@nocobase/plugin-flow-engine 2.3.0-alpha.1 → 2.3.0-beta.11

package/dist/server/variables/allow-list.d.ts

@@ -0,0 +1,49 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import type { ResourcerContext } from '@nocobase/resourcer';
+import { type FlowModelNodeSnapshot } from '../repository';
+import { type AnalyzeTemplateMode, type AnalyzedTemplate, type ResolvePathPolicy } from '../template/variable-expression';
+import type { JSONValue } from '../template/resolver';
+import { type RecordBindingPlan } from './record-bindings';
+import { type RecordSlotPolicies } from './record-slot-policy';
+type AuthorizationResultBase = {
+    contextParams: Readonly<Record<string, unknown>>;
+    flowModelUid?: string;
+    policy: ResolvePathPolicy;
+    recordSlotPolicies: RecordSlotPolicies;
+};
+export type AuthorizationResult = AuthorizationResultBase & ({
+    allowed: true;
+    analysis: AnalyzedTemplate;
+    bindingPlan: RecordBindingPlan;
+} | {
+    allowed: false;
+    analysis?: AnalyzedTemplate;
+});
+export type TemplateAnalysisResult = {
+    ok: true;
+    analysis: AnalyzedTemplate;
+} | {
+    ok: false;
+    errorType: string;
+};
+export declare function analyzeVariableTemplateSafely(template: unknown, options?: Readonly<{
+    mode?: AnalyzeTemplateMode;
+}>): TemplateAnalysisResult;
+export declare function clearVariableAllowListCache(app?: object): object;
+export declare function hasRecordContextParams(value: unknown): boolean;
+export declare function sanitizeContextParams(value?: Record<string, unknown>): Record<string, unknown>;
+export declare function resolveFlowModelNodeFromRequestRd(ctx: ResourcerContext, rd?: string | number): Promise<FlowModelNodeSnapshot>;
+export declare function authorizeVariablesResolve(ctx: ResourcerContext, options: {
+    contractRd?: string | number;
+    contextParams?: Record<string, unknown>;
+    rd?: string | number;
+    template: JSONValue;
+}): Promise<AuthorizationResult>;
+export {};

package/dist/server/variables/allow-list.js

@@ -0,0 +1,546 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var allow_list_exports = {};
+__export(allow_list_exports, {
+  analyzeVariableTemplateSafely: () => analyzeVariableTemplateSafely,
+  authorizeVariablesResolve: () => authorizeVariablesResolve,
+  clearVariableAllowListCache: () => clearVariableAllowListCache,
+  hasRecordContextParams: () => hasRecordContextParams,
+  resolveFlowModelNodeFromRequestRd: () => resolveFlowModelNodeFromRequestRd,
+  sanitizeContextParams: () => sanitizeContextParams
+});
+module.exports = __toCommonJS(allow_list_exports);
+var import_utils = require("@nocobase/utils");
+var import_variable_expression = require("../template/variable-expression");
+var import_record_bindings = require("./record-bindings");
+var import_record_slot_policy = require("./record-slot-policy");
+var import_registry = require("./registry");
+var import_runjs_variable_dependencies = require("./runjs-variable-dependencies");
+function analyzeVariableTemplateSafely(template, options = {}) {
+  let analysis;
+  try {
+    analysis = (0, import_variable_expression.analyzeVariableTemplate)(template, options);
+  } catch (error) {
+    return { ok: false, errorType: error instanceof Error ? error.name : typeof error };
+  }
+  return { ok: true, analysis };
+}
+const MAX_FLOW_MODEL_ANCESTORS = 64;
+function clearVariableAllowListCache(app) {
+  return app;
+}
+function isObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function readFormAssignRulesVariableSource(node) {
+  const stepParams = isObject(node.options.stepParams) ? node.options.stepParams : null;
