@nocobase/plugin-file-manager 2.1.0-beta.9 → 2.1.1

package/dist/node_modules/mime-types/package.json

@@ -1 +1 @@
-{"name":"mime-types","description":"The ultimate javascript content-type utility.","version":"3.0.1","contributors":["Douglas Christopher Wilson <doug@somethingdoug.com>","Jeremiah Senkpiel <fishrock123@rocketmail.com> (https://searchbeam.jit.su)","Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)"],"license":"MIT","keywords":["mime","types"],"repository":"jshttp/mime-types","dependencies":{"mime-db":"^1.54.0"},"devDependencies":{"eslint":"8.33.0","eslint-config-standard":"14.1.1","eslint-plugin-import":"2.27.5","eslint-plugin-markdown":"3.0.0","eslint-plugin-node":"11.1.0","eslint-plugin-promise":"6.1.1","eslint-plugin-standard":"4.1.0","mocha":"10.2.0","nyc":"15.1.0"},"files":["HISTORY.md","LICENSE","index.js","mimeScore.js"],"engines":{"node":">= 0.6"},"scripts":{"lint":"eslint .","test":"mocha --reporter spec test/test.js","test-ci":"nyc --reporter=lcov --reporter=text npm test","test-cov":"nyc --reporter=html --reporter=text npm test"},"_lastModified":"2026-03-12T13:29:42.167Z"}
+{"name":"mime-types","description":"The ultimate javascript content-type utility.","version":"3.0.1","contributors":["Douglas Christopher Wilson <doug@somethingdoug.com>","Jeremiah Senkpiel <fishrock123@rocketmail.com> (https://searchbeam.jit.su)","Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)"],"license":"MIT","keywords":["mime","types"],"repository":"jshttp/mime-types","dependencies":{"mime-db":"^1.54.0"},"devDependencies":{"eslint":"8.33.0","eslint-config-standard":"14.1.1","eslint-plugin-import":"2.27.5","eslint-plugin-markdown":"3.0.0","eslint-plugin-node":"11.1.0","eslint-plugin-promise":"6.1.1","eslint-plugin-standard":"4.1.0","mocha":"10.2.0","nyc":"15.1.0"},"files":["HISTORY.md","LICENSE","index.js","mimeScore.js"],"engines":{"node":">= 0.6"},"scripts":{"lint":"eslint .","test":"mocha --reporter spec test/test.js","test-ci":"nyc --reporter=lcov --reporter=text npm test","test-cov":"nyc --reporter=html --reporter=text npm test"},"_lastModified":"2026-06-11T01:17:51.156Z"}

