@nocobase/plugin-flow-engine 2.3.0-alpha.1 → 2.3.0-beta.11

package/dist/server/index.js

@@ -37,7 +37,10 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var server_exports = {};
 __export(server_exports, {
   FlowModelRepository: () => import_repository.FlowModelRepository,
+  RecordSlotResolverRegistry: () => import_record_slot_resolvers.RecordSlotResolverRegistry,
+  createNestedRecordSlotResolver: () => import_record_slot_resolvers.createNestedRecordSlotResolver,
   default: () => import_plugin.default,
+  getRecordSlotResolverRegistry: () => import_record_slot_resolvers.getRecordSlotResolverRegistry,
   resolveVariablesBatch: () => import_resolve.resolveVariablesBatch,
   resolveVariablesTemplate: () => import_resolve.resolveVariablesTemplate
 });
@@ -45,9 +48,13 @@ module.exports = __toCommonJS(server_exports);
 var import_plugin = __toESM(require("./plugin"));
 var import_repository = require("./repository");
 var import_resolve = require("./variables/resolve");
+var import_record_slot_resolvers = require("./variables/record-slot-resolvers");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   FlowModelRepository,
+  RecordSlotResolverRegistry,
+  createNestedRecordSlotResolver,
+  getRecordSlotResolverRegistry,
   resolveVariablesBatch,
   resolveVariablesTemplate
 });

package/dist/server/plugin.d.ts

@@ -6,16 +6,29 @@
  * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
+import type { ResourcerContext } from '@nocobase/resourcer';
 import PluginUISchemaStorageServer from './server';
+import { JSONValue } from './template/resolver';
 export declare class PluginFlowEngineServer extends PluginUISchemaStorageServer {
+    private recordSlotResolverDisposers;
     afterAdd(): Promise<void>;
     beforeLoad(): Promise<void>;
     getDatabaseByDataSourceKey(dataSourceKey?: string): import("@nocobase/database").default;
     runSQLByDataSourceKey(dataSourceKey: string | undefined, sql: string, options?: Record<string, unknown>): Promise<any>;
+    resolveFlowModelVariablesTemplate(ctx: ResourcerContext, options: {
+        contractRd?: string | number;
+        contextParams?: Record<string, unknown>;
+        rd?: string | number;
+        template: JSONValue;
+    }): Promise<any>;
+    isLegacyVariableTemplateSafe(template: JSONValue): boolean;
     load(): Promise<void>;
     install(): Promise<void>;
     afterEnable(): Promise<void>;
     afterDisable(): Promise<void>;
     remove(): Promise<void>;
+    private disposeRecordSlotResolvers;
+    private registerRecordSlotResolvers;
+    private ensureRecordSlotResolvers;
 }
 export default PluginFlowEngineServer;

