@nocobase/plugin-data-visualization 2.0.27 → 2.0.28

package/dist/externalVersion.js

@@ -8,18 +8,18 @@
  */
 
 module.exports = {
-  "@nocobase/client": "2.0.27",
+  "@nocobase/client": "2.0.28",
   "@formily/react": "2.3.7",
-  "@nocobase/plugin-ai": "2.0.27",
-  "@nocobase/flow-engine": "2.0.27",
+  "@nocobase/plugin-ai": "2.0.28",
+  "@nocobase/flow-engine": "2.0.28",
   "react-i18next": "11.18.6",
   "dayjs": "1.11.13",
   "@formily/shared": "2.3.7",
   "lodash": "4.17.21",
-  "@nocobase/cache": "2.0.27",
-  "@nocobase/server": "2.0.27",
-  "@nocobase/test": "2.0.27",
-  "@nocobase/utils": "2.0.27",
+  "@nocobase/cache": "2.0.28",
+  "@nocobase/server": "2.0.28",
+  "@nocobase/test": "2.0.28",
+  "@nocobase/utils": "2.0.28",
   "react": "18.2.0",
   "@emotion/css": "11.13.0",
   "@ant-design/icons": "5.6.1",
@@ -27,9 +27,9 @@ module.exports = {
   "antd": "5.24.2",
   "@formily/antd-v5": "1.2.3",
   "@formily/core": "2.3.7",
-  "@nocobase/actions": "2.0.27",
-  "@nocobase/database": "2.0.27",
-  "@nocobase/acl": "2.0.27",
+  "@nocobase/actions": "2.0.28",
+  "@nocobase/database": "2.0.28",
+  "@nocobase/acl": "2.0.28",
   "sequelize": "6.35.2",
   "@formily/reactive": "2.3.7"
 };

package/dist/node_modules/koa-compose/package.json

@@ -1 +1 @@
-{"name":"koa-compose","description":"compose Koa middleware","repository":"koajs/compose","version":"4.1.0","keywords":["koa","middleware","compose"],"files":["index.js"],"dependencies":{},"devDependencies":{"codecov":"^3.0.0","jest":"^21.0.0","matcha":"^0.7.0","standard":"^10.0.3"},"scripts":{"bench":"matcha bench/bench.js","lint":"standard --fix .","test":"jest --forceExit --coverage"},"jest":{"testEnvironment":"node"},"license":"MIT","_lastModified":"2026-03-26T11:01:04.786Z"}
+{"name":"koa-compose","description":"compose Koa middleware","repository":"koajs/compose","version":"4.1.0","keywords":["koa","middleware","compose"],"files":["index.js"],"dependencies":{},"devDependencies":{"codecov":"^3.0.0","jest":"^21.0.0","matcha":"^0.7.0","standard":"^10.0.3"},"scripts":{"bench":"matcha bench/bench.js","lint":"standard --fix .","test":"jest --forceExit --coverage"},"jest":{"testEnvironment":"node"},"license":"MIT","_lastModified":"2026-03-27T15:56:12.848Z"}

package/dist/node_modules/moment-timezone/package.json

@@ -1 +1 @@
-{"name":"moment-timezone","version":"0.5.43","description":"Parse and display moments in any timezone.","homepage":"http://momentjs.com/timezone/","author":"Tim Wood <washwithcare@gmail.com> (http://timwoodcreates.com/)","keywords":["moment","date","time","timezone","olson","iana","zone","tz"],"main":"./index.js","typings":"./index.d.ts","engines":{"node":"*"},"repository":{"type":"git","url":"https://github.com/moment/moment-timezone.git"},"bugs":{"url":"https://github.com/moment/moment-timezone/issues"},"license":"MIT","dependencies":{"moment":"^2.29.4"},"devDependencies":{"grunt":"^1.5.3","grunt-contrib-clean":"^2.0.1","grunt-contrib-jshint":"^3.2.0","grunt-contrib-nodeunit":"^4.0.0","grunt-contrib-uglify":"^5.2.2","grunt-exec":"^3.0.0","typescript":"^3.5.1"},"jspm":{"main":"builds/moment-timezone-with-data","shim":{"moment-timezone":{"deps":["moment"]}}},"scripts":{"test":"grunt"},"_lastModified":"2026-03-26T11:01:05.406Z"}
+{"name":"moment-timezone","version":"0.5.43","description":"Parse and display moments in any timezone.","homepage":"http://momentjs.com/timezone/","author":"Tim Wood <washwithcare@gmail.com> (http://timwoodcreates.com/)","keywords":["moment","date","time","timezone","olson","iana","zone","tz"],"main":"./index.js","typings":"./index.d.ts","engines":{"node":"*"},"repository":{"type":"git","url":"https://github.com/moment/moment-timezone.git"},"bugs":{"url":"https://github.com/moment/moment-timezone/issues"},"license":"MIT","dependencies":{"moment":"^2.29.4"},"devDependencies":{"grunt":"^1.5.3","grunt-contrib-clean":"^2.0.1","grunt-contrib-jshint":"^3.2.0","grunt-contrib-nodeunit":"^4.0.0","grunt-contrib-uglify":"^5.2.2","grunt-exec":"^3.0.0","typescript":"^3.5.1"},"jspm":{"main":"builds/moment-timezone-with-data","shim":{"moment-timezone":{"deps":["moment"]}}},"scripts":{"test":"grunt"},"_lastModified":"2026-03-27T15:56:13.388Z"}

