native filter action. In this way, the user clicks once to filter, and both charts and custom content will be updated based on the same range.
+
+---
+
+## 4. Chart linkage JS block for drill-down
+
+![](https://static-docs.nocobase.com/202607121921577.png)
+
+Clicking on the chart to drill down is a very practical interaction in the dashboard.
+
+In the work order scenario, the user clicks the "Status: Open" column, and all Open work orders are displayed in the detail area below; when the user clicks "SLA breached", all overtime work orders are displayed below.
+
+The implementation idea is:
+
+1. Chart data points carry `ticketingDrilldown`;
+2. The chart event reads this drill-down information;
+3. Write drill-down information into the target JS block context;
+4. Trigger the target JS block to re-render.
+
+The key code in the chart event is as follows. First find the drill-down JS block:
+
+```javascript
+const DRILLDOWN_TARGET_UID = 'v7mioopm6rm';
+
+function getDrilldownTarget() {
+  if (typeof ctx.getModel === 'function') {
+    return ctx.getModel(DRILLDOWN_TARGET_UID);
+  }
+
+  const engine =
+    ctx.model?.flowEngine || ctx.model?.context?.flowEngine || ctx.engine;
+  return engine?.getModel?.(DRILLDOWN_TARGET_UID);
+}
+```
+
+Then write the drill-down conditions obtained by clicking on the chart into the target block:
+
+```javascript
+function applyDrilldown(drilldown) {
+  if (!drilldown?.filter) return;
+
+  const target = getDrilldownTarget();
+  if (!target?.context?.defineProperty) return;
+
+  target.context.defineProperty('ticketingDashboardDrilldown', {
+    value: drilldown,
+  });
+
+  target.rerender?.();
+}
+```
+
+The most critical are these two lines:
+
+```javascript
+target.context.defineProperty('ticketingDashboardDrilldown', {
+  value: drilldown,
+});
+target.rerender?.();
+```
+
+The first line passes the drill-down condition to the JS block, and the second line triggers the JS block refresh.
+
+Finally bind the chart click event:
+
+```javascript
+const clickHandler = (params) => {
+  applyDrilldown(params?.data?.ticketingDrilldown);
+};
+
+chart.on('click', clickHandler);
+
+return () => chart.off('click', clickHandler);
+```
+
+It is recommended here that you must return cleanup:
+
+```javascript
+return () => chart.off('click', clickHandler);
+```
+
+In this way, when the chart is reconfigured or re-rendered, old events can be cleaned up to avoid repeated binding.
+
+The above click event-related code is applicable to [v2.2.0-beta.10](https://github.com/nocobase/nocobase/releases/tag/v2.2.0-beta.10) and above versions. Reference to the old version code:
+
+```javascript
+chart.off('click');
+chart.on('click', clickHandler);
+```
+
+---
+
+## 5. How to display details in drill-down JS blocks
+
+![](https://static-docs.nocobase.com/202607121921601.png)
+
+Drill down into the JS block to read the `ticketingDashboardDrilldown` just written, and then query the data according to the filter in it.
+
+```javascript
+const drilldown = ctx.model?.context?.ticketingDashboardDrilldown;
+
+if (!drilldown) {
+  ctx.render(
+    <Alert
+      type="info"
+      showIcon
+      message={ctx.t('Select a chart segment to inspect matching tickets')}
+    />,
+  );
+  return;
+}
+```
+
+If the user has not clicked on the chart, display a prompt. After clicking, query the work order based on `drilldown.filter`:
+
+```javascript
+const resource = ctx.makeResource('MultiRecordResource');
+resource.setResourceName('tickets');
+resource.setFilter(drilldown.filter);
+resource.setPageSize(10);
+await resource.refresh();
+
+const rows = resource.getData?.() || [];
+```
+
+Then render the table:
+
+```javascript
+const { Table, Typography } = ctx.libs.antd;
+
+ctx.render(
+  <>
+    <Typography.Title level={5}>
+      {ctx.t('Drilldown')}: {drilldown.label}
+    </Typography.Title>
+
+    <Table
+      size="small"
+      rowKey="id"
+      dataSource={rows}
+      pagination={false}
+      columns={[
+        { title: ctx.t('Ticket No'), dataIndex: 'ticketNo' },
+        { title: ctx.t('Title'), dataIndex: 'title' },
+        { title: ctx.t('Status'), dataIndex: 'status' },
+        { title: ctx.t('Priority'), dataIndex: 'priority' },
+      ]}
+    />
+  </>,
+);
+```
+
+If you need to clear drill-down conditions, you can refer to
+
+```javascript
+function clearChartDrilldown() {
+  if (ctx.model?.context?.defineProperty) {
+    ctx.model.context.defineProperty('ticketingDashboardDrilldown', {
+      value: null,
+    });
+  }
+  if (typeof ctx.model?.rerender === 'function') {
+    ctx.model.rerender();
+  }
+}
+```
+
+The key points in this part are:
+
+- The chart is only responsible for passing the filter;
+- The JS block is responsible for querying and displaying details;
+- Click on different charts to share the same drill-down block.