+  const formModelSettings = stepParams && isObject(stepParams.formModelSettings) ? stepParams.formModelSettings : null;
+  return formModelSettings && Object.prototype.hasOwnProperty.call(formModelSettings, "assignRules") ? formModelSettings.assignRules : void 0;
+}
+function hasFlowModelUse(node) {
+  const use = node.options.use;
+  return typeof use === "string" && !!use.trim();
+}
+function matchesVariableContractType(node, type) {
+  const marker = node.options.variableContractType;
+  if (typeof marker === "undefined") return void 0;
+  return isObject(marker) && marker.type === type && marker.use === node.options.use;
+}
+function isFormGridNode(node) {
+  const use = node.options.use;
+  const markerMatches = matchesVariableContractType(node, "formGrid");
+  return node.subKey === "grid" && hasFlowModelUse(node) && (markerMatches === true || typeof markerMatches === "undefined" && typeof use === "string" && use.endsWith("GridModel"));
+}
+function getReferenceFormUseTemplate(node) {
+  const stepParams = isObject(node.options.stepParams) ? node.options.stepParams : null;
+  const referenceSettings = stepParams && isObject(stepParams.referenceSettings) ? stepParams.referenceSettings : null;
+  return referenceSettings && isObject(referenceSettings.useTemplate) ? referenceSettings.useTemplate : null;
+}
+function isReferenceFormGridNode(node) {
+  const use = node.options.use;
+  return isFormGridNode(node) && typeof use === "string" && use.endsWith("ReferenceFormGridModel");
+}
+function getReferenceFormGridTargetUid(node) {
+  const useTemplate = getReferenceFormUseTemplate(node);
+  const templateUid = useTemplate && typeof useTemplate.templateUid === "string" ? useTemplate.templateUid.trim() : "";
+  if (!useTemplate || !templateUid) return "";
+  const targetPath = typeof useTemplate.targetPath === "string" ? useTemplate.targetPath.trim() : "";
+  if (targetPath && targetPath !== "subModels.grid") return "";
+  return typeof useTemplate.targetUid === "string" ? useTemplate.targetUid.trim() : "";
+}
+function isFormAssignRulesOwnerNode(node) {
+  const use = node.options.use;
+  const markerMatches = matchesVariableContractType(node, "form");
+  return hasFlowModelUse(node) && (markerMatches === true || typeof markerMatches === "undefined" && typeof use === "string" && (use.endsWith("FormModel") || use.endsWith("FormBlockModel")));
+}
+function isFormAssignRulesContractPair(formNode, gridNode) {
+  return isFormAssignRulesOwnerNode(formNode) && isFormGridNode(gridNode) && gridNode.parentId === formNode.uid;
+}
+function isFormAssignRulesRunJsValuePath(pathTail) {
+  return pathTail.length === 3 && pathTail[0] === "value" && /^\d+$/.test(pathTail[1]) && pathTail[2] === "value";
+}
+function isRecordParams(value) {
+  return isObject(value) && typeof value.collection === "string" && Object.prototype.hasOwnProperty.call(value, "filterByTk") && (typeof value.dataSourceKey === "undefined" || typeof value.dataSourceKey === "string") && (typeof value.associationName === "undefined" || typeof value.associationName === "string") && (typeof value.fields === "undefined" || Array.isArray(value.fields) && value.fields.every((field) => typeof field === "string")) && (typeof value.appends === "undefined" || Array.isArray(value.appends) && value.appends.every((append) => typeof append === "string"));
+}
+function hasRecordContextParams(value) {
+  if (isRecordParams(value)) return true;
+  if (Array.isArray(value)) return value.some((item) => hasRecordContextParams(item));
+  if (!isObject(value)) return false;
+  return Object.values(value).some((item) => hasRecordContextParams(item));
+}
+function sanitizeContextParams(value = {}) {