package/dist/node_modules/mkdirp/index.js

@@ -1 +1 @@
-(function(){var e={186:function(e,r,i){var t=i(17);var n=i(147);var f=parseInt("0777",8);e.exports=mkdirP.mkdirp=mkdirP.mkdirP=mkdirP;function mkdirP(e,r,i,a){if(typeof r==="function"){i=r;r={}}else if(!r||typeof r!=="object"){r={mode:r}}var c=r.mode;var o=r.fs||n;if(c===undefined){c=f}if(!a)a=null;var u=i||function(){};e=t.resolve(e);o.mkdir(e,c,(function(i){if(!i){a=a||e;return u(null,a)}switch(i.code){case"ENOENT":if(t.dirname(e)===e)return u(i);mkdirP(t.dirname(e),r,(function(i,t){if(i)u(i,t);else mkdirP(e,r,u,t)}));break;default:o.stat(e,(function(e,r){if(e||!r.isDirectory())u(i,a);else u(null,a)}));break}}))}mkdirP.sync=function sync(e,r,i){if(!r||typeof r!=="object"){r={mode:r}}var a=r.mode;var c=r.fs||n;if(a===undefined){a=f}if(!i)i=null;e=t.resolve(e);try{c.mkdirSync(e,a);i=i||e}catch(n){switch(n.code){case"ENOENT":i=sync(t.dirname(e),r,i);sync(e,r,i);break;default:var o;try{o=c.statSync(e)}catch(e){throw n}if(!o.isDirectory())throw n;break}}return i}},147:function(e){"use strict";e.exports=require("fs")},17:function(e){"use strict";e.exports=require("path")}};var r={};function __nccwpck_require__(i){var t=r[i];if(t!==undefined){return t.exports}var n=r[i]={exports:{}};var f=true;try{e[i](n,n.exports,__nccwpck_require__);f=false}finally{if(f)delete r[i]}return n.exports}if(typeof __nccwpck_require__!=="undefined")__nccwpck_require__.ab=__dirname+"/";var i=__nccwpck_require__(186);module.exports=i})();
+(()=>{var e={186:(e,r,i)=>{var t=i(17);var n=i(147);var a=parseInt("0777",8);e.exports=mkdirP.mkdirp=mkdirP.mkdirP=mkdirP;function mkdirP(e,r,i,f){if(typeof r==="function"){i=r;r={}}else if(!r||typeof r!=="object"){r={mode:r}}var c=r.mode;var o=r.fs||n;if(c===undefined){c=a}if(!f)f=null;var s=i||function(){};e=t.resolve(e);o.mkdir(e,c,(function(i){if(!i){f=f||e;return s(null,f)}switch(i.code){case"ENOENT":if(t.dirname(e)===e)return s(i);mkdirP(t.dirname(e),r,(function(i,t){if(i)s(i,t);else mkdirP(e,r,s,t)}));break;default:o.stat(e,(function(e,r){if(e||!r.isDirectory())s(i,f);else s(null,f)}));break}}))}mkdirP.sync=function sync(e,r,i){if(!r||typeof r!=="object"){r={mode:r}}var f=r.mode;var c=r.fs||n;if(f===undefined){f=a}if(!i)i=null;e=t.resolve(e);try{c.mkdirSync(e,f);i=i||e}catch(n){switch(n.code){case"ENOENT":i=sync(t.dirname(e),r,i);sync(e,r,i);break;default:var o;try{o=c.statSync(e)}catch(e){throw n}if(!o.isDirectory())throw n;break}}return i}},147:e=>{"use strict";e.exports=require("fs")},17:e=>{"use strict";e.exports=require("path")}};var r={};function __nccwpck_require__(i){var t=r[i];if(t!==undefined){return t.exports}var n=r[i]={exports:{}};var a=true;try{e[i](n,n.exports,__nccwpck_require__);a=false}finally{if(a)delete r[i]}return n.exports}if(typeof __nccwpck_require__!=="undefined")__nccwpck_require__.ab=__dirname+"/";var i=__nccwpck_require__(186);module.exports=i})();

package/dist/node_modules/mkdirp/package.json

@@ -1 +1 @@
-{"name":"mkdirp","description":"Recursively mkdir, like `mkdir -p`","version":"0.5.6","publishConfig":{"tag":"legacy"},"author":"James Halliday <mail@substack.net> (http://substack.net)","main":"index.js","keywords":["mkdir","directory"],"repository":{"type":"git","url":"https://github.com/substack/node-mkdirp.git"},"scripts":{"test":"tap test/*.js"},"dependencies":{"minimist":"^1.2.6"},"devDependencies":{"tap":"^16.0.1"},"bin":"bin/cmd.js","license":"MIT","files":["bin","index.js"],"_lastModified":"2026-03-12T13:29:46.851Z"}
+{"name":"mkdirp","description":"Recursively mkdir, like `mkdir -p`","version":"0.5.6","publishConfig":{"tag":"legacy"},"author":"James Halliday <mail@substack.net> (http://substack.net)","main":"index.js","keywords":["mkdir","directory"],"repository":{"type":"git","url":"https://github.com/substack/node-mkdirp.git"},"scripts":{"test":"tap test/*.js"},"dependencies":{"minimist":"^1.2.6"},"devDependencies":{"tap":"^16.0.1"},"bin":"bin/cmd.js","license":"MIT","files":["bin","index.js"],"_lastModified":"2026-06-11T01:17:55.489Z"}