package/dist/server/plugin.js

@@ -43,8 +43,13 @@ module.exports = __toCommonJS(plugin_exports);
 var import_utils = require("@nocobase/utils");
 var import_flow_surfaces = require("./flow-surfaces");
 var import_server = __toESM(require("./server"));
+var import_allow_list = require("./variables/allow-list");
+var import_form_item_record_slot_resolvers = require("./variables/form-item-record-slot-resolvers");
+var import_record_slot_policy = require("./variables/record-slot-policy");
+var import_record_slot_resolvers = require("./variables/record-slot-resolvers");
 var import_resolve = require("./variables/resolve");
 class PluginFlowEngineServer extends import_server.default {
+  recordSlotResolverDisposers = [];
   async afterAdd() {
   }
   async beforeLoad() {
@@ -71,8 +76,16 @@ class PluginFlowEngineServer extends import_server.default {
     }
     return await cm.db.runSQL(sql, options);
   }
+  async resolveFlowModelVariablesTemplate(ctx, options) {
+    this.ensureRecordSlotResolvers(ctx.app);
+    return await (0, import_resolve.resolveFlowModelVariablesTemplate)(ctx, options);
+  }
+  isLegacyVariableTemplateSafe(template) {
+    return (0, import_resolve.isLegacyVariableTemplateSafe)(template);
+  }
   async load() {
     await super.load();
+    this.registerRecordSlotResolvers();
     (0, import_flow_surfaces.registerFlowSurfacesResource)(this);
     this.app.auditManager.registerAction("flowSql:save");
     this.app.auditManager.registerAction("flowModels:save");
@@ -86,12 +99,56 @@ class PluginFlowEngineServer extends import_server.default {
       actions: {
         // 解析 JSON 模板中的 ctx 变量
         resolve: async (ctx, next) => {
-          var _a, _b;
+          var _a, _b, _c;
+          this.ensureRecordSlotResolvers(ctx.app);
           const raw = ((_b = (_a = ctx.action) == null ? void 0 : _a.params) == null ? void 0 : _b.values) ?? {};
           const values = typeof (raw == null ? void 0 : raw.values) !== "undefined" ? raw.values : raw;
           if (Array.isArray(values == null ? void 0 : values.batch)) {
             const batchItems = values.batch;
-            const results = await (0, import_resolve.resolveVariablesBatch)(ctx, batchItems);
+            const authorizedItems = [];
+            const passthroughResults = [];
+            for (const [index, item] of batchItems.entries()) {
+              const template2 = (item == null ? void 0 : item.template) ?? {};
+              const authorization2 = await (0, import_allow_list.authorizeVariablesResolve)(ctx, {
+                contractRd: item == null ? void 0 : item.contractRd,
+                contextParams: (item == null ? void 0 : item.contextParams) || {},
+                rd: item == null ? void 0 : item.rd,
+                template: template2
+              });
+              if (authorization2.allowed) {
+                const authorizedItem = {
+                  analysis: authorization2.analysis,
+                  bindingPlan: authorization2.bindingPlan,
+                  id: item == null ? void 0 : item.id,
+                  index,
+                  policy: authorization2.policy,
+                  template: template2
+                };
+                authorizedItems.push(authorizedItem);
+              } else {
+                passthroughResults[index] = { id: item == null ? void 0 : item.id, data: template2 };
+              }
+            }
+            const resolvedItems = await (0, import_resolve.resolveAnalyzedVariablesBatch)(
+              ctx,
+              authorizedItems.map((item) => ({
+                analysis: item.analysis,
+                bindingPlan: item.bindingPlan,
+                id: item.index,
+                template: item.template,
+                policy: item.policy
+              }))
+            );
+            for (const item of resolvedItems) {
+              const index = Number(item.id);
+              passthroughResults[index] = {
+                id: (_c = batchItems[index]) == null ? void 0 : _c.id,
+                data: item.data
+              };
+            }
+            const results = passthroughResults.filter(
+              (item) => !!item
+            );
             ctx.body = { results };
             await next();
             return;
@@ -104,7 +161,18 @@ class PluginFlowEngineServer extends import_server.default {
           }
           const template = values.template;
           const contextParams = (values == null ? void 0 : values.contextParams) || {};
-          ctx.body = await (0, import_resolve.resolveVariablesTemplate)(ctx, template, contextParams);
+          const authorization = await (0, import_allow_list.authorizeVariablesResolve)(ctx, {
+            contractRd: values == null ? void 0 : values.contractRd,
+            contextParams,
+            rd: values == null ? void 0 : values.rd,
+            template
+          });
+          ctx.body = authorization.allowed ? await (0, import_resolve.resolveAnalyzedVariablesTemplate)(
+            ctx,
+            authorization.analysis,
+            authorization.policy,
+            authorization.bindingPlan
+          ) : template;
           await next();
         }
       }
@@ -162,10 +230,29 @@ class PluginFlowEngineServer extends import_server.default {
   async install() {
   }
   async afterEnable() {
+    this.registerRecordSlotResolvers();
   }
   async afterDisable() {
+    this.disposeRecordSlotResolvers();
   }
   async remove() {
+    this.disposeRecordSlotResolvers();
+  }
+  disposeRecordSlotResolvers() {
+    this.recordSlotResolverDisposers.forEach((dispose) => dispose());
+    this.recordSlotResolverDisposers = [];
+  }
+  registerRecordSlotResolvers() {
+    this.disposeRecordSlotResolvers();
+    this.ensureRecordSlotResolvers(this.app);
+  }
+  ensureRecordSlotResolvers(app) {
+    const registry = (0, import_record_slot_resolvers.getRecordSlotResolverRegistry)(app);
+    for (const resolver of [...(0, import_record_slot_policy.createBuiltInRecordSlotResolvers)(), ...(0, import_form_item_record_slot_resolvers.createFormItemRecordSlotResolvers)()]) {
+      if (!registry.has(resolver.owner, resolver.id)) {
+        this.recordSlotResolverDisposers.push(registry.register(resolver));
+      }
+    }
   }
 }
 var plugin_default = PluginFlowEngineServer;