+  const sanitizeStringArray = (input) => Array.isArray(input) && input.every((item) => typeof item === "string") ? input : void 0;
+  const sanitize = (input) => {
+    if (isRecordParams(input)) {
+      const { associationName, collection, filterByTk, dataSourceKey, sourceId } = input;
+      const fields = sanitizeStringArray(input.fields);
+      const appends = sanitizeStringArray(input.appends);
+      return {
+        associationName,
+        collection,
+        filterByTk,
+        dataSourceKey,
+        sourceId,
+        ...fields ? { fields } : {},
+        ...appends ? { appends } : {}
+      };
+    }
+    if (Array.isArray(input)) return input.map((item) => sanitize(item));
+    if (!isObject(input)) return input;
+    const output = {};
+    for (const [key, child] of Object.entries(input)) output[key] = sanitize(child);
+    return output;
+  };
+  return sanitize(value);
+}
+function getRequestState(ctx) {
+  const request = ctx;
+  if (!request.state) request.state = {};
+  return request.state;
+}
+function getFlowModelRepository(ctx) {
+  return ctx.db.getCollection("flowModels").repository;
+}
+async function getFlowModelNode(ctx, flowModelUid) {
+  const state = getRequestState(ctx);
+  const cacheKey = "__variableResolveFlowModelCache";
+  const cache = state[cacheKey] || /* @__PURE__ */ new Map();
+  state[cacheKey] = cache;
+  if (cache.has(flowModelUid)) return await cache.get(flowModelUid) || null;
+  const load = getFlowModelRepository(ctx).findModelNodeSnapshotById(flowModelUid);
+  cache.set(flowModelUid, load);
+  const model = await load;
+  cache.set(flowModelUid, model);
+  return model;
+}
+async function getFlowModelChildNode(ctx, parentUid, subKey) {
+  const state = getRequestState(ctx);
+  const cacheKey = "__variableResolveFlowModelChildCache";
+  const cache = state[cacheKey] || /* @__PURE__ */ new Map();
+  state[cacheKey] = cache;
+  const childCacheKey = JSON.stringify([parentUid, subKey]);
+  if (cache.has(childCacheKey)) return await cache.get(childCacheKey) || null;
+  const load = getFlowModelRepository(ctx).findModelNodeSnapshotByParentId(parentUid, { subKey });
+  cache.set(childCacheKey, load);
+  const child = await load;
+  cache.set(childCacheKey, child);
+  return child;
+}
+async function loadFlowModelAncestors(ctx, currentNode) {
+  const ancestors = [];
+  const seen = /* @__PURE__ */ new Set([currentNode.uid]);
+  let parentId = currentNode.parentId;
+  while (parentId) {
+    if (seen.has(parentId) || ancestors.length >= MAX_FLOW_MODEL_ANCESTORS) {
+      throw new Error("Invalid FlowModel ancestor chain");
+    }
+    seen.add(parentId);
+    const parent = await getFlowModelNode(ctx, parentId);
+    if (!parent) throw new Error("Missing FlowModel ancestor");
+    ancestors.push(parent);
+    parentId = parent.parentId;
+  }
+  return Object.freeze(ancestors);
+}
+async function loadFlowModelAncestorUids(ctx, currentNode) {
+  try {
+    return new Set((await loadFlowModelAncestors(ctx, currentNode)).map((ancestor) => ancestor.uid));
+  } catch {
+    return null;
+  }
+}
+async function resolveFormAssignRulesVariableSource(ctx, contractNode) {
+  const fromGrid = readFormAssignRulesVariableSource(contractNode);
+  if (typeof fromGrid !== "undefined") return fromGrid;
+  if (!contractNode.parentId) return void 0;
+  const formNode = await getFlowModelNode(ctx, contractNode.parentId);
+  return formNode && isFormAssignRulesContractPair(formNode, contractNode) ? readFormAssignRulesVariableSource(formNode) : void 0;
+}
+function readFormLinkageRulesSource(node) {
+  const steps = isObject(node.options.stepParams) ? node.options.stepParams : null;