package/dist/node_modules/url-join/lib/url-join.js

@@ -1 +1 @@
-(function(){var e={821:function(e){(function(r,i,t){if(true&&e.exports)e.exports=t();else if(typeof define==="function"&&define.amd)define(t);else i[r]=t()})("urljoin",this,(function(){function normalize(e){var r=[];if(e.length===0){return""}if(typeof e[0]!=="string"){throw new TypeError("Url must be a string. Received "+e[0])}if(e[0].match(/^[^/:]+:\/*$/)&&e.length>1){var i=e.shift();e[0]=i+e[0]}if(e[0].match(/^file:\/\/\//)){e[0]=e[0].replace(/^([^/:]+):\/*/,"$1:///")}else{e[0]=e[0].replace(/^([^/:]+):\/*/,"$1://")}for(var t=0;t<e.length;t++){var n=e[t];if(typeof n!=="string"){throw new TypeError("Url must be a string. Received "+n)}if(n===""){continue}if(t>0){n=n.replace(/^[\/]+/,"")}if(t<e.length-1){n=n.replace(/[\/]+$/,"")}else{n=n.replace(/[\/]+$/,"/")}r.push(n)}var f=r.join("/");f=f.replace(/\/(\?|&|#[^!])/g,"$1");var a=f.split("?");f=a.shift()+(a.length>0?"?":"")+a.join("&");return f}return function(){var e;if(typeof arguments[0]==="object"){e=arguments[0]}else{e=[].slice.call(arguments)}return normalize(e)}}))}};var r={};function __nccwpck_require__(i){var t=r[i];if(t!==undefined){return t.exports}var n=r[i]={exports:{}};var f=true;try{e[i].call(n.exports,n,n.exports,__nccwpck_require__);f=false}finally{if(f)delete r[i]}return n.exports}if(typeof __nccwpck_require__!=="undefined")__nccwpck_require__.ab=__dirname+"/";var i=__nccwpck_require__(821);module.exports=i})();
+(()=>{var e={821:function(e){(function(r,i,t){if(true&&e.exports)e.exports=t();else if(typeof define==="function"&&define.amd)define(t);else i[r]=t()})("urljoin",this,(function(){function normalize(e){var r=[];if(e.length===0){return""}if(typeof e[0]!=="string"){throw new TypeError("Url must be a string. Received "+e[0])}if(e[0].match(/^[^/:]+:\/*$/)&&e.length>1){var i=e.shift();e[0]=i+e[0]}if(e[0].match(/^file:\/\/\//)){e[0]=e[0].replace(/^([^/:]+):\/*/,"$1:///")}else{e[0]=e[0].replace(/^([^/:]+):\/*/,"$1://")}for(var t=0;t<e.length;t++){var n=e[t];if(typeof n!=="string"){throw new TypeError("Url must be a string. Received "+n)}if(n===""){continue}if(t>0){n=n.replace(/^[\/]+/,"")}if(t<e.length-1){n=n.replace(/[\/]+$/,"")}else{n=n.replace(/[\/]+$/,"/")}r.push(n)}var a=r.join("/");a=a.replace(/\/(\?|&|#[^!])/g,"$1");var f=a.split("?");a=f.shift()+(f.length>0?"?":"")+f.join("&");return a}return function(){var e;if(typeof arguments[0]==="object"){e=arguments[0]}else{e=[].slice.call(arguments)}return normalize(e)}}))}};var r={};function __nccwpck_require__(i){var t=r[i];if(t!==undefined){return t.exports}var n=r[i]={exports:{}};var a=true;try{e[i].call(n.exports,n,n.exports,__nccwpck_require__);a=false}finally{if(a)delete r[i]}return n.exports}if(typeof __nccwpck_require__!=="undefined")__nccwpck_require__.ab=__dirname+"/";var i=__nccwpck_require__(821);module.exports=i})();

package/dist/node_modules/url-join/package.json

@@ -1 +1 @@
-{"name":"url-join","version":"4.0.1","description":"Join urls and normalize as in path.join.","main":"lib/url-join.js","scripts":{"test":"mocha --require should"},"repository":{"type":"git","url":"git://github.com/jfromaniello/url-join.git"},"keywords":["url","join"],"author":"José F. Romaniello <jfromaniello@gmail.com> (http://joseoncode.com)","license":"MIT","devDependencies":{"conventional-changelog":"^1.1.10","mocha":"^3.2.0","should":"~1.2.1"},"_lastModified":"2026-03-12T13:29:41.953Z"}
+{"name":"url-join","version":"4.0.1","description":"Join urls and normalize as in path.join.","main":"lib/url-join.js","scripts":{"test":"mocha --require should"},"repository":{"type":"git","url":"git://github.com/jfromaniello/url-join.git"},"keywords":["url","join"],"author":"José F. Romaniello <jfromaniello@gmail.com> (http://joseoncode.com)","license":"MIT","devDependencies":{"conventional-changelog":"^1.1.10","mocha":"^3.2.0","should":"~1.2.1"},"_lastModified":"2026-06-11T01:17:50.956Z"}