+
+---
+
+## Practical suggestions
+
+### 1. Don’t rush to code the complex page as a whole
+
+The most important lesson from this page is: don’t pit native capabilities against JS capabilities.
+
+If a capability is already a native capability of NocoBase, such as filtering, chart query, table display, and permission control, the native block will be used first. In this way, when fields, filter conditions, and chart caliber are subsequently adjusted, they can still be configured on the interface.
+
+JS blocks are more suitable for processing parts that native blocks are not good at, such as combining multiple indicators into a set of KPIs, special card styles, displaying a set of custom details after clicking on the chart, or passing business context between different blocks.
+
+In other words, the native block is responsible for "configurable standard capabilities", and the JS block is responsible for "business-oriented personalized experience". This is also the most reusable construction idea for this dashboard.
+
+### 2. For simple statistics, use the chart block Query builder first.
+
+This preserves NocoBase's standard query, permissions, filtering and refreshing capabilities. Only when the default chart style cannot express the business focus, use the customized ECharts option for visual optimization.
+
+### 3. KPI cards give priority to using JS blocks
+
+KPIs often require multiple queries, condition combinations, and custom layouts, and JS blocks are more flexible. Especially when KPIs need to respond to the same set of system filter conditions, it will be clearer to use JS blocks to handle them uniformly.
+
+### 4. Chart events should return cleanup
+
+Recommended writing method:
+
+```javascript
+const handler = (params) => {
+  // handle click
+};
+
+chart.on('click', handler);
+
+return () => chart.off('click', handler);
+```
+
+Do not directly use `chart.off('click')` to clear all click events, as this may accidentally delete the chart block or configure the panel's own monitoring.
+
+---
+
+## Let AI help you build it
+
+This type of dashboard is very suitable for AI-assisted generation because it involves data models, statistical calibers, chart styles, and page interactions at the same time. You can hand it the content of this article and ask questions using the prompt words below.
+
+You can ask questions like this:
+
+```markdown
+I am using NocoBase to build an operational dashboard for a work order system.
+Please take the work order scenario as an example and help me design an Operations dashboard.
+
+The data table tickets contains:
+ticketNo、title、status、priority、slaStatus、
+requestType、serviceGroup、assignee、createdAt、updatedAt。
+
+The page requires:
+
+1. Top filter: Created at, Service group, Request type, Priority, SLA status.
+2. KPI cards: Open backlog, Unassigned, SLA warning, SLA breached, New tickets, Resolved tickets.
+3. Chart: Created tickets trend, Ticket status, SLA status, Priority mix.
+4. After clicking on the chart, the JS block below displays the matching Ticket drilldown table.
+5. The chart style should be suitable for the operating market, with clear colors and compact layout.
+6. Use ctx.t() for all JS copy.
+7. Chart events use chart.on and return the cleanup function.
+8. Prioritize using NocoBase’s native filter blocks and chart blocks. Only use JS blocks for KPIs, drill-down details, special styles, and cross-block interactions. Do not write the entire page as one large JS block.
+
+Please give the configuration ideas for each block and mark the key JS code.
+```
+
+If you already have a page, you can also let AI help you optimize it:
+
+```markdown
+This is my current NocoBase dashboard design:
+At the top is the filter area, in the middle are 4 charts, and below is the drill-down JS block.
+Please help me optimize from the perspective of operator experience:
+
+1. What indicators should the KPI display?
+2. Whether there is a need for linkage between charts;
+3. Which columns should be displayed in drill-down details;
+4. How should JS block and chart events be organized;
+5. Which code should be placed in the chart custom option and which should be placed in the JS block.
+```
+
+In this way, the content generated by AI will be closer to the real business, rather than just giving isolated code.
+
+:::warning
+If you choose to let AI help you build it, please use the backup manager to back up the project before starting.
+:::
+
+## Reference documentation
+
+- [Chart configuration ](/data-visualization/guide/chart-options)
+- [Frontend RunJS](/runjs/)
+- [Filter form ](/interface-builder/blocks/filter-blocks/form)
+- [AI Construction - Interface Construction ](/ai-builder/ui-builder)
+- [ECharts Options](https://echarts.apache.org/en/option.html)