+  const events = steps && isObject(steps.eventSettings) ? steps.eventSettings : null;
+  return { stepParams: { eventSettings: { linkageRules: events == null ? void 0 : events.linkageRules } } };
+}
+async function collectFormLinkageRuleSources(ctx, form) {
+  const grid = await getFlowModelChildNode(ctx, form.uid, "grid");
+  if (!grid || !isFormAssignRulesContractPair(form, grid)) return [];
+  if (!isReferenceFormGridNode(grid)) return [readFormLinkageRulesSource(grid)];
+  const targetUid = getReferenceFormGridTargetUid(grid);
+  const target = targetUid ? await getFlowModelNode(ctx, targetUid) : null;
+  if (!target || !isFormAssignRulesOwnerNode(target)) return [];
+  const targetGrid = await getFlowModelChildNode(ctx, target.uid, "grid");
+  if (!targetGrid || !isFormAssignRulesContractPair(target, targetGrid) || isReferenceFormGridNode(targetGrid)) {
+    return [];
+  }
+  return [readFormLinkageRulesSource(target), readFormLinkageRulesSource(targetGrid)];
+}
+function createRecordSlotCompilerOptions(ctx, currentNode) {
+  let ancestors;
+  return {
+    app: ctx.app,
+    ctx,
+    currentNode,
+    getCollection: (dataSourceKey, collection) => {
+      var _a, _b, _c;
+      return dataSourceKey === "main" ? ctx.db.getCollection(collection) : (_c = (_b = (_a = ctx.app.dataSourceManager.get(dataSourceKey)) == null ? void 0 : _a.collectionManager) == null ? void 0 : _b.getCollection) == null ? void 0 : _c.call(_b, collection);
+    },
+    loadAncestors: currentNode ? () => {
+      ancestors ||= loadFlowModelAncestors(ctx, currentNode);
+      return ancestors;
+    } : void 0
+  };
+}
+async function getFlowModelVariableContract(ctx, contractNode, runtimeNode, source) {
+  const state = getRequestState(ctx);
+  const cacheKey = "__variableResolveContractCache";
+  const cache = state[cacheKey] || /* @__PURE__ */ new Map();
+  state[cacheKey] = cache;
+  const contractCacheKey = JSON.stringify([source, contractNode.uid, runtimeNode.uid]);
+  if (cache.has(contractCacheKey)) return await cache.get(contractCacheKey) || null;
+  const load = createFlowModelVariableContractFromNode(ctx, contractNode, runtimeNode, source);
+  cache.set(contractCacheKey, load);
+  const contract = await load;
+  cache.set(contractCacheKey, contract);
+  return contract;
+}
+async function createFlowModelVariableContractFromNode(ctx, contractNode, runtimeNode, source) {
+  const sources = [];
+  if (source === "formAssignRules") {
+    sources.push(await resolveFormAssignRulesVariableSource(ctx, contractNode) ?? {});
+  } else {
+    const nodes = contractNode.uid === runtimeNode.uid ? [contractNode] : [contractNode, runtimeNode];
+    for (const node of nodes) {
+      sources.push(node.options);
+      if (isFormAssignRulesOwnerNode(node)) {
+        sources.push(...await collectFormLinkageRuleSources(ctx, node));
+      }
+    }
+  }
+  const paths = [];
+  for (const variableSource of sources) {
+    const item = (0, import_runjs_variable_dependencies.prepareFlowModelVariableSource)(
+      variableSource,
+      source === "formAssignRules" ? { isRunJsValuePath: isFormAssignRulesRunJsValuePath } : void 0
+    );
+    if (!item.ok) continue;
+    const contractSource = item.runJsTemplates.length ? [item.templateSource, ...item.runJsTemplates] : item.templateSource;
+    const result = analyzeVariableTemplateSafely(contractSource, { mode: "flow-model" });
+    if (result.ok) paths.push(...result.analysis.paths);
+  }
+  const analysis = { ...(0, import_variable_expression.analyzeVariableTemplate)({}, { mode: "flow-model" }), paths };