package/dist/server/actions/attachments.js

@@ -221,10 +221,10 @@ async function createMiddleware(ctx, next) {
       const filePath = (values == null ? void 0 : values.path) ?? "";
       const filename = (values == null ? void 0 : values.filename) ?? "";
       try {
-        (0, import_local.resolveSafePath)((0, import_local.getDocumentRoot)(storage), filePath, filename);
+        (0, import_local.resolveSafePath)((0, import_local.getDocumentRoot)(storage), (0, import_local.normalizeLocalStoragePath)(filePath), filename);
       } catch (error) {
         if (error.code === "PATH_TRAVERSAL") {
-          return ctx.throw(400, error);
+          return ctx.throw(400, error.message);
         }
         throw error;
       }

package/dist/server/actions/index.js

@@ -41,11 +41,18 @@ __export(actions_exports, {
 module.exports = __toCommonJS(actions_exports);
 var import_actions = __toESM(require("@nocobase/actions"));
 var import_attachments = require("./attachments");
+var import_storage_validation = require("./storage-validation");
 var storageActions = __toESM(require("./storages"));
 function actions_default({ app }) {
   app.resourcer.define({
     name: "storages",
-    actions: storageActions
+    actions: storageActions,
+    middlewares: [
+      {
+        only: ["create", "update"],
+        handler: import_storage_validation.validateStorageMiddleware
+      }
+    ]
   });
   app.resourcer.use(import_attachments.createMiddleware, { tag: "createMiddleware", after: "auth" });
   app.resourcer.registerActionHandler("upload", import_actions.default.create);

package/dist/server/actions/storage-validation.d.ts

@@ -0,0 +1,10 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import { Context, Next } from '@nocobase/actions';
+export declare function validateStorageMiddleware(ctx: Context, next: Next): Promise<never>;

package/dist/server/actions/storage-validation.js

@@ -0,0 +1,73 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var storage_validation_exports = {};
+__export(storage_validation_exports, {
+  validateStorageMiddleware: () => validateStorageMiddleware
+});
+module.exports = __toCommonJS(storage_validation_exports);
+var import_local = require("../storages/local");
+async function validateStorageMiddleware(ctx, next) {
+  const { actionName, params } = ctx.action;
+  const values = params.values || {};
+  let storage = values;
+  const hasSubmittedDocumentRoot = Object.prototype.hasOwnProperty.call(values.options || {}, "documentRoot");
+  if (actionName === "update" && params.filterByTk) {
+    const repository = ctx.db.getRepository("storages");
+    let existing = await repository.findById(params.filterByTk);
+    if (!existing) {
+      existing = await repository.findOne({
+        filter: {
+          name: params.filterByTk
+        }
+      });
+    }
+    if (existing) {
+      const existingValues = existing.toJSON();
+      storage = {
+        ...existingValues,
+        ...values,
+        options: {
+          ...existingValues.options || {},
+          ...values.options || {}
+        }
+      };
+    }
+  }
+  try {
+    (0, import_local.validateLocalStorageConfig)(storage, { validateDocumentRoot: hasSubmittedDocumentRoot });
+  } catch (error) {
+    if (error.code === "PATH_TRAVERSAL") {
+      return ctx.throw(400, error.message);
+    }
+    throw error;
+  }
+  await next();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  validateStorageMiddleware
+});