package/dist/ai/docs/nocobase/file-manager/field-attachment.md

@@ -1,5 +1,11 @@
 # Attachment
 
+:::warning Note
+
+The Attachment field will be deprecated in a future version. For new apps or when adjusting existing business flows, migrate to a custom file collection as early as possible and manage related files with association fields.
+
+:::
+
 ## Introduction
 
 The system has a built-in "Attachment" field type to support file uploads in custom collections.

package/dist/ai/docs/nocobase/file-manager/file-preview/index.md

@@ -12,17 +12,8 @@ Currently, NocoBase provides the following file preview plugins:
 
 ## PDF preview with external storage
 
-PDF preview uses PDF.js to render files in the browser. The browser must first read the PDF file content and then pass it to PDF.js for rendering. Therefore, when files are stored in external storage such as OSS, S3, COS, or a CDN, and the file access domain is different from the NocoBase site domain, the external storage must allow the NocoBase site to read files across origins.
+NocoBase previews PDFs through a browser iframe. Some browsers or PDF readers may support scripts, forms, or other interactive content inside PDF files. If the previewed file comes from an untrusted source, pay attention to the security boundary for script execution.
 
-If CORS is not configured, PDF downloads can still work normally, but preview may fail with a file loading error.
+We recommend isolating the file access domain from the NocoBase site and API domains. For example, serve files from OSS, S3, COS, or a CDN through a dedicated domain, instead of sharing the same origin with the NocoBase frontend or API.
 
-The CORS configuration for external storage or CDN should include:
-
-```http
-Access-Control-Allow-Origin: https://your-nocobase-domain
-Access-Control-Allow-Methods: GET, HEAD
-Access-Control-Allow-Headers: *
-Access-Control-Expose-Headers: Content-Length, Content-Range, Accept-Ranges, Content-Disposition, Content-Type
-```
-
-`Access-Control-Allow-Origin` should be set to the actual domain used to access NocoBase. Avoid using `*` for non-public files over the long term, because it expands the range of sites that can read the files.
+If the file domain is different from the API domain, and the API does not enable CORS access for the file domain, scripts running in the PDF preview environment are usually restricted by the browser's same-origin policy. They cannot directly read the NocoBase page, browser storage, or API responses.