package/dist/server/repository.d.ts

@@ -18,6 +18,13 @@ export interface GetPropertiesOptions {
     readFromCache?: boolean;
     transaction?: Transaction;
 }
+export interface FlowModelNodeSnapshot {
+    uid: string;
+    options: Record<string, unknown>;
+    parentId: string | null;
+    subKey: string | null;
+    async: boolean;
+}
 export type FlowModelAttachPosition = 'first' | 'last' | TargetPosition;
 export interface FlowModelAttachOptions {
     parentId: string;
@@ -132,6 +139,11 @@ export declare class FlowModelRepository extends Repository {
     updateSingleNode(node: SchemaNode, options?: Transactionable): Promise<boolean>;
     upsertModel(model: any, options?: Transactionable): Promise<string>;
     findModelById(uid: string, options?: GetJsonSchemaOptions): Promise<any>;
+    findModelNodeSnapshotById(uid: string, options?: Transactionable): Promise<FlowModelNodeSnapshot | null>;
+    private findModelUidByParentId;
+    findModelNodeSnapshotByParentId(parentUid: string, options?: Transactionable & {
+        subKey?: string;
+    }): Promise<FlowModelNodeSnapshot | null>;
     findModelByParentId(parentUid: string, options?: GetJsonSchemaOptions & {
         subKey?: string;
     }): Promise<any>;

package/dist/server/repository.js

@@ -1411,7 +1411,36 @@ WHERE TreeTable.depth = 1 AND  TreeTable.ancestor = :ancestor and TreeTable.sort
     const nodes = await this.findNodesById(uid2, options);
     return _FlowModelRepository.nodesToModel(nodes, uid2);
   }
-  async findModelByParentId(parentUid, options) {
+  async findModelNodeSnapshotById(uid2, options) {
+    const transaction2 = options == null ? void 0 : options.transaction;
+    const model = await this.model.findByPk(uid2, { transaction: transaction2 });
+    if (!model) {
+      return null;
+    }
+    const paths = await this.database.getRepository("flowModelTreePath").find({
+      filter: {
+        descendant: uid2,
+        depth: { $in: [0, 1] }
+      },
+      transaction: transaction2
+    });
+    const nodePath = paths.find((path) => path.get("depth") === 0);
+    if (!nodePath) {
+      return null;
+    }
+    const parentPath = paths.find((path) => path.get("depth") === 1);
+    const nodeOptions = import_lodash.default.cloneDeep(
+      import_lodash.default.omit(_FlowModelRepository.optionsToJson(model.get("options") || {}), "subModels")
+    );
+    return {
+      uid: uid2,
+      options: nodeOptions,
+      parentId: parentPath ? parentPath.get("ancestor") : null,
+      subKey: nodePath.get("type") || null,
+      async: !!nodePath.get("async")
+    };
+  }
+  async findModelUidByParentId(parentUid, options) {
     const r = this.database.getRepository("flowModelTreePath");
     const treePaths = await r.model.findAll({
       where: {
@@ -1433,10 +1462,18 @@ WHERE TreeTable.depth = 1 AND  TreeTable.ancestor = :ancestor and TreeTable.sort
       transaction: options == null ? void 0 : options.transaction
     });
     if (treePath == null ? void 0 : treePath["descendant"]) {
-      return this.findModelById(treePath["descendant"], options);
+      return treePath["descendant"];
     }
     return null;
   }
+  async findModelNodeSnapshotByParentId(parentUid, options) {
+    const uid2 = await this.findModelUidByParentId(parentUid, options);
+    return uid2 ? this.findModelNodeSnapshotById(uid2, options) : null;
+  }
+  async findModelByParentId(parentUid, options) {
+    const uid2 = await this.findModelUidByParentId(parentUid, options);
+    return uid2 ? this.findModelById(uid2, options) : null;
+  }
   async attach(uid2, attachOptions, options) {
     const { transaction: transaction2 } = options || {};
     const modelUid = String(uid2 || "").trim();