package/dist/server/commands/repair-filenames.d.ts

@@ -0,0 +1,55 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import { Application } from '@nocobase/server';
+import { AttachmentModel, StorageClassType, StorageModel } from '../storages';
+export type RepairFilenameStatus = 'pending' | 'repaired' | 'skipped' | 'failed';
+export interface RepairFilenameItem {
+    collectionName: string;
+    id: number | string;
+    storageId: number | string;
+    storageType: string;
+    oldPath: string;
+    oldFilename: string;
+    newPath: string;
+    newFilename: string;
+    oldKey: string;
+    newKey: string;
+    sourceExists?: boolean;
+    targetExists?: boolean;
+    status: RepairFilenameStatus;
+    reason?: string;
+}
+export interface RepairFilenamesOptions {
+    apply?: boolean;
+    batchSize?: number;
+    limit?: number;
+}
+export interface RepairFilenamesResult {
+    dryRun: boolean;
+    scanned: number;
+    candidates: RepairFilenameItem[];
+    repaired: RepairFilenameItem[];
+    skipped: RepairFilenameItem[];
+    failed: RepairFilenameItem[];
+}
+interface FileManagerLike {
+    storageTypes: {
+        get(type: string): StorageClassType | undefined;
+    };
+    loadStorages(): Promise<void>;
+    storagesCache: Map<number | string, StorageModel>;
+}
+export declare function replaceInvisibleChars(value?: string | null): string;
+export declare function getRepairedAttachmentValues(record: Pick<AttachmentModel, 'path' | 'filename'>): {
+    path: string;
+    filename: string;
+};
+export declare function repairAttachmentFilenames(app: Application, fileManager: FileManagerLike, options?: RepairFilenamesOptions): Promise<RepairFilenamesResult>;
+export declare function registerRepairFilenamesCommand(app: Application): void;
+export {};

