@nocobase/plugin-flow-engine 2.1.0-beta.43 → 2.1.0-beta.45

package/dist/server/template/resolver.js

@@ -42,6 +42,16 @@ __export(resolver_exports, {
 module.exports = __toCommonJS(resolver_exports);
 var import_ses = require("ses");
 var import_lodash = __toESM(require("lodash"));
+var import_utils = require("@nocobase/utils");
+var import_contexts = require("./contexts");
+const BLOCKED_SANDBOX_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+const sandboxProxyCache = /* @__PURE__ */ new WeakMap();
+const sandboxProxyMeta = /* @__PURE__ */ new WeakMap();
+const EMPTY_SANDBOX_CONTEXT = {
+  getSandboxKeys: () => [],
+  getSandboxValue: () => void 0
+};
+let resolverLockdownReady = false;
 async function resolveJsonTemplate(template, ctx) {
   const compile = async (source) => {
     if (typeof source === "string" && /\{\{.*?\}\}/.test(source)) {
@@ -75,6 +85,210 @@ async function replacePlaceholders(input, ctx) {
   }
   return result;
 }
+function isObjectLike(value) {
+  return value !== null && (typeof value === "object" || typeof value === "function");
+}
+function isTrustedPromise(value) {
+  return value instanceof Promise;
+}
+function isBlockedSandboxKey(key) {
+  return typeof key === "string" && BLOCKED_SANDBOX_KEYS.has(key);
+}
+function getSandboxDataDescriptor(source, key) {
+  if (isBlockedSandboxKey(key) || typeof key === "symbol") return void 0;
+  const descriptor = Reflect.getOwnPropertyDescriptor(source, key);
+  if (!descriptor || !("value" in descriptor)) return void 0;
+  if (key === "then" && typeof descriptor.value === "function") return void 0;
+  return descriptor;
+}
+function getPrimitiveDataDescriptor(source, key) {
+  if (source == null || isObjectLike(source)) return void 0;
+  return getSandboxDataDescriptor(Object(source), key);
+}
+function isSandboxContextSource(value) {
+  return value === EMPTY_SANDBOX_CONTEXT || value instanceof import_contexts.ServerBaseContext;
+}
+function wrapSandboxValue(value) {
+  if (isTrustedPromise(value)) {
+    return Promise.prototype.then.call(value, (resolved) => wrapSandboxValue(resolved));
+  }
+  if (!isObjectLike(value)) return value;
+  if (sandboxProxyMeta.has(value)) return value;
+  const cached = sandboxProxyCache.get(value);
+  if (cached) return cached;
+  const kind = isSandboxContextSource(value) ? "context" : typeof value === "function" ? "function" : "data";
+  const proxy = kind === "context" ? createSandboxContextProxy(value) : kind === "function" ? createSandboxFunctionProxy(value) : createSandboxDataProxy(value);
+  sandboxProxyCache.set(value, proxy);
+  sandboxProxyMeta.set(proxy, { kind, source: value });
+  return proxy;
+}
+function wrapRootSandboxContext(ctx) {
+  return wrapSandboxValue(isSandboxContextSource(ctx) ? ctx : EMPTY_SANDBOX_CONTEXT);
+}
+function ensureResolverLockdown() {
+  if (resolverLockdownReady) return;
+  (0, import_utils.lockdownSes)({
+    consoleTaming: "unsafe",
+    errorTaming: "unsafe",
+    overrideTaming: "moderate",
+    stackFiltering: "verbose"
+  });
+  resolverLockdownReady = true;
+}
+function createSandboxContextProxy(source) {
+  return new Proxy(/* @__PURE__ */ Object.create(null), {
+    get: (_target, key) => {
+      if (isBlockedSandboxKey(key) || typeof key !== "string") return void 0;
+      if (!source.getSandboxKeys().includes(key)) return void 0;
+      return wrapSandboxValue(source.getSandboxValue(key));
+    },
+    has: (_target, key) => typeof key === "string" && source.getSandboxKeys().includes(key),
+    ownKeys: () => source.getSandboxKeys(),
+    getOwnPropertyDescriptor: (_target, key) => {
+      if (isBlockedSandboxKey(key) || typeof key !== "string" || !source.getSandboxKeys().includes(key)) {
+        return void 0;
+      }
+      return {
+        configurable: true,
+        enumerable: true,
+        value: wrapSandboxValue(source.getSandboxValue(key))
+      };
+    },
+    getPrototypeOf: () => null,
+    set: () => false,
+    defineProperty: () => false,
+    deleteProperty: () => false
+  });
+}
+function createSandboxFunctionProxy(source) {
+  const callable = (...args) => Reflect.apply(source, void 0, args);
+  return new Proxy(callable, {
+    apply: (_target, _thisArg, argArray) => wrapSandboxValue(Reflect.apply(source, void 0, argArray)),
+    get: (_target, key) => {
+      if (key === "length" || key === "name") return Reflect.get(source, key);
+      return void 0;
+    },
+    has: (_target, key) => key === "length" || key === "name",
+    ownKeys: () => [],
+    getOwnPropertyDescriptor: () => void 0,
+    getPrototypeOf: () => null,
+    set: () => false,
+    defineProperty: () => false,
+    deleteProperty: () => false
+  });
+}
+function createSandboxDataProxy(source) {
+  const target = Array.isArray(source) ? new Array(source.length) : /* @__PURE__ */ Object.create(null);
+  return new Proxy(target, {
+    get: (_target, key) => {
+      const descriptor = getSandboxDataDescriptor(source, key);
+      if (!descriptor) return void 0;
+      const value = descriptor.value;
+      return typeof value === "function" ? wrapSandboxValue(value.bind(source)) : wrapSandboxValue(value);
+    },
+    has: (_target, key) => {
+      if (isBlockedSandboxKey(key) || typeof key !== "string") return false;
+      return !!getSandboxDataDescriptor(source, key);
+    },
+    ownKeys: () => {
+      const keys = Reflect.ownKeys(source).filter((key) => {
