@nocobase/plugin-flow-engine 2.3.0-alpha.1 → 2.3.0-beta.10

package/dist/server/variables/resolve.d.ts

@@ -7,15 +7,33 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 import type { ResourcerContext } from '@nocobase/resourcer';
+import { type AnalyzedTemplate, type ResolvePathPolicy } from '../template/variable-expression';
 import { JSONValue } from '../template/resolver';
-type ResolveBatchItem = {
+import { type RecordBindingPlan } from './record-bindings';
+export type ResolveBatchItem = {
     id?: string | number;
     template: JSONValue;
     contextParams?: Record<string, unknown>;
 };
+export type AnalyzedResolveBatchItem = ResolveBatchItem & {
+    analysis: AnalyzedTemplate;
+    bindingPlan: RecordBindingPlan;
+    policy: ResolvePathPolicy;
+};
 export declare function resolveVariablesTemplate(ctx: ResourcerContext, template: JSONValue, contextParams?: Record<string, unknown>): Promise<any>;
+export declare function isLegacyVariableTemplateSafe(template: JSONValue): boolean;
+export declare function resolveFlowModelVariablesTemplate(ctx: ResourcerContext, options: {
+    contractRd?: string | number;
+    contextParams?: Record<string, unknown>;
+    rd?: string | number;
+    template: JSONValue;
+}): Promise<any>;
+export declare function resolveAnalyzedVariablesTemplate(ctx: ResourcerContext, analysis: AnalyzedTemplate, policy: ResolvePathPolicy, bindingPlan: RecordBindingPlan): Promise<any>;
 export declare function resolveVariablesBatch(ctx: ResourcerContext, items: ResolveBatchItem[]): Promise<{
     id?: string | number;
     data: unknown;
 }[]>;
-export {};
+export declare function resolveAnalyzedVariablesBatch(ctx: ResourcerContext, items: AnalyzedResolveBatchItem[]): Promise<{
+    id?: string | number;
+    data: unknown;
+}[]>;