+  return await (0, import_record_slot_policy.createFlowModelVariableContract)(analysis, createRecordSlotCompilerOptions(ctx, runtimeNode));
+}
+function getCurrentRoleNames(ctx) {
+  const state = ctx.state;
+  const roleNames = /* @__PURE__ */ new Set();
+  const currentRoles = state == null ? void 0 : state.currentRoles;
+  if (Array.isArray(currentRoles)) {
+    currentRoles.forEach((roleName) => {
+      if (typeof roleName === "string" && roleName) roleNames.add(roleName);
+    });
+  }
+  if (typeof (state == null ? void 0 : state.currentRole) === "string" && state.currentRole) roleNames.add(state.currentRole);
+  return Array.from(roleNames);
+}
+async function readCurrentRoleAllowsConfigure(ctx) {
+  const roleNames = getCurrentRoleNames(ctx);
+  if (!roleNames.length) return false;
+  if (roleNames.includes("root")) return true;
+  const acl = ctx.app.acl;
+  if (roleNames.some((roleName) => {
+    var _a, _b, _c, _d;
+    return ((_d = (_c = (_b = (_a = acl == null ? void 0 : acl.getRole) == null ? void 0 : _a.call(acl, roleName)) == null ? void 0 : _b.getStrategy) == null ? void 0 : _c.call(_b)) == null ? void 0 : _d.allowConfigure) === true;
+  })) return true;
+  const roles = await ctx.db.getRepository("roles").find({
+    filter: { name: roleNames },
+    fields: ["name", "allowConfigure"]
+  });
+  return roles.some(
+    (role) => typeof (role == null ? void 0 : role.get) === "function" ? role.get("allowConfigure") === true : (role == null ? void 0 : role.allowConfigure) === true
+  );
+}
+async function currentRoleAllowsConfigure(ctx) {
+  const state = getRequestState(ctx);
+  const cacheKey = "__variableResolveRoleAllowsConfigure";
+  const cached = state[cacheKey];
+  if (typeof cached === "boolean") return cached;
+  if (cached instanceof Promise) return await cached;
+  const pending = readCurrentRoleAllowsConfigure(ctx);
+  state[cacheKey] = pending;
+  const allowed = await pending;
+  state[cacheKey] = allowed;
+  return allowed;
+}
+function getRequestBearerToken(ctx) {
+  var _a, _b;
+  const contextWithBearerToken = ctx;
+  const token = (_a = contextWithBearerToken.getBearerToken) == null ? void 0 : _a.call(contextWithBearerToken);
+  if (token) return token;
+  const authorization = typeof ctx.get === "function" ? ctx.get("authorization") || ctx.get("Authorization") : void 0;
+  if (typeof authorization !== "string") return "";
+  return ((_b = authorization.match(/^Bearer\s+(.+)$/i)) == null ? void 0 : _b[1]) || "";
+}
+function getCurrentRequestRdSessionId(ctx) {
+  const state = getRequestState(ctx);
+  const cacheKey = "__variableResolveRdSessionId";
+  const cached = state[cacheKey];
+  if (typeof cached === "string") return cached;
+  const sessionId = (0, import_utils.getFlowModelRdSessionId)((0, import_utils.decodeJwtSessionPayload)(getRequestBearerToken(ctx)));
+  state[cacheKey] = sessionId;
+  return sessionId;
+}
+function resolveFlowModelUidFromRequestRd(ctx, rd) {
+  if (typeof rd !== "string" || !rd) return "";
+  const state = getRequestState(ctx);
+  const cacheKey = "__variableResolveRdUidCache";
+  const cache = state[cacheKey] || /* @__PURE__ */ new Map();
+  state[cacheKey] = cache;
+  if (cache.has(rd)) return cache.get(rd) || "";
+  const flowModelUid = (0, import_utils.resolveFlowModelUidFromRd)(rd, getCurrentRequestRdSessionId(ctx)) || "";
+  cache.set(rd, flowModelUid);
+  return flowModelUid;
+}
+async function resolveFlowModelNodeFromRequestRd(ctx, rd) {
+  const flowModelUid = resolveFlowModelUidFromRequestRd(ctx, rd);
+  return flowModelUid ? getFlowModelNode(ctx, flowModelUid) : null;
+}
+async function resolveFormAssignRulesContractNode(ctx, runtimeNode, contractModelUid) {