package/dist/server/actions/query.js

@@ -55,6 +55,37 @@ const getDB = (ctx, dataSource) => {
   const ds = ctx.app.dataSourceManager.dataSources.get(dataSource);
   return ds == null ? void 0 : ds.collectionManager.db;
 };
+const getChartQueryPermission = async (ctx, collection, acl) => {
+  var _a;
+  const actionCtx = {
+    app: ctx.app,
+    db: ctx.db,
+    database: ctx.database ?? ctx.db,
+    getCurrentRepository: ctx.getCurrentRepository,
+    request: ctx.request,
+    req: ctx.req,
+    action: {
+      actionName: "list",
+      name: "list",
+      params: {},
+      resourceName: collection,
+      mergeParams() {
+      }
+    },
+    state: {
+      ...ctx.state,
+      currentRole: ctx.state.currentRole,
+      currentRoles: ctx.state.currentRoles,
+      currentUser: ((_a = ctx.state.currentUser) == null ? void 0 : _a.toJSON) ? ctx.state.currentUser.toJSON() : ctx.state.currentUser
+    },
+    permission: {},
+    throw(...args) {
+      ctx.throw(...args);
+    }
+  };
+  await acl.getActionParams(actionCtx);
+  return actionCtx.permission;
+};
 const postProcess = async (ctx, next) => {
   const { data, fieldMap } = ctx.action.params.values;
   ctx.body = data.map((record) => {
@@ -220,17 +251,14 @@ const cacheMiddleware = async (ctx, next) => {
   }
 };
 const checkPermission = async (ctx, next) => {
-  var _a, _b, _c;
+  var _a, _b;
   const { collection, dataSource } = ctx.action.params.values;
-  const roleNames = ctx.state.currentRoles || ["anonymous"];
   const acl = ((_a = ctx.app.dataSourceManager.get(dataSource)) == null ? void 0 : _a.acl) || ctx.app.acl;
-  const can = acl.can({ roles: roleNames, resource: collection, action: "list" });
-  if (!can && !roleNames.includes("root")) {
-    ctx.throw(403, "No permissions");
-  }
-  if ((_b = can == null ? void 0 : can.params) == null ? void 0 : _b.filter) {
+  const permission = await getChartQueryPermission(ctx, collection, acl);
+  const filterParams = (_b = permission == null ? void 0 : permission.parsedParams) == null ? void 0 : _b.filter;
+  if (filterParams) {
     try {
-      (0, import_acl.checkFilterParams)(ctx.database.getCollection(collection), (_c = can.params) == null ? void 0 : _c.filter);
+      (0, import_acl.checkFilterParams)(ctx.database.getCollection(collection), filterParams);
     } catch (e) {
       if (e instanceof import_acl.NoPermissionError) {
         ctx.throw(403, "No permissions");
@@ -239,7 +267,7 @@ const checkPermission = async (ctx, next) => {
     const filter = ctx.action.params.values.filter || {};
     ctx.action.params.values = {
       ...ctx.action.params.values,
-      filter: (0, import_utils.assign)(filter, can == null ? void 0 : can.params.filter, {
+      filter: (0, import_utils.assign)(filter, filterParams, {
         filter: "andMerge"
       })
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/plugin-data-visualization",
-  "version": "2.0.27",
+  "version": "2.0.28",
   "displayName": "Data visualization",
   "displayName.ru-RU": "Визуализация данных",
   "displayName.zh-CN": "数据可视化",
@@ -46,7 +46,7 @@
     "@nocobase/test": "2.x",
     "@nocobase/utils": "2.x"
   },
-  "gitHead": "0317737a319acb75fdcd0c69eab3fa8dd9095c86",
+  "gitHead": "7a3e96a74b05f2beaa5a87d8ef28ccf269ea90f4",
   "keywords": [
     "Blocks"
   ],