@nocobase/plugin-flow-engine 2.3.0-alpha.1 → 2.3.0-beta.2

package/dist/server/variables/resolve.d.ts

@@ -7,15 +7,33 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 import type { ResourcerContext } from '@nocobase/resourcer';
+import { type AnalyzedTemplate, type ResolvePathPolicy } from '../template/variable-expression';
 import { JSONValue } from '../template/resolver';
-type ResolveBatchItem = {
+import { type RecordBindingPlan } from './record-bindings';
+export type ResolveBatchItem = {
     id?: string | number;
     template: JSONValue;
     contextParams?: Record<string, unknown>;
 };
+export type AnalyzedResolveBatchItem = ResolveBatchItem & {
+    analysis: AnalyzedTemplate;
+    bindingPlan: RecordBindingPlan;
+    policy: ResolvePathPolicy;
+};
 export declare function resolveVariablesTemplate(ctx: ResourcerContext, template: JSONValue, contextParams?: Record<string, unknown>): Promise<any>;
+export declare function isLegacyVariableTemplateSafe(template: JSONValue): boolean;
+export declare function resolveFlowModelVariablesTemplate(ctx: ResourcerContext, options: {
+    contractRd?: string | number;
+    contextParams?: Record<string, unknown>;
+    rd?: string | number;
+    template: JSONValue;
+}): Promise<any>;
+export declare function resolveAnalyzedVariablesTemplate(ctx: ResourcerContext, analysis: AnalyzedTemplate, policy: ResolvePathPolicy, bindingPlan: RecordBindingPlan): Promise<any>;
 export declare function resolveVariablesBatch(ctx: ResourcerContext, items: ResolveBatchItem[]): Promise<{
     id?: string | number;
     data: unknown;
 }[]>;
-export {};
+export declare function resolveAnalyzedVariablesBatch(ctx: ResourcerContext, items: AnalyzedResolveBatchItem[]): Promise<{
+    id?: string | number;
+    data: unknown;
+}[]>;

package/dist/server/variables/resolve.js

@@ -26,15 +26,27 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var resolve_exports = {};
 __export(resolve_exports, {
+  isLegacyVariableTemplateSafe: () => isLegacyVariableTemplateSafe,
+  resolveAnalyzedVariablesBatch: () => resolveAnalyzedVariablesBatch,
+  resolveAnalyzedVariablesTemplate: () => resolveAnalyzedVariablesTemplate,
+  resolveFlowModelVariablesTemplate: () => resolveFlowModelVariablesTemplate,
   resolveVariablesBatch: () => resolveVariablesBatch,
   resolveVariablesTemplate: () => resolveVariablesTemplate
 });
 module.exports = __toCommonJS(resolve_exports);
 var import_contexts = require("../template/contexts");
 var import_resolver = require("../template/resolver");
+var import_allow_list = require("./allow-list");
+var import_record_bindings = require("./record-bindings");
 var import_registry = require("./registry");
+var import_record_slot_policy = require("./record-slot-policy");
 var import_utils = require("./utils");
 const GLOBAL_CONTEXT_KEY = Symbol.for("nocobase.flow-engine.variables.global-context");
+const REQUEST_BOUND_RESOLVE_POLICY = {
+  allowAll: true,
+  allowedPaths: /* @__PURE__ */ new Set(),
+  unrestrictedVariables: /* @__PURE__ */ new Set()
+};
 function getGlobalContext(ctx) {
   var _a, _b;
   const app = ctx.app;
@@ -44,36 +56,96 @@ function getGlobalContext(ctx) {
   return app[GLOBAL_CONTEXT_KEY];
 }
 async function resolveVariablesTemplate(ctx, template, contextParams = {}) {
-  await (0, import_utils.prefetchRecordsForResolve)(ctx, [{ template, contextParams }]);
-  return resolveVariablesTemplateWithPrefetchedRecords(ctx, template, contextParams);
+  const result = (0, import_allow_list.analyzeVariableTemplateSafely)(template, { mode: "untrusted-request" });
+  if (!result.ok) return template;
+  const bindingPlan = await createRequestBoundRecordBindingPlan(ctx, result.analysis, contextParams);
+  return resolveAnalyzedVariablesTemplate(ctx, result.analysis, REQUEST_BOUND_RESOLVE_POLICY, bindingPlan);
+}
+function isLegacyVariableTemplateSafe(template) {
+  const result = (0, import_allow_list.analyzeVariableTemplateSafely)(template, { mode: "untrusted-request" });
+  return result.ok && result.analysis.supported && result.analysis.paths.length === 0;
+}
+async function resolveFlowModelVariablesTemplate(ctx, options) {
+  if (!await (0, import_allow_list.resolveFlowModelNodeFromRequestRd)(ctx, options.rd)) return;
+  const authorization = await (0, import_allow_list.authorizeVariablesResolve)(ctx, options);
+  if (!authorization.allowed || !authorization.flowModelUid) return;
+  const resolved = await resolveAnalyzedVariablesTemplate(
+    ctx,
+    authorization.analysis,
+    authorization.policy,
+    authorization.bindingPlan
+  );
+  const remaining = (0, import_allow_list.analyzeVariableTemplateSafely)(resolved, { mode: "untrusted-request" });
+  if (!remaining.ok || !remaining.analysis.supported || remaining.analysis.paths.length) return;
+  return resolved;
+}
+async function createRequestBoundRecordBindingPlan(ctx, analysis, contextParams) {
+  const policies = await (0, import_record_slot_policy.compileRecordSlotPolicies)(analysis, { app: ctx.app, ctx });
+  return (0, import_record_bindings.planRecordBindings)({
+    contextParams,
+    koaCtx: ctx,
+    policies,
+    usage: analysis.usage
+  });
 }
-async function resolveVariablesTemplateWithPrefetchedRecords(ctx, template, contextParams = {}) {
+async function resolveAnalyzedVariablesTemplate(ctx, analysis, policy, bindingPlan) {
+  await (0, import_utils.prefetchRecordsForResolve)(ctx, bindingPlan.bindings);
+  return resolveAnalyzedVariablesTemplateWithPrefetchedRecords(ctx, analysis, policy, bindingPlan);
+}
+async function resolveAnalyzedVariablesTemplateWithPrefetchedRecords(ctx, analysis, policy, bindingPlan) {
   const requestCtx = new import_contexts.HttpRequestContext(ctx);
   requestCtx.delegate(getGlobalContext(ctx));
-  await import_registry.variables.attachUsedVariables(requestCtx, ctx, template, contextParams);
-  return (0, import_resolver.resolveJsonTemplate)(template, requestCtx);
+  await import_registry.variables.attachUsedVariablesFromPlan(requestCtx, ctx, analysis.usage, bindingPlan);
+  return (0, import_resolver.resolveAnalyzedJsonTemplate)(analysis, requestCtx, policy);
 }
 async function resolveVariablesBatch(ctx, items) {
+  var _a;
+  const analyzedItems = [];
+  const results = [];
+  for (const [index, item] of items.entries()) {
+    const result = (0, import_allow_list.analyzeVariableTemplateSafely)((item == null ? void 0 : item.template) ?? {}, { mode: "untrusted-request" });
+    if (!result.ok) {
+      results[index] = { id: item == null ? void 0 : item.id, data: (item == null ? void 0 : item.template) ?? {} };
+      continue;
+    }
+    analyzedItems.push({
+      ...item,
+      id: index,
+      analysis: result.analysis,
+      bindingPlan: await createRequestBoundRecordBindingPlan(ctx, result.analysis, item.contextParams || {}),
+      policy: REQUEST_BOUND_RESOLVE_POLICY
+    });
+  }
+  const resolvedItems = await resolveAnalyzedVariablesBatch(ctx, analyzedItems);
+  for (const item of resolvedItems) {
+    const index = Number(item.id);
+    results[index] = { id: (_a = items[index]) == null ? void 0 : _a.id, data: item.data };
+  }
+  return results.filter((item) => !!item);
+}
+async function resolveAnalyzedVariablesBatch(ctx, items) {
   await (0, import_utils.prefetchRecordsForResolve)(
     ctx,
-    items.map((item) => ({
-      template: (item == null ? void 0 : item.template) ?? {},
-      contextParams: (item == null ? void 0 : item.contextParams) || {}
-    }))
+    items.flatMap((item) => item.bindingPlan.bindings)
   );
   const results = [];
   for (const item of items) {
-    const data = await resolveVariablesTemplateWithPrefetchedRecords(
+    const data = await resolveAnalyzedVariablesTemplateWithPrefetchedRecords(
       ctx,
-      (item == null ? void 0 : item.template) ?? {},
-      (item == null ? void 0 : item.contextParams) || {}
+      item.analysis,
+      item.policy,
+      item.bindingPlan
     );
-    results.push({ id: item == null ? void 0 : item.id, data });
+    results.push({ id: item.id, data });
   }
   return results;
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  isLegacyVariableTemplateSafe,
+  resolveAnalyzedVariablesBatch,
+  resolveAnalyzedVariablesTemplate,
+  resolveFlowModelVariablesTemplate,
   resolveVariablesBatch,
   resolveVariablesTemplate
 });

package/dist/server/variables/runjs-variable-dependencies.d.ts

@@ -0,0 +1,23 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export type PreparedFlowModelVariableSource = Readonly<{
+    ok: true;
+    runJsTemplates: readonly string[];
+    templateSource: unknown;
+}> | Readonly<{
+    ok: false;
+}>;
+export declare const MAX_FLOW_MODEL_VARIABLE_SOURCE_DEPTH = 128;
+export declare const MAX_FLOW_MODEL_VARIABLE_SOURCE_NODES = 10000;
+export declare const MAX_FLOW_MODEL_VARIABLE_STRING_LENGTH: number;
+export declare const MAX_FLOW_MODEL_VARIABLE_TOTAL_STRING_LENGTH: number