package/dist/server/template/context-keys.d.ts

@@ -0,0 +1,14 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export declare const GLOBAL_CONTEXT_KEYS: readonly ["now", "timestamp", "env"];
+export declare const HTTP_REQUEST_CONTEXT_KEYS: readonly ["user", "roleName", "locale", "ip", "headers", "query", "params"];
+export declare const SERVER_CONTEXT_PROTOTYPE_KEYS: readonly ["__proto__", "prototype", "constructor", "then", "__defineGetter__", "__defineSetter__", "__lookupGetter__", "__lookupSetter__", "hasOwnProperty", "isPrototypeOf", "propertyIsEnumerable", "toLocaleString", "toString", "valueOf"];
+export declare const SERVER_CONTEXT_INTERNAL_KEYS: readonly ["_props", "_cache", "_delegates", "_proxy", "_getOwn", "defineProperty", "delegate", "clearDelegates", "getSandboxKeys", "getSandboxValue", "createProxy"];
+export declare const PROTECTED_SERVER_CONTEXT_KEYS: readonly ["now", "timestamp", "env", "user", "roleName", "locale", "ip", "headers", "query", "params", "__proto__", "prototype", "constructor", "then", "__defineGetter__", "__defineSetter__", "__lookupGetter__", "__lookupSetter__", "hasOwnProperty", "isPrototypeOf", "propertyIsEnumerable", "toLocaleString", "toString", "valueOf", "_props", "_cache", "_delegates", "_proxy", "_getOwn", "defineProperty", "delegate", "clearDelegates", "getSandboxKeys", "getSandboxValue", "createProxy"];
+export declare function isProtectedServerContextKey(key: string): boolean;

package/dist/server/template/context-keys.js

@@ -0,0 +1,86 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var context_keys_exports = {};
+__export(context_keys_exports, {
+  GLOBAL_CONTEXT_KEYS: () => GLOBAL_CONTEXT_KEYS,
+  HTTP_REQUEST_CONTEXT_KEYS: () => HTTP_REQUEST_CONTEXT_KEYS,
+  PROTECTED_SERVER_CONTEXT_KEYS: () => PROTECTED_SERVER_CONTEXT_KEYS,
+  SERVER_CONTEXT_INTERNAL_KEYS: () => SERVER_CONTEXT_INTERNAL_KEYS,
+  SERVER_CONTEXT_PROTOTYPE_KEYS: () => SERVER_CONTEXT_PROTOTYPE_KEYS,
+  isProtectedServerContextKey: () => isProtectedServerContextKey
+});
+module.exports = __toCommonJS(context_keys_exports);
+const GLOBAL_CONTEXT_KEYS = ["now", "timestamp", "env"];
+const HTTP_REQUEST_CONTEXT_KEYS = ["user", "roleName", "locale", "ip", "headers", "query", "params"];
+const SERVER_CONTEXT_PROTOTYPE_KEYS = [
+  "__proto__",
+  "prototype",
+  "constructor",
+  "then",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__",
+  "hasOwnProperty",
+  "isPrototypeOf",
+  "propertyIsEnumerable",
+  "toLocaleString",
+  "toString",
+  "valueOf"
+];
+const SERVER_CONTEXT_INTERNAL_KEYS = [
+  "_props",
+  "_cache",
+  "_delegates",
+  "_proxy",
+  "_getOwn",
+  "defineProperty",
+  "delegate",
+  "clearDelegates",
+  "getSandboxKeys",
+  "getSandboxValue",
+  "createProxy"
+];
+const PROTECTED_SERVER_CONTEXT_KEYS = [
+  ...GLOBAL_CONTEXT_KEYS,
+  ...HTTP_REQUEST_CONTEXT_KEYS,
+  ...SERVER_CONTEXT_PROTOTYPE_KEYS,
+  ...SERVER_CONTEXT_INTERNAL_KEYS
+];
+const protectedServerContextKeys = new Set(PROTECTED_SERVER_CONTEXT_KEYS);
+function isProtectedServerContextKey(key) {
+  return protectedServerContextKeys.has(key);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  GLOBAL_CONTEXT_KEYS,
+  HTTP_REQUEST_CONTEXT_KEYS,
+  PROTECTED_SERVER_CONTEXT_KEYS,
+  SERVER_CONTEXT_INTERNAL_KEYS,
+  SERVER_CONTEXT_PROTOTYPE_KEYS,
+  isProtectedServerContextKey
+});