package/dist/server/variables/resolve.js

@@ -26,15 +26,27 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var resolve_exports = {};
 __export(resolve_exports, {
+  isLegacyVariableTemplateSafe: () => isLegacyVariableTemplateSafe,
+  resolveAnalyzedVariablesBatch: () => resolveAnalyzedVariablesBatch,
+  resolveAnalyzedVariablesTemplate: () => resolveAnalyzedVariablesTemplate,
+  resolveFlowModelVariablesTemplate: () => resolveFlowModelVariablesTemplate,
   resolveVariablesBatch: () => resolveVariablesBatch,
   resolveVariablesTemplate: () => resolveVariablesTemplate
 });
 module.exports = __toCommonJS(resolve_exports);
 var import_contexts = require("../template/contexts");
 var import_resolver = require("../template/resolver");
+var import_allow_list = require("./allow-list");
+var import_record_bindings = require("./record-bindings");
 var import_registry = require("./registry");
+var import_record_slot_policy = require("./record-slot-policy");
 var import_utils = require("./utils");
 const GLOBAL_CONTEXT_KEY = Symbol.for("nocobase.flow-engine.variables.global-context");
+const REQUEST_BOUND_RESOLVE_POLICY = {
+  allowAll: true,
+  allowedPaths: /* @__PURE__ */ new Set(),
+  unrestrictedVariables: /* @__PURE__ */ new Set()
+};
 function getGlobalContext(ctx) {
   var _a, _b;
   const app = ctx.app;
@@ -44,36 +56,96 @@ function getGlobalContext(ctx) {
   return app[GLOBAL_CONTEXT_KEY];
 }
 async function resolveVariablesTemplate(ctx, template, contextParams = {}) {
-  await (0, import_utils.prefetchRecordsForResolve)(ctx, [{ template, contextParams }]);
-  return resolveVariablesTemplateWithPrefetchedRecords(ctx, template, contextParams);
+  const result = (0, import_allow_list.analyzeVariableTemplateSafely)(template, { mode: "untrusted-request" });
+  if (!result.ok) return template;
+  const bindingPlan = await createRequestBoundRecordBindingPlan(ctx, result.analysis, contextParams);
+  return resolveAnalyzedVariablesTemplate(ctx, result.analysis, REQUEST_BOUND_RESOLVE_POLICY, bindingPlan);
+}
+function isLegacyVariableTemplateSafe(template) {
+  const result = (0, import_allow_list.analyzeVariableTemplateSafely)(template, { mode: "untrusted-request" });
+  return result.ok && result.analysis.supported && result.analysis.paths.length === 0;
+}
+async function resolveFlowModelVariablesTemplate(ctx, options) {
+  if (!await (0, import_allow_list.resolveFlowModelNodeFromRequestRd)(ctx, options.rd)) return;
+  const authorization = await (0, import_allow_list.authorizeVariablesResolve)(ctx, options);
+  if (!authorization.allowed || !authorization.flowModelUid) return;
+  const resolved = await resolveAnalyzedVariablesTemplate(
+    ctx,
+    authorization.analysis,
+    authorization.policy,
+    authorization.bindingPlan
+  );
+  const remaining = (0, import_allow_list.analyzeVariableTemplateSafely)(resolved, { mode: "untrusted-request" });
+  if (!remaining.ok || !remaining.analysis.supported || remaining.analysis.paths.length) return;
+  return resolved;
+}
+async function createRequestBoundRecordBindingPlan(ctx, analysis, contextParams) {
+  const policies = await (0, import_record_slot_policy.compileRecordSlotPolicies)(analysis, { app: ctx.app, ctx });
+  return (0, import_record_bindings.planRecordBindings)({
+    contextParams,
+    koaCtx: ctx,
+    policies,
+    usage: analysis.usage
+  });
 }
-async function resolveVariablesTemplateWithPrefetchedRecords(ctx, template, contextParams = {}) {
+async function resolveAnalyzedVariablesTemplate(ctx, analysis, policy, bindingPlan) {
+  await (0, import_utils.prefetchRecordsForResolve)(ctx, bindingPlan.bindings);
+  return resolveAnalyzedVariablesTemplateWithPrefetchedRecords(ctx, analysis, policy, bindingPlan);
+}
+async function resolveAnalyzedVariablesTemplateWithPrefetchedRecords(ctx, analysis, policy, bindingPlan) {
   const requestCtx = new import_contexts.HttpRequestContext(ctx);
   requestCtx.delegate(getGlobalContext(ctx));
-  await import_registry.variables.attachUsedVariables(requestCtx, ctx, template, contextParams);
-  return (0, import_resolver.resolveJsonTemplate)(template, requestCtx);
+  await import_registry.variables.attachUsedVariablesFromPlan(requestCtx, ctx, analysis.usage, bindingPlan);
+  return (0, import_resolver.resolveAnalyzedJsonTemplate)(analysis, requestCtx, policy);
 }
 async function resolveVariablesBatch(ctx, items) {
+  var _a;
+  const analyzedItems = [];
+  const results = [];
+  for (const [index, item] of items.entries()) {
+    const result = (0, import_allow_list.analyzeVariableTemplateSafely)((item == null ? void 0 : item.template) ?? {}, { mode: "untrusted-request" });
+    if (!result.ok) {
+      results[index] = { id: item == null ? void 0 : item.id, data: (item == null ? void 0 : item.template) ?? {} };
+      continue;
+    }
+    analyzedItems.push({
+      ...item,
+      id: index,
+      analysis: result.analysis,
+      bindingPlan: await createRequestBoundRecordBindingPlan(ctx, result.analysis, item.contextParams || {}),
+      policy: REQUEST_BOUND_RESOLVE_POLICY
+    });
+  }
+  const resolvedItems = await resolveAnalyzedVariablesBatch(ctx, analyzedItems);
+  for (const item of resolvedItems) {
+    const index = Number(item.id);
+    results[index] = { id: (_a = items[index]) == null ? void 0 : _a.id, data: item.data };
+  }
+  return results.filter((item) => !!item);
+}
+async function resolveAnalyzedVariablesBatch(ctx, items) {
   await (0, import_utils.prefetchRecordsForResolve)(
     ctx,
-    items.map((item) => ({
-      template: (item == null ? void 0 : item.template) ?? {},
-      contextParams: (item == null ? void 0 : item.contextParams) || {}
-    }))
+    items.flatMap((item) => item.bindingPlan.bindings)
   );
   const results = [];
   for (const item of items) {
-    const data = await resolveVariablesTemplateWithPrefetchedRecords(
+    const data = await resolveAnalyzedVariablesTemplateWithPrefetchedRecords(
       ctx,
-      (item == null ? void 0 : item.template) ?? {},
-      (item == null ? void 0 : item.contextParams) || {}
+      item.analysis,
+      item.policy,
+      item.bindingPlan
     );
-    results.push({ id: item == null ? void 0 : item.id, data });
+    results.push({ id: item.id, data });
   }
   return results;
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  isLegacyVariableTemplateSafe,
+  resolveAnalyzedVariablesBatch,
+  resolveAnalyzedVariablesTemplate,
+  resolveFlowModelVariablesTemplate,
   resolveVariablesBatch,
   resolveVariablesTemplate
 });

package/dist/server/variables/runjs-variable-dependencies.d.ts

@@ -0,0 +1,23 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export type PreparedFlowModelVariableSource = Readonly<{
+    ok: true;
+    runJsTemplates: readonly string[];
+    templateSource: unknown;
+}> | Readonly<{
+    ok: false;
+}>;
+export declare const MAX_FLOW_MODEL_VARIABLE_SOURCE_DEPTH = 128;
+export declare const MAX_FLOW_MODEL_VARIABLE_SOURCE_NODES = 10000;
+export declare const MAX_FLOW_MODEL_VARIABLE_STRING_LENGTH: number;
+export declare const MAX_FLOW_MODEL_VARIABLE_TOTAL_STRING_LENGTH: number;
+export declare function prepareFlowModelVariableSource(value: unknown, options?: Readonly<{
+    isRunJsValuePath?: (pathTail: readonly string[]) => boolean;
+}>): PreparedFlowModelVariableSource;
+export declare function collectPersistedRunJsVariableTemplates(value: unknown): string[];