package/dist/server/commands/repair-filenames.js

@@ -0,0 +1,283 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var repair_filenames_exports = {};
+__export(repair_filenames_exports, {
+  getRepairedAttachmentValues: () => getRepairedAttachmentValues,
+  registerRepairFilenamesCommand: () => registerRepairFilenamesCommand,
+  repairAttachmentFilenames: () => repairAttachmentFilenames,
+  replaceInvisibleChars: () => replaceInvisibleChars
+});
+module.exports = __toCommonJS(repair_filenames_exports);
+var import_sequelize = require("sequelize");
+var import_utils = require("../utils");
+function containsInvisibleChars(value) {
+  return Array.from(value || "").some((char) => {
+    const code = char.charCodeAt(0);
+    return code <= 31 || code >= 127 && code <= 159;
+  });
+}
+function replaceInvisibleChars(value) {
+  return Array.from(value || "").map((char) => {
+    const code = char.charCodeAt(0);
+    return code <= 31 || code >= 127 && code <= 159 ? "-" : char;
+  }).join("");
+}
+function getRepairedAttachmentValues(record) {
+  return {
+    path: replaceInvisibleChars(record.path),
+    filename: replaceInvisibleChars(record.filename)
+  };
+}
+function updateUrlValue(url, oldKey, newKey) {
+  if (!url) {
+    return url;
+  }
+  const encodedOldKey = oldKey.split("/").map((segment) => encodeURIComponent(segment)).join("/");
+  const encodedNewKey = newKey.split("/").map((segment) => encodeURIComponent(segment)).join("/");
+  return url.split(oldKey).join(newKey).split(encodedOldKey).join(encodedNewKey);
+}
+function formatItem(item) {
+  return {
+    collectionName: item.collectionName,
+    id: item.id,
+    storageId: item.storageId,
+    storageType: item.storageType,
+    oldKey: item.oldKey,
+    newKey: item.newKey,
+    sourceExists: item.sourceExists,
+    targetExists: item.targetExists,
+    status: item.status,
+    reason: item.reason
+  };
+}
+async function getFileCollectionNames(app) {
+  var _a;
+  const repository = app.db.getRepository("collections") || ((_a = app.db.getCollection("collections")) == null ? void 0 : _a.repository);
+  if (repository) {
+    const collections = await repository.find({
+      filter: {
+        "options.template": "file"
+      }
+    });
+    return Array.from(/* @__PURE__ */ new Set(["attachments", ...collections.map((collection) => collection.get("name"))]));
+  }
+  return Array.from(
+    /* @__PURE__ */ new Set([
+      "attachments",
+      ...Array.from(app.db.collections.values()).filter((collection) => collection.options.template === "file").map((collection) => collection.name)
+    ])
+  );
+}
+async function loadFileCollections(app) {
+  var _a, _b;
+  const collection = app.db.getCollection("collections");
+  if (!collection) {
+    return;
+  }
+  const repository = collection.repository;
+  await ((_a = repository.setApp) == null ? void 0 : _a.call(repository, app));
+  await ((_b = repository.load) == null ? void 0 : _b.call(repository));
+}
+async function repairCollectionAttachmentFilenames({
+  app,
+  fileManager,
+  collectionName,
+  result,
+  apply,
+  batchSize,
+  limit
+}) {
+  const collection = app.db.getCollection(collectionName);
+  if (!collection) {
+    return;
+  }
+  const Model = collection.model;
+  let lastId = null;
+  while (result.scanned < limit) {
+    const rows = await Model.findAll({
+      attributes: ["id", "path", "filename", "storageId", "url"],
+      where: lastId ? { id: { [import_sequelize.Op.gt]: lastId } } : void 0,
+      order: [["id", "ASC"]],
+      limit: Math.min(batchSize, limit - result.scanned)
+    });
+    if (!rows.length) {
+      break;
+    }
+    for (const row of rows) {
+      result.scanned += 1;
+      lastId = row.get("id");
+      const record = row.toJSON();
+      if (!containsInvisibleChars(record.path) && !containsInvisibleChars(record.filename)) {
+        continue;
+      }
+      const storage = fileManager.storagesCache.get(record.storageId);
+      const { path: newPath, filename: newFilename } = getRepairedAttachmentValues(record);
+      const oldKey = (0, import_utils.getFileKey)(record);
+      const newRecord = { ...record, path: newPath, filename: newFilename };
+      const newKey = (0, import_utils.getFileKey)(newRecord);
+      const item = {
+        collectionName,
+        id: lastId,
+        storageId: record.storageId,
+        storageType: (storage == null ? void 0 : storage.type) || "",
+        oldPath: record.path || "",
+        oldFilename: record.filename,
+        newPath,
+        newFilename,
+        oldKey,
+        newKey,
+        status: "pending"
+      };
+      result.candidates.push(item);
+      if (!storage) {
+        item.status = "skipped";
+        item.reason = "storage_not_found";
+        result.skipped.push(item);
+        continue;
+      }
+      if (oldKey === newKey) {
+        item.status = "skipped";
+        item.reason = "unchanged";
+        result.skipped.push(item);
+        continue;
+      }
+      try {
+        const StorageClass = fileManager.storageTypes.get(storage.type);
+        if (!StorageClass) {
+          item.status = "skipped";
+          item.reason = "storage_type_not_found";
+          result.skipped.push(item);
+          continue;
+        }
+        const storageInstance = new StorageClass(storage);
+        item.sourceExists = await storageInstance.exists(record);
+        if (!item.sourceExists) {
+          item.status = "skipped";
+          item.reason = "source_not_found";
+          result.skipped.push(item);
+          continue;
+        }
+        item.targetExists = await storageInstance.exists(newRecord);
+        if (item.targetExists) {
+          item.status = "skipped";
+          item.reason = "target_exists";
+          result.skipped.push(item);
+          continue;
+        }
+        if (apply) {
+          await storageInstance.copy(record, newRecord);
+          await row.update({
+            path: newPath,
+            filename: newFilename,
+            url: updateUrlValue(record.url, oldKey, newKey)
+          });
+          try {
+            const [deleted] = await storageInstance.delete([record]);
+            if (!deleted) {
+              item.reason = "delete_old_failed";
+            }
+          } catch (error) {
+            item.reason = `delete_old_failed: ${error.message}`;
+          }
+          item.status = "repaired";
+          result.repaired.push(item);
+        }
+      } catch (error) {
+        item.status = "failed";
+        item.reason = error.message;
+        result.failed.push(item);
+      }
+    }
+  }
+}
+async function repairAttachmentFilenames(app, fileManager, options = {}) {
+  const apply = !!options.apply;
+  const batchSize = options.batchSize || 500;
+  const limit = options.limit || Number.POSITIVE_INFINITY;
+  const result = {
+    dryRun: !apply,
+    scanned: 0,
+    candidates: [],
+    repaired: [],
+    skipped: [],
+    failed: []
+  };
+  if (!fileManager.storagesCache.size) {
+    await fileManager.loadStorages();
+  }
+  await loadFileCollections(app);
+  for (const collectionName of await getFileCollectionNames(app)) {
+    if (result.scanned >= limit) {
+      break;
+    }
+    await repairCollectionAttachmentFilenames({
+      app,
+      fileManager,
+      collectionName,
+      result,
+      apply,
+      batchSize,
+      limit
+    });
+  }
+  return result;
+}
+function registerRepairFilenamesCommand(app) {
+  const command = app.findCommand("file-manager") || app.command("file-manager");
+  command.command("repair-filenames").preload().option("--apply", "rename objects and update attachment records").option("--batch-size [batchSize]", "batch size for scanning attachments").option("--limit [limit]", "maximum number of attachment records to scan").action(async (options) => {
+    const fileManager = app.pm.get("file-manager");
+    const result = await repairAttachmentFilenames(app, fileManager, {
+      apply: !!options.apply,
+      batchSize: options.batchSize ? Number(options.batchSize) : void 0,
+      limit: options.limit ? Number(options.limit) : void 0
+    });
+    console.log(
+      JSON.stringify(
+        {
+          dryRun: result.dryRun,
+          scanned: result.scanned,
+          candidates: result.candidates.length,
+          repaired: result.repaired.length,
+          skipped: result.skipped.length,
+          failed: result.failed.length
+        },
+        null,
+        2
+      )
+    );
+    if (result.candidates.length) {
+      console.table(result.candidates.map(formatItem));
+    }
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getRepairedAttachmentValues,
+  registerRepairFilenamesCommand,
+  repairAttachmentFilenames,
+  replaceInvisibleChars
+});