package/dist/server/template/contexts.d.ts

@@ -8,6 +8,7 @@
  */
 import { ResourcerContext } from '@nocobase/resourcer';
 type Getter<T = any> = (ctx: ServerBaseContext) => T | Promise<T>;
+export declare const SERVER_CONTEXT_PROVIDER_TOKEN: unique symbol;
 export interface PropertyOptions {
     /** 固定值，优先级高于 get */
     value?: any;
@@ -21,13 +22,11 @@ export interface PropertyOptions {
 /**
  * 服务器端上下文基础类。
  * - 支持以 defineProperty 定义惰性/常量属性，并可选择缓存
- * - 支持以 defineMethod 定义方法
- * - 支持 delegate 机制，属性与方法可回退到被委托的上游上下文
- * - 通过 Proxy 实现按需求值与 this 绑定
+ * - 支持 delegate 机制，属性可回退到被委托的上游上下文
+ * - 通过 Proxy 实现按需求值
  */
 export declare class ServerBaseContext {
     protected _props: Record<string, PropertyOptions>;
-    protected _methods: Record<string, (...args: any[]) => any>;
     protected _cache: Record<string, any>;
     protected _delegates: ServerBaseContext[];
     protected _proxy?: ServerBaseContext;
@@ -40,12 +39,10 @@ export declare class ServerBaseContext {
      * - get：惰性 getter（默认带缓存）
      * - once：已存在时忽略重复定义
      */
-    defineProperty(key: string, options: PropertyOptions): void;
-    /** 定义一个方法（不可枚举、不可写），访问时会自动绑定到对应实例 */
-    defineMethod(name: string, fn: (...args: any[]) => any): void;
+    defineProperty(key: string, options: PropertyOptions, providerToken?: typeof SERVER_CONTEXT_PROVIDER_TOKEN): void;
     /**
      * 委托到另一个 ServerBaseContext：
-     * - 访问属性/方法找不到时，会回退到被委托者进行解析
+     * - 访问属性找不到时，会回退到被委托者进行解析
      */
     delegate(ctx: ServerBaseContext): void;
     /** 清空所有委托 */