+  const contractNode = await getFlowModelNode(ctx, contractModelUid);
+  if (!contractNode || !contractNode.parentId || !isFormGridNode(contractNode)) return null;
+  const formNode = await getFlowModelNode(ctx, contractNode.parentId);
+  if (!formNode || !isFormAssignRulesContractPair(formNode, contractNode)) return null;
+  if (isReferenceFormGridNode(contractNode)) {
+    const targetUid = getReferenceFormGridTargetUid(contractNode);
+    if (!targetUid) return null;
+    const targetFormNode = await getFlowModelNode(ctx, targetUid);
+    if (!targetFormNode) return null;
+    const targetGridNode = await getFlowModelChildNode(ctx, targetFormNode.uid, "grid");
+    if (!targetGridNode || !isFormAssignRulesContractPair(targetFormNode, targetGridNode) || isReferenceFormGridNode(targetGridNode)) {
+      return null;
+    }
+    const targetVariableSource = await resolveFormAssignRulesVariableSource(ctx, targetGridNode);
+    let contractSourceNode = targetGridNode;
+    if (typeof targetVariableSource === "undefined") {
+      if (typeof readFormAssignRulesVariableSource(formNode) === "undefined") return null;
+      contractSourceNode = formNode;
+    }
+    const directlyRelated = runtimeNode.uid === contractNode.uid || runtimeNode.uid === formNode.uid || runtimeNode.uid === targetGridNode.uid || runtimeNode.uid === targetFormNode.uid;
+    if (directlyRelated) return contractSourceNode;
+    const ancestorUids2 = await loadFlowModelAncestorUids(ctx, runtimeNode);
+    return (ancestorUids2 == null ? void 0 : ancestorUids2.has(contractNode.uid)) === true || (ancestorUids2 == null ? void 0 : ancestorUids2.has(targetGridNode.uid)) === true ? contractSourceNode : null;
+  }
+  if (typeof await resolveFormAssignRulesVariableSource(ctx, contractNode) === "undefined") return null;
+  if (runtimeNode.uid === contractNode.uid || runtimeNode.uid === formNode.uid) return contractNode;
+  const ancestorUids = await loadFlowModelAncestorUids(ctx, runtimeNode);
+  return (ancestorUids == null ? void 0 : ancestorUids.has(contractNode.uid)) === true ? contractNode : null;
+}
+async function resolveReferenceBlockContractNode(ctx, runtimeNode, contractModelUid) {
+  const reference = await getFlowModelNode(ctx, contractModelUid);
+  if ((reference == null ? void 0 : reference.options.use) !== "ReferenceBlockModel") return null;
+  let current = reference;
+  const seen = /* @__PURE__ */ new Set([reference.uid]);
+  for (let depth = 0; depth < 20; depth++) {
+    const steps = isObject(current.options.stepParams) ? current.options.stepParams : null;
+    const settings = steps && isObject(steps.referenceSettings) ? steps.referenceSettings : null;
+    const target = settings && isObject(settings.target) ? settings.target : null;
+    const targetUid = typeof (target == null ? void 0 : target.targetUid) === "string" ? target.targetUid.trim() : "";
+    if (!targetUid || seen.has(targetUid)) return null;
+    seen.add(targetUid);
+    const node = await getFlowModelNode(ctx, targetUid);
+    if (!node) return null;
+    if (node.options.use !== "ReferenceBlockModel") return node.uid === runtimeNode.uid ? reference : null;
+    current = node;
+  }
+  return null;
+}
+function createPolicy(allowAll = false, allowedPaths = /* @__PURE__ */ new Set(), unrestrictedVariables = /* @__PURE__ */ new Set()) {
+  return { allowAll, allowedPaths, unrestrictedVariables };
+}
+function denied(analysis, contextParams, policy, recordSlotPolicies, flowModelUid) {
+  return { allowed: false, analysis, contextParams, flowModelUid, policy, recordSlotPolicies };
+}
+async function createRecordBindingPlan(ctx, contextParams, usage, recordSlotPolicies) {