package/dist/server/index.d.ts

@@ -10,5 +10,5 @@ import { StorageEngine } from 'multer';
 export * from '../constants';
 export { AttachmentModel, default, PluginFileManagerServer, StorageModel } from './server';
 export { cloudFilenameGetter } from './utils';
-export { StorageType } from './storages';
+export { StorageType, GetFileStreamOptions } from './storages';
 export { StorageEngine };

package/dist/server/index.js

@@ -38,6 +38,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var server_exports = {};
 __export(server_exports, {
   AttachmentModel: () => import_server.AttachmentModel,
+  GetFileStreamOptions: () => import_storages.GetFileStreamOptions,
   PluginFileManagerServer: () => import_server.PluginFileManagerServer,
   StorageEngine: () => import_multer.StorageEngine,
   StorageModel: () => import_server.StorageModel,
@@ -54,6 +55,7 @@ var import_storages = require("./storages");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AttachmentModel,
+  GetFileStreamOptions,
   PluginFileManagerServer,
   StorageEngine,
   StorageModel,

package/dist/server/server.d.ts

@@ -11,22 +11,25 @@ import { Model, Transactionable } from '@nocobase/database';
 import { Plugin } from '@nocobase/server';
 import { Registry } from '@nocobase/utils';
 import { Readable } from 'stream';
-import { AttachmentModel, StorageClassType, StorageModel } from './storages';
+import { AttachmentModel, GetFileStreamOptions, StorageClassType, StorageModel } from './storages';
 export type * from './storages';
 export type FileRecordOptions = {
     collectionName: string;
     filePath: string;
     storageName?: string;
+    subPath?: string;
     values?: any;
 } & Transactionable;
 export type UploadFileOptions = {
     filePath: string;
     storageName?: string;
+    subPath?: string;
     documentRoot?: string;
 };
 export declare class PluginFileManagerServer extends Plugin {
     storageTypes: Registry<StorageClassType>;
     storagesCache: Map<string | number, StorageModel>;
+    static staticImport(): Promise<void>;
     afterDestroy: (record: Model, options: any) => Promise<void>;
     registerStorageType(type: string, Type: StorageClassType): void;
     createFileRecord(options: FileRecordOptions): Promise<any>;
@@ -50,7 +53,7 @@ export declare class PluginFileManagerServer extends Plugin {
     load(): Promise<void>;
     getFileURL(file: AttachmentModel, preview?: boolean): Promise<any>;
     isPublicAccessStorage(storageName: any): Promise<boolean>;
-    getFileStream(file: AttachmentModel): Promise<{
+    getFileStream(file: AttachmentModel, options?: GetFileStreamOptions): Promise<{
         stream: Readable;
         contentType?: string;
     }>;

package/dist/server/server.js

@@ -54,6 +54,7 @@ var import_local = __toESM(require("./storages/local"));
 var import_s3 = __toESM(require("./storages/s3"));
 var import_tx_cos = __toESM(require("./storages/tx-cos"));
 var import_utils2 = require("./utils");
+var import_repair_filenames = require("./commands/repair-filenames");
 const DEFAULT_STORAGE_TYPE = import_constants.STORAGE_TYPE_LOCAL;
 class FileDeleteError extends Error {
   data;
@@ -66,6 +67,9 @@ class FileDeleteError extends Error {
 class PluginFileManagerServer extends import_server.Plugin {
   storageTypes = new import_utils.Registry();
   storagesCache = /* @__PURE__ */ new Map();
+  static async staticImport() {
+    import_server.Application.addCommand(import_repair_filenames.registerRepairFilenamesCommand);
+  }
   afterDestroy = async (record, options) => {
     var _a;
     const { collection } = record.constructor;
@@ -96,29 +100,34 @@ class PluginFileManagerServer extends import_server.Plugin {
     this.storageTypes.register(type, Type);
   }
   async createFileRecord(options) {
-    const { values, storageName, collectionName, filePath, transaction } = options;
+    const { values, storageName, subPath, collectionName, filePath, transaction } = options;
     const collection = this.db.getCollection(collectionName);
     if (!collection) {
       throw new Error(`collection does not exist`);
     }
     const collectionRepository = this.db.getRepository(collectionName);
     const name = storageName || collection.options.storage;
-    const data = await this.uploadFile({ storageName: name, filePath });
+    const data = await this.uploadFile({ storageName: name, subPath, filePath });
     return await collectionRepository.create({ values: { ...data, ...values }, transaction });
   }
   parseStorage(instance) {
     return this.app.environment.renderJsonTemplate(instance.toJSON());
   }
   async uploadFile(options) {
-    const { storageName, filePath, documentRoot } = options;
+    const { storageName, subPath, filePath, documentRoot } = options;
     if (!this.storagesCache.size) {
       await this.loadStorages();
     }
     const storages = Array.from(this.storagesCache.values());
-    const storage = storages.find((item) => item.name === storageName) || storages.find((item) => item.default);
-    if (!storage) {
+    const cachedStorage = storages.find((item) => item.name === storageName) || storages.find((item) => item.default);
+    if (!cachedStorage) {
       throw new Error("[file-manager] no linked or default storage provided");
     }
+    const storage = {
+      ...cachedStorage,
+      options: { ...cachedStorage.options || {} },
+      path: (0, import_utils2.resolveStoragePath)(cachedStorage.path, subPath)
+    };
     const fileStream = import_fs.default.createReadStream(filePath);
     if (documentRoot) {
       storage.options["documentRoot"] = documentRoot;
@@ -212,6 +221,9 @@ class PluginFileManagerServer extends import_server.Plugin {
     this.storageTypes.register(import_constants.STORAGE_TYPE_S3, import_s3.default);
     this.storageTypes.register(import_constants.STORAGE_TYPE_TX_COS, import_tx_cos.default);
     const Storage = this.db.getModel("storages");
+    Storage.beforeSave((m) => {
+      (0, import_local.validateLocalStorageConfig)(m.toJSON());
+    });
     Storage.afterSave(async (m, { transaction }) => {
       await this.loadStorages({ transaction });
       this.sendSyncMessage({ type: "reloadStorages" }, { transaction });
@@ -324,7 +336,7 @@ class PluginFileManagerServer extends import_server.Plugin {
     }
     return !!((_a = storage.options) == null ? void 0 : _a.public);
   }
-  async getFileStream(file) {
+  async getFileStream(file, options) {
     if (!file.storageId) {
       throw new Error("File storageId not found");
     }
@@ -340,7 +352,7 @@ class PluginFileManagerServer extends import_server.Plugin {
     if (!storageInstance) {
       throw new Error(`[file-manager] storage type "${storage.type}" is not defined`);
     }
-    return storageInstance.getFileStream(file);
+    return storageInstance.getFileStream(file, options);
   }
 }
 var server_default = PluginFileManagerServer;

package/dist/server/storages/ali-oss.d.ts

@@ -18,7 +18,7 @@ declare class AliYunOssStorage {
         filename?: typeof getRandomFilename;
     });
     _handleFile(req: any, file: any, cb: any): any;
-    _removeFile(req: any, file: any, cb: any): any;
+    _removeFile(req: any, file: any, cb: any): Promise<any>;
 }
 export default class extends StorageType {
     static defaults(): {
@@ -34,6 +34,8 @@ export default class extends StorageType {
         };
     };
     make(): AliYunOssStorage;
+    exists(record: AttachmentModel): Promise<boolean>;
+    copy(source: AttachmentModel, target: AttachmentModel): Promise<void>;
     delete(records: AttachmentModel[]): Promise<[number, AttachmentModel[]]>;
 }
 export {};