package/dist/server/template/contexts.js

@@ -38,17 +38,21 @@ var contexts_exports = {};
 __export(contexts_exports, {
   GlobalContext: () => GlobalContext,
   HttpRequestContext: () => HttpRequestContext,
+  SERVER_CONTEXT_PROVIDER_TOKEN: () => SERVER_CONTEXT_PROVIDER_TOKEN,
   ServerBaseContext: () => ServerBaseContext
 });
 module.exports = __toCommonJS(contexts_exports);
 var import_lodash = __toESM(require("lodash"));
-const BLOCKED_SANDBOX_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor", "then"]);
+var import_context_keys = require("./context-keys");
+const SERVER_CONTEXT_PROVIDER_TOKEN = Symbol("server-context-provider");
+const PROVIDER_KEYS = /* @__PURE__ */ new Set([...import_context_keys.GLOBAL_CONTEXT_KEYS, ...import_context_keys.HTTP_REQUEST_CONTEXT_KEYS]);
+const INTERNAL_KEYS = new Set(import_context_keys.SERVER_CONTEXT_INTERNAL_KEYS);
+const BLOCKED_SANDBOX_KEYS = /* @__PURE__ */ new Set([...import_context_keys.SERVER_CONTEXT_PROTOTYPE_KEYS, ...import_context_keys.SERVER_CONTEXT_INTERNAL_KEYS]);
 function isBlockedSandboxKey(key) {
   return BLOCKED_SANDBOX_KEYS.has(key);
 }
 class ServerBaseContext {
   _props = {};
-  _methods = {};
   _cache = {};
   _delegates = [];
   _proxy;
@@ -74,10 +78,14 @@ class ServerBaseContext {
    * - get：惰性 getter（默认带缓存）
    * - once：已存在时忽略重复定义
    */
-  defineProperty(key, options) {
+  defineProperty(key, options, providerToken) {
     var _a;
-    if (this._props[key] && ((_a = this._props[key]) == null ? void 0 : _a.once)) return;
-    this._props[key] = options;
+    if (BLOCKED_SANDBOX_KEYS.has(key)) return;
+    if (PROVIDER_KEYS.has(key) && (this instanceof HttpRequestContext || this instanceof GlobalContext) && providerToken !== SERVER_CONTEXT_PROVIDER_TOKEN) {
+      return;
+    }
+    if (((_a = this._props[key]) == null ? void 0 : _a.once) && providerToken !== SERVER_CONTEXT_PROVIDER_TOKEN) return;
+    this._props[key] = providerToken === SERVER_CONTEXT_PROVIDER_TOKEN ? { ...options, once: true } : options;
     delete this._cache[key];
     Object.defineProperty(this, key, {
       configurable: true,
@@ -85,20 +93,9 @@ class ServerBaseContext {
       get: () => this._getOwn(key, this.createProxy())
     });
   }
-  /** 定义一个方法（不可枚举、不可写），访问时会自动绑定到对应实例 */
-  defineMethod(name, fn) {
-    this._methods[name] = fn;
-    Object.defineProperty(this, name, {
-      configurable: true,
-      enumerable: false,
-      writable: false,
-      value: fn
-      // bind at proxy access to keep delegate binding consistent
-    });
-  }
   /**
    * 委托到另一个 ServerBaseContext：
-   * - 访问属性/方法找不到时，会回退到被委托者进行解析
+   * - 访问属性找不到时，会回退到被委托者进行解析
    */
   delegate(ctx) {
     if (!(ctx instanceof ServerBaseContext)) {
@@ -115,9 +112,6 @@ class ServerBaseContext {
     for (const key of Object.keys(this._props)) {
       if (!isBlockedSandboxKey(key)) keys.add(key);
     }
-    for (const key of Object.keys(this._methods)) {
-      if (!isBlockedSandboxKey(key)) keys.add(key);
-    }
     for (const d of this._delegates) {
       for (const key of d.getSandboxKeys()) {
         if (!isBlockedSandboxKey(key)) keys.add(key);
@@ -130,10 +124,6 @@ class ServerBaseContext {
     if (Object.prototype.hasOwnProperty.call(this._props, key)) {
       return this._getOwn(key, current);
     }
-    if (Object.prototype.hasOwnProperty.call(this._methods, key)) {
-      const fn = this._methods[key];
-      return typeof fn === "function" ? fn.bind(this) : fn;
-    }
     for (const d of this._delegates) {
       if (!d.getSandboxKeys().includes(key)) continue;
       return d.getSandboxValue(key, current);
@@ -145,8 +135,11 @@ class ServerBaseContext {
     if (this._proxy) return this._proxy;
     this._proxy = new Proxy(this, {
       get: (target, key, receiver) => {
-        var _a;
         if (typeof key !== "string") return Reflect.get(target, key, receiver);
+        if (import_context_keys.SERVER_CONTEXT_PROTOTYPE_KEYS.includes(key)) {
+          return void 0;
+        }
+        if (INTERNAL_KEYS.has(key) && key.startsWith("_")) return void 0;
         if (Reflect.has(target, key)) {
           const v = Reflect.get(target, key, receiver);
           return typeof v === "function" ? v.bind(target) : v;
@@ -154,28 +147,18 @@ class ServerBaseContext {
         if (Object.prototype.hasOwnProperty.call(target._props, key)) {
           return target._getOwn(key, this.createProxy());
         }
-        if (Object.prototype.hasOwnProperty.call(target._methods, key)) {
-          const fn = target._methods[key];
-          return typeof fn === "function" ? fn.bind(target) : fn;
-        }
         for (const d of target._delegates) {