+        if (typeof key !== "string" || isBlockedSandboxKey(key)) return false;
+        return !!getSandboxDataDescriptor(source, key);
+      });
+      if (Array.isArray(source) && !keys.includes("length")) keys.push("length");
+      return keys;
+    },
+    getOwnPropertyDescriptor: (proxyTarget, key) => {
+      if (isBlockedSandboxKey(key) || typeof key === "symbol") return void 0;
+      if (Array.isArray(source) && key === "length") {
+        return Reflect.getOwnPropertyDescriptor(proxyTarget, key);
+      }
+      const descriptor = getSandboxDataDescriptor(source, key);
+      if (!descriptor) return void 0;
+      return {
+        configurable: true,
+        enumerable: descriptor.enumerable,
+        writable: false,
+        value: wrapSandboxValue(descriptor.value)
+      };
+    },
+    getPrototypeOf: () => null,
+    set: () => false,
+    defineProperty: () => false,
+    deleteProperty: () => false
+  });
+}
+async function unwrapSandboxValue(value, seen = /* @__PURE__ */ new WeakMap()) {
+  const resolved = isTrustedPromise(value) ? await value : value;
+  if (!isObjectLike(resolved)) return resolved;
+  const meta = sandboxProxyMeta.get(resolved);
+  if ((meta == null ? void 0 : meta.kind) === "function" || typeof resolved === "function") return void 0;
+  const source = (meta == null ? void 0 : meta.source) ?? resolved;
+  if (!isObjectLike(source)) return source;
+  if (seen.has(source)) return seen.get(source);
+  if (isSandboxContextSource(source)) {
+    const out2 = {};
+    seen.set(source, out2);
+    for (const key of source.getSandboxKeys()) {
+      if (BLOCKED_SANDBOX_KEYS.has(key)) continue;
+      out2[key] = await unwrapSandboxValue(wrapSandboxValue(source.getSandboxValue(key)), seen);
+    }
+    return out2;
+  }
+  if (Array.isArray(source)) {
+    const out2 = [];
+    seen.set(source, out2);
+    const lengthDescriptor = Reflect.getOwnPropertyDescriptor(source, "length");
+    const length = typeof (lengthDescriptor == null ? void 0 : lengthDescriptor.value) === "number" ? lengthDescriptor.value : 0;
+    for (let index = 0; index < length; index++) {
+      const descriptor = Reflect.getOwnPropertyDescriptor(source, String(index));
+      if (!descriptor || !("value" in descriptor)) continue;
+      out2.push(await unwrapSandboxValue(descriptor.value, seen));
+    }
+    return out2;
+  }
+  if (source instanceof Date) return source;
+  const out = {};
+  seen.set(source, out);
+  for (const key of Object.keys(source)) {
+    if (BLOCKED_SANDBOX_KEYS.has(key)) continue;
+    const descriptor = getSandboxDataDescriptor(source, key);
+    if (!descriptor) continue;
+    out[key] = await unwrapSandboxValue(descriptor.value, seen);
+  }
+  return out;
+}
+function getRootSandboxValue(ctx, key) {
+  if (BLOCKED_SANDBOX_KEYS.has(key)) return void 0;
+  if (isSandboxContextSource(ctx)) {
+    if (!ctx.getSandboxKeys().includes(key)) return void 0;
+    return wrapSandboxValue(ctx.getSandboxValue(key));
+  }
+  return void 0;
+}
+async function getSandboxProperty(value, key) {
+  if (BLOCKED_SANDBOX_KEYS.has(key)) return void 0;
+  const resolved = isTrustedPromise(value) ? await value : value;
+  if (resolved == null) return void 0;
+  const meta = isObjectLike(resolved) ? sandboxProxyMeta.get(resolved) : void 0;
+  const source = (meta == null ? void 0 : meta.source) ?? resolved;
+  if (isSandboxContextSource(source)) {
+    if (!source.getSandboxKeys().includes(key)) return void 0;
+    return wrapSandboxValue(source.getSandboxValue(key));
+  }
+  if (typeof source === "function") {
+    return key === "length" || key === "name" ? Reflect.get(source, key) : void 0;
+  }
+  if (!isObjectLike(source)) {
+    const descriptor2 = getPrimitiveDataDescriptor(source, key);
+    if (!descriptor2 || typeof descriptor2.value === "function") return void 0;
+    return wrapSandboxValue(descriptor2.value);
+  }
+  const descriptor = getSandboxDataDescriptor(source, key);
+  if (!descriptor) return void 0;
+  const current = descriptor.value;
+  return typeof current === "function" ? wrapSandboxValue(current.bind(source)) : wrapSandboxValue(current);
+}
 async function evaluate(expr, ctx) {
   try {
     const raw = expr.trim();
@@ -84,40 +298,36 @@ async function evaluate(expr, ctx) {
     if (dotOnly) {
       const first = dotOnly[1];
       const rest = dotOnly[2];
-      const base = await ctx[first];
-      if (!rest) return base;
+      const base = getRootSandboxValue(ctx, first);
+      if (!rest) return await unwrapSandboxValue(wrapSandboxValue(base));
       const resolved = await asyncGetValuesByPath(base, rest);
       if (typeof resolved !== "undefined" || !rest.includes("-")) {
-        return resolved;
+        return await unwrapSandboxValue(resolved);
       }
     }
     const transformed = preprocessExpression(raw);
+    ensureResolverLockdown();
     const compartment = new Compartment({
-      ctx,
-      __get: (varName, path) => getAtPath(ctx, varName, path),
-      console
+      ctx: wrapRootSandboxContext(ctx),
+      __get: wrapSandboxValue((varName, path) => getAtPath(ctx, varName, path))
     });
     const wrapped = `(async () => { try { return ${transformed}; } catch (e) { return undefined; } })()`;
-    return await compartment.evaluate(wrapped);
+    return await unwrapSandboxValue(await compartment.evaluate(wrapped));
   } catch (_2) {