package/dist/ai/docs/nocobase/file-manager/stable-url.md

@@ -0,0 +1,87 @@
+---
+pkg: '@nocobase/plugin-file-manager'
+title: "Stable URL (proxy URL)"
+description: "Explains NocoBase stable file URLs, access permissions, redirects, temporary Office preview URLs, and behavior across file-related features."
+keywords: "stable URL,proxy URL,permanent URL,file access,file permissions,Office preview,NocoBase"
+---
+
+# Stable URL
+
+Files managed by a NocoBase storage engine are accessed through a **stable URL**. The URL first reaches NocoBase, where the file record and access permissions are checked, and then redirects to the actual URL generated by the storage engine.
+
+## URL format
+
+```text
+/files/<app>/<dataSource>/<collection>/<id><extname>
+```
+
+For example:
+
+```text
+/files/main/main/attachments/42.pdf
+```
+
+When `APP_PUBLIC_PATH=/nocobase` is configured, the URL starts with `/nocobase/files/`. The path identifies the app, data source, file collection, record ID, and extension. The ID and extension cannot be changed after creation, which keeps the URL stable for the lifetime of the record.
+
+## URL variants
+
+| Purpose | URL | Behavior |
+|---|---|---|
+| Open or embed | `/files/.../42.pdf` | Checks permission and redirects to the actual file URL |
+| Preview | `/files/.../42.png?preview=1` | Redirects to the preview or thumbnail URL |
+| Download | `/files/.../42.pdf?download=1` | Redirects with download semantics |
+| Office preview | `/files/.../42.xlsx?temporaryAccessToken=...` | Allows Microsoft Office Online Viewer to fetch one file for a short time |
+
+:::tip
+
+Use the `url` and `preview` values returned by NocoBase. Application code normally should not construct `/files` URLs or their query parameters.
+
+:::
+
+## Behavior across NocoBase
+
+- Attachment fields and file collections return stable URLs after upload and when records are queried
+- [HTTP API](./http-api.md) responses no longer expose local paths, storage domains, or presigned download URLs
+- Markdown uploads store the stable URL, including files in private S3, OSS, COS, or S3 Pro storage
+- Attachment URL fields store a stable URL for managed uploads, while manually entered external URLs remain unchanged
+- Image, PDF, audio, video, and text previews use the stable URL and the current NocoBase login session
+- Public forms grant limited access to files uploaded in the current public-form browser session; this does not create a generally public link
+
+## Office preview
+
+Microsoft Office Online Viewer fetches the file from Microsoft servers and cannot use the user's NocoBase cookie. When the user opens an Office preview, NocoBase first checks the user's file permission and then issues a temporary URL for that file.
+
+The URL is valid for 10 minutes by default. `TEMPORARY_FILE_ACCESS_EXPIRES_IN` may be set from 5 to 10 minutes. It is requested again when the preview is reopened and must never be saved in an attachment field, Markdown content, or a business record.
+
+## Permissions and redirects
+
+Logged-in requests use the current app credentials and role. After permission is granted, NocoBase responds with `302` and redirects to the local or object-storage URL.
+
+Stable URLs support `GET` and `HEAD`. Other methods return `405`. A command-line client must follow redirects, for example:
+
+```bash
+curl -L \
+  -H "Authorization: Bearer <JWT>" \
+  "https://example.com/files/main/main/attachments/42.pdf"
+```
+
+## Important notes
+
+- Stable does not mean public; recipients still need permission to view the file
+- Deleting the record or changing its app, data source, or collection context invalidates the old URL
+- Do not persist `temporaryAccessToken` or use it as a sharing link
+- Do not cache the `302 Location` as a permanent URL because storage signatures can expire
+- Do not rewrite the app, data source, collection, ID, or extension in the path
+- Reverse proxies must forward the `/files/` route under `APP_PUBLIC_PATH` to NocoBase. For subpath deployments, keep a compatible root-level `/files/` route as well. Configurations generated by the NocoBase CLI include both routes automatically
+- Deployments where the pages access the API cross-origin (with `API_BASE_URL` pointing to another origin) must add the page origin to `CORS_ORIGIN_WHITELIST`; otherwise the login cookie is never stored and stable URLs return `403` for lack of credentials. See [Environment Variables](../get-started/installation/env.md#api_base_url)
+- Use a different `hostname` for each independent NocoBase service instead of separating services only by port. Browser cookies are not isolated by port; see [Production Environment Deployment](../get-started/deployment/production.md)
+- Sub-apps in the same NocoBase deployment are distinguished by app name and do not need separate hostnames. However, an independent service on another port still needs hostname isolation if it contains a main app or sub-app with the same name
+- Custom `fetch()` code may also need object-storage CORS after following the redirect
+- Use a dedicated sharing or public-access feature when a long-lived public link is required
+
+## Related links
+
+- [HTTP API](./http-api.md) — Upload and query files through the API
+- [File preview](./file-preview/index.md) — Preview behavior for supported file types
+- [Office file preview](./file-preview/ms-office.md) — Configure Microsoft Office Online Viewer
+- [Storage engines](./storage/index.md) — Configure local and object storage

package/dist/ai/docs/nocobase/file-manager/storage/aliyun-oss.md

@@ -2,6 +2,15 @@
 
 A storage engine based on Aliyun OSS. Before use, you need to prepare the relevant account and permissions.
 
+
+:::warning Note
+
+This engine does not support private access. After a file is uploaded, NocoBase generates a directly accessible URL, and anyone who has that URL can access the file.
+
+Even if the OSS bucket itself is private, the built-in Aliyun OSS engine does not generate temporary signed URLs for file access. If you need private access, use [S3 Pro](./s3-pro). If historical files already exist, see [Migrate to S3 Pro](./migrate-to-s3-pro.md).
+
+:::
+
 ## Configuration Parameters
 
 

package/dist/ai/docs/nocobase/file-manager/storage/amazon-s3.md

@@ -2,6 +2,15 @@
 
 A storage engine based on Amazon S3. You need to prepare the relevant account and permissions before use.
 
+
+:::warning Note
+
+This engine does not support private access. After a file is uploaded, NocoBase generates a directly accessible URL, and anyone who has that URL can access the file.
+
+Even if the S3 bucket itself is private, the built-in Amazon S3 engine does not generate temporary signed URLs for file access. If you need private access, use [S3 Pro](./s3-pro). If historical files already exist, see [Migrate to S3 Pro](./migrate-to-s3-pro.md).
+
+:::
+
 ## Configuration Parameters