-          const candidate = (_a = d._getOwn) == null ? void 0 : _a.call(d, key, this.createProxy());
+          const candidate = d.getSandboxValue(key, this.createProxy());
           if (typeof candidate !== "undefined") return candidate;
-          if (Object.prototype.hasOwnProperty.call(d._methods || {}, key)) {
-            const fn = d._methods[key];
-            return typeof fn === "function" ? fn.bind(d) : fn;
-          }
         }
         return void 0;
       },
       has: (target, key) => {
         if (typeof key !== "string") return Reflect.has(target, key);
+        if (isBlockedSandboxKey(key)) return false;
         if (Reflect.has(target, key)) return true;
         if (Object.prototype.hasOwnProperty.call(target._props, key)) return true;
-        if (Object.prototype.hasOwnProperty.call(target._methods, key)) return true;
-        return target._delegates.some(
-          (d) => Object.prototype.hasOwnProperty.call(d._props, key) || Object.prototype.hasOwnProperty.call(d._methods, key)
-        );
+        return target._delegates.some((d) => d.getSandboxKeys().includes(key));
       }
     });
     return this._proxy;
@@ -184,9 +167,9 @@ class ServerBaseContext {
 class GlobalContext extends ServerBaseContext {
   constructor(env) {
     super();
-    this.defineProperty("now", { get: () => (/* @__PURE__ */ new Date()).toISOString(), cache: false });
-    this.defineProperty("timestamp", { get: () => Date.now(), cache: false });
-    if (env) this.defineProperty("env", { value: filterEnv(env) });
+    this.defineProperty("now", { get: () => (/* @__PURE__ */ new Date()).toISOString(), cache: false }, SERVER_CONTEXT_PROVIDER_TOKEN);
+    this.defineProperty("timestamp", { get: () => Date.now(), cache: false }, SERVER_CONTEXT_PROVIDER_TOKEN);
+    if (env) this.defineProperty("env", { value: filterEnv(env) }, SERVER_CONTEXT_PROVIDER_TOKEN);
   }
 }
 class HttpRequestContext extends ServerBaseContext {
@@ -194,16 +177,24 @@ class HttpRequestContext extends ServerBaseContext {
     var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
     super();
     this.koaCtx = koaCtx;
-    this.defineProperty("user", { get: async () => {
-      var _a2, _b2;
-      return (_b2 = (_a2 = this.koaCtx) == null ? void 0 : _a2.auth) == null ? void 0 : _b2.user;
-    }, cache: true });
-    this.defineProperty("roleName", { value: (_b = (_a = this.koaCtx) == null ? void 0 : _a.auth) == null ? void 0 : _b.role });
-    this.defineProperty("locale", { value: (_d = (_c = this.koaCtx) == null ? void 0 : _c.getCurrentLocale) == null ? void 0 : _d.call(_c) });
-    this.defineProperty("ip", { value: ((_f = (_e = this.koaCtx) == null ? void 0 : _e.state) == null ? void 0 : _f.clientIp) || ((_h = (_g = this.koaCtx) == null ? void 0 : _g.request) == null ? void 0 : _h.ip) });
-    this.defineProperty("headers", { value: (_i = this.koaCtx) == null ? void 0 : _i.headers });
-    this.defineProperty("query", { value: (_k = (_j = this.koaCtx) == null ? void 0 : _j.request) == null ? void 0 : _k.query });
-    this.defineProperty("params", { value: import_lodash.default.get(this.koaCtx, "action.params") });
+    this.defineProperty(
+      "user",
+      { get: async () => {
+        var _a2, _b2;
+        return (_b2 = (_a2 = this.koaCtx) == null ? void 0 : _a2.auth) == null ? void 0 : _b2.user;
+      }, cache: true },
+      SERVER_CONTEXT_PROVIDER_TOKEN
+    );
+    this.defineProperty("roleName", { value: (_b = (_a = this.koaCtx) == null ? void 0 : _a.auth) == null ? void 0 : _b.role }, SERVER_CONTEXT_PROVIDER_TOKEN);
+    this.defineProperty("locale", { value: (_d = (_c = this.koaCtx) == null ? void 0 : _c.getCurrentLocale) == null ? void 0 : _d.call(_c) }, SERVER_CONTEXT_PROVIDER_TOKEN);
+    this.defineProperty(
+      "ip",
+      { value: ((_f = (_e = this.koaCtx) == null ? void 0 : _e.state) == null ? void 0 : _f.clientIp) || ((_h = (_g = this.koaCtx) == null ? void 0 : _g.request) == null ? void 0 : _h.ip) },
+      SERVER_CONTEXT_PROVIDER_TOKEN
+    );
+    this.defineProperty("headers", { value: (_i = this.koaCtx) == null ? void 0 : _i.headers }, SERVER_CONTEXT_PROVIDER_TOKEN);
+    this.defineProperty("query", { value: (_k = (_j = this.koaCtx) == null ? void 0 : _j.request) == null ? void 0 : _k.query }, SERVER_CONTEXT_PROVIDER_TOKEN);
+    this.defineProperty("params", { value: import_lodash.default.get(this.koaCtx, "action.params") }, SERVER_CONTEXT_PROVIDER_TOKEN);
   }
 }
 const DEFAULT_ENV_PREFIXES = ["PUBLIC_", "NEXT_PUBLIC_", "NCB_PUBLIC_"];
@@ -224,5 +215,6 @@ function filterEnv(env, allowedPrefixes = DEFAULT_ENV_PREFIXES) {
 0 && (module.exports = {
   GlobalContext,
   HttpRequestContext,
+  SERVER_CONTEXT_PROVIDER_TOKEN,
   ServerBaseContext
 });