     return void 0;
   }
 }
 async function getAtPath(ctx, varName, path) {
   try {
-    let current = await ctx[varName];
+    let current = getRootSandboxValue(ctx, varName);
     if (!path) return current;
     const norm = String(path || "").replace(/^\./, "");
     const segments = import_lodash.default.toPath(norm);
     for (const seg of segments) {
       if (current == null) return void 0;
-      let val = current[seg];
-      if (val && typeof val["then"] === "function") {
-        val = await val;
-      }
-      current = val;
+      current = await getSandboxProperty(current, seg);
     }
-    return current;
+    return wrapSandboxValue(current);
   } catch (_2) {
     return void 0;
   }
@@ -134,18 +344,19 @@ async function asyncGetValuesByPath(obj, path, defaultValue) {
       if (Array.isArray(currentValue)) {
         shouldReturnArray = true;
         const rest = keys.slice(i).join(".");
-        const parts = await Promise.all(currentValue.map((el) => asyncGetValuesByPath(el, rest, defaultValue)));
+        const parts = await Promise.all(
+          Array.prototype.map.call(currentValue, (el) => asyncGetValuesByPath(el, rest, defaultValue))
+        );
         for (const p of parts) {
-          if (Array.isArray(p)) result.push(...p);
-          else if (typeof p !== "undefined") result.push(p);
+          if (Array.isArray(p)) {
+            for (let index = 0; index < p.length; index++) {
+              if (typeof p[index] !== "undefined") result.push(p[index]);
+            }
+          } else if (typeof p !== "undefined") result.push(p);
         }
         break;
       }
-      let val = currentValue == null ? void 0 : currentValue[key];
-      if (val && typeof val.then === "function") {
-        val = await val;
-      }
-      currentValue = val;
+      currentValue = await getSandboxProperty(currentValue, key);
       if (i === keys.length - 1) {
         result.push(currentValue);
       }

package/dist/swagger/flow-surfaces.d.ts

@@ -4001,6 +4001,118 @@ declare const _default: {
                         type: string;
                         enum: string[];
                     };
+                    errorCount: {
+                        type: string;
+                        description: string;
+                    };
+                    details: {
+                        type: string;
+                        description: string;
+                        properties: {
+                            errorCount: {
+                                type: string;
+                                description: string;
+                                example: number;
+                            };
+                            mustFixAllErrorsBeforeRetry: {
+                                type: string;
+                                example: boolean;
+                            };
+                            retryPolicy: {
+                                type: string;
+                                example: string;
+                            };
+                            sameWriteRetryRequired: {
+                                type: string;
+                                example: boolean;
+                            };
+                            agentInstruction: {
+                                type: string;
+                                description: string;
+                            };
+                            requiredBlockPolicy: {
+                                type: string;
+                                properties: {
+                                    requiredBlockTypes: {
+                                        type: string;
+                                        items: {
+                                            type: string;
+                                        };
+                                    };
+                                    fixStrategy: {
+                                        type: string;
+                                        example: string;
+                                    };
+                                    doNotReplaceOrDrop: {
+                                        type: string;
+                                        example: boolean;
+                                    };
+                                };
+                                additionalProperties: boolean;
+                            };
+                        };
+                        additionalProperties: boolean;
+                    };
+                    errors: {
+                        type: string;
+                        description: string;
+                        items: {
+                            type: string;
+                            properties: {
+                                index: {
+                                    type: string;
+                                    description: string;
+                                    example: number;
+                                };
+                                code: {
+                                    type: string;
+                                    description: string;
+                                    example: string;
+                                };
+                                message: {
+                                    type: string;
+                                    description: string;
+                                };