+  return await (0, import_record_bindings.planRecordBindings)({ contextParams, koaCtx: ctx, policies: recordSlotPolicies, usage });
+}
+function recordBindingPlanAllowed(plan) {
+  return plan.rejections.length === 0 && plan.bindings.every(import_registry.isSafeRecordBinding);
+}
+async function authorizeVariablesResolve(ctx, options) {
+  var _a;
+  let contextParams = sanitizeContextParams(options.contextParams || {});
+  const flowModelUid = resolveFlowModelUidFromRequestRd(ctx, options.rd);
+  const hasContractRd = typeof options.contractRd !== "undefined";
+  const contractModelUid = hasContractRd ? resolveFlowModelUidFromRequestRd(ctx, options.contractRd) : flowModelUid;
+  const unrestrictedVariables = /* @__PURE__ */ new Set();
+  let policy = createPolicy(false, /* @__PURE__ */ new Set(), unrestrictedVariables);
+  let recordSlotPolicies = /* @__PURE__ */ new Map();
+  const result = analyzeVariableTemplateSafely(options.template, { mode: "untrusted-request" });
+  if (!result.ok) {
+    contextParams = sanitizeContextParams((0, import_registry.sanitizeRegisteredVariableContextParams)(contextParams));
+    return {
+      allowed: false,
+      contextParams: (await createRecordBindingPlan(ctx, contextParams, {})).contextParams,
+      flowModelUid: flowModelUid || void 0,
+      policy,
+      recordSlotPolicies
+    };
+  }
+  const { analysis } = result;
+  if (!analysis.supported) {
+    contextParams = sanitizeContextParams((0, import_registry.sanitizeRegisteredVariableContextParams)(contextParams));
+    return denied(
+      analysis,
+      (await createRecordBindingPlan(ctx, contextParams, analysis.usage)).contextParams,
+      policy,
+      recordSlotPolicies,
+      flowModelUid || void 0
+    );
+  }
+  const flowModelRequiredVars = /* @__PURE__ */ new Set();
+  for (const [varName, usedPaths] of Object.entries(analysis.usage)) {
+    const def = import_registry.variables.get(varName);
+    const validation = await ((_a = def == null ? void 0 : def.validateContextParams) == null ? void 0 : _a.call(def, {
+      contextParams,
+      flowModelUid: flowModelUid || void 0,
+      koaCtx: ctx,
+      usage: usedPaths,
+      varName
+    })) || {};
+    contextParams = sanitizeContextParams((validation == null ? void 0 : validation.contextParams) || contextParams);
+    if ((validation == null ? void 0 : validation.allowed) === false) {
+      contextParams = sanitizeContextParams((0, import_registry.sanitizeRegisteredVariableContextParams)(contextParams));
+      return denied(
+        analysis,
+        (await createRecordBindingPlan(ctx, contextParams, analysis.usage)).contextParams,
+        policy,
+        recordSlotPolicies,
+        flowModelUid || void 0
+      );
+    }
+    if ((validation == null ? void 0 : validation.requireFlowModel) === false) unrestrictedVariables.add(varName);
+    else flowModelRequiredVars.add(varName);
+  }
+  contextParams = sanitizeContextParams((0, import_registry.sanitizeRegisteredVariableContextParams)(contextParams));
+  let bindingPlan = await createRecordBindingPlan(ctx, contextParams, analysis.usage);
+  const configureRole = await currentRoleAllowsConfigure(ctx);
+  const currentNode = flowModelUid ? await getFlowModelNode(ctx, flowModelUid) : null;
+  if (configureRole) {
+    policy = createPolicy(true, /* @__PURE__ */ new Set(), unrestrictedVariables);
+    recordSlotPolicies = await (0, import_record_slot_policy.compileRecordSlotPolicies)(
+      analysis,
+      createRecordSlotCompilerOptions(ctx, currentNode || void 0)
+    );
+    bindingPlan = await createRecordBindingPlan(ctx, contextParams, analysis.usage, recordSlotPolicies);
+    return recordBindingPlanAllowed(bindingPlan) ? {
+      allowed: true,
+      analysis,
+      bindingPlan,
+      contextParams: bindingPlan.contextParams,
+      ...currentNode ? { flowModelUid: currentNode.uid } : {},
+      policy,
+      recordSlotPolicies
+    } : denied(analysis, bindingPlan.contextParams, policy, recordSlotPolicies, flowModelUid || void 0);
+  }
+  if (flowModelRequiredVars.size > 0 && !flowModelUid) {
+    return denied(analysis, bindingPlan.contextParams, policy, recordSlotPolicies);
+  }
+  let contractNode = currentNode;
+  let contractSource = "node";
+  if (hasContractRd) {
+    const reference = currentNode && contractModelUid ? await resolveReferenceBlockContractNode(ctx, currentNode, contractModelUid) : null;
+    contractNode = reference || (currentNode && contractModelUid ? await resolveFormAssignRulesContractNode(ctx, currentNode, contractModelUid) : null);
+    contractSource = reference ? "node" : "formAssignRules";
+    if (!contractNode) {
+      return denied(analysis, bindingPlan.contextParams, policy, recordSlotPolicies, flowModelUid || void 0);
+    }
+  }
+  const contract = contractNode && currentNode ? await getFlowModelVariableContract(ctx, contractNode, currentNode, contractSource) : null;
+  const allowedPaths = (contract == null ? void 0 : contract.allowedPaths) || null;
+  recordSlotPolicies = (contract == null ? void 0 : contract.recordSlots) || /* @__PURE__ */ new Map();
+  policy = createPolicy(false, allowedPaths || /* @__PURE__ */ new Set(), unrestrictedVariables);
+  if (flowModelRequiredVars.size > 0 && !allowedPaths) {
+    return denied(analysis, bindingPlan.contextParams, policy, recordSlotPolicies, flowModelUid || void 0);
+  }
+  for (const path of analysis.paths) {
+    if (unrestrictedVariables.has(path.varName)) continue;
+    if (!(allowedPaths == null ? void 0 : allowedPaths.has(path.canonicalKey))) {
+      return denied(analysis, bindingPlan.contextParams, policy, recordSlotPolicies, flowModelUid || void 0);
+    }
+  }
+  if (unrestrictedVariables.size) {
+    const requestPolicies = await (0, import_record_slot_policy.compileRecordSlotPolicies)(
+      analysis,
+      createRecordSlotCompilerOptions(ctx, currentNode || void 0)
+    );
+    const mergedPolicies = new Map(recordSlotPolicies);
+    for (const path of analysis.paths) {
+      if (!unrestrictedVariables.has(path.varName)) continue;
+      const requestPolicy = requestPolicies.get(path.canonicalKey);
+      if (requestPolicy) mergedPolicies.set(path.canonicalKey, requestPolicy);
+    }
+    recordSlotPolicies = mergedPolicies;
+  }
+  bindingPlan = await createRecordBindingPlan(ctx, contextParams, analysis.usage, recordSlotPolicies);
+  return recordBindingPlanAllowed(bindingPlan) ? {
+    allowed: true,
+    analysis,
+    bindingPlan,
+    contextParams: bindingPlan.contextParams,
+    flowModelUid: flowModelUid || void 0,
+    policy,
+    recordSlotPolicies
+  } : denied(analysis, bindingPlan.contextParams, policy, recordSlotPolicies, flowModelUid || void 0);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  analyzeVariableTemplateSafely,
+  authorizeVariablesResolve,
+  clearVariableAllowListCache,
+  hasRecordContextParams,
+  resolveFlowModelNodeFromRequestRd,
+  sanitizeContextParams
+});

package/dist/server/variables/form-item-record-slot-resolvers.d.ts

@@ -0,0 +1,10 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import type { RecordSlotResolverRegistration } from './record-slot-resolvers';
+export declare function createFormItemRecordSlotResolvers(): readonly RecordSlotResolverRegistration[];