package/dist/server/template/resolver.d.ts

@@ -7,24 +7,16 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 import 'ses';
-export type JSONValue = string | {
+import { type AnalyzedTemplate, type ResolvePathPolicy } from './variable-expression';
+export type JSONValue = string | number | boolean | null | {
     [key: string]: JSONValue;
 } | JSONValue[];
 /**
  * 解析 JSON 模板中形如 {{ ... }} 的占位符（服务端解析）。
- * 仅支持以 ctx 开头的路径与表达式（如：{{ ctx.user.id }}、{{ ctx.record.roles[0].name }}）。
  * 无法解析或不受支持的表达式将原样保留。
- *
- * @param template 要解析的对象/数组/字符串模板
- * @param ctx 变量上下文（实现了所需属性/方法的代理对象）
- * @returns 解析后的结果，与输入结构相同
  */
-export declare function resolveJsonTemplate(template: JSONValue, ctx: any): Promise<any>;
+export declare function resolveJsonTemplate(template: JSONValue, ctx: unknown): Promise<any>;
 /**
- * 将表达式中的 ctx 访问改写为内部 __get 调用。
- * 例如：ctx.user.id + 1 => (await __get('user', '.id')) + 1
- *
- * @param expression 原始表达式字符串
- * @returns 改写后的表达式字符串
+ * 执行已分析的模板。授权、挂载和执行链路应复用同一个 analysis 与 policy。
  */
-export declare function preprocessExpression(expression: string): string;
+export declare function resolveAnalyzedJsonTemplate(analysis: AnalyzedTemplate, ctx: unknown, policy: ResolvePathPolicy): Promise<any>;