+                                status: {
+                                    type: string;
+                                    description: string;
+                                    example: number;
+                                };
+                                type: {
+                                    type: string;
+                                    description: string;
+                                    example: string;
+                                    enum: string[];
+                                };
+                                path: {
+                                    type: string;
+                                    description: string;
+                                    example: string;
+                                };
+                                ruleId: {
+                                    type: string;
+                                    description: string;
+                                    example: string;
+                                };
+                                details: {
+                                    type: string;
+                                    description: string;
+                                    additionalProperties: boolean;
+                                    example: {
+                                        action: string;
+                                        fieldPath: string;
+                                        titleField: string;
+                                        targetCollection: string;
+                                        invalidReason: string;
+                                        availableFields: string[];
+                                        suggestion: string;
+                                    };
+                                };
+                            };
+                            required: string[];
+                            additionalProperties: boolean;
+                        };
+                    };
                 };
                 required: string[];
                 additionalProperties: boolean;
@@ -5250,11 +5362,74 @@ declare const _default: {
                     }[];
                 };
                 properties: {
+                    message: {
+                        type: string;
+                        description: string;
+                        example: string;
+                    };
+                    errorCount: {
+                        type: string;
+                        description: string;
+                        example: number;
+                    };
+                    details: {
+                        type: string;
+                        description: string;
+                        properties: {
+                            errorCount: {
+                                type: string;
+                                description: string;
+                                example: number;
+                            };
+                            mustFixAllErrorsBeforeRetry: {
+                                type: string;
+                                example: boolean;
+                            };
+                            retryPolicy: {
+                                type: string;
+                                example: string;
+                            };
+                            sameWriteRetryRequired: {
+                                type: string;
+                                example: boolean;
+                            };
+                            agentInstruction: {
+                                type: string;
+                                description: string;
+                            };
+                            requiredBlockPolicy: {
+                                type: string;
+                                properties: {
+                                    requiredBlockTypes: {
+                                        type: string;
+                                        items: {
+                                            type: string;
+                                        };
+                                    };
+                                    fixStrategy: {
+                                        type: string;
+                                        example: string;
+                                    };
+                                    doNotReplaceOrDrop: {
+                                        type: string;
+                                        example: boolean;
+                                    };
+                                };
+                                additionalProperties: boolean;
+                            };
+                        };
+                        additionalProperties: boolean;
+                    };
                     errors: {
                         type: string;
                         items: {
                             type: string;
                             properties: {
+                                index: {
+                                    type: string;
+                                    description: string;
+                                    example: number;
+                                };
                                 code: {
                                     type: string;
                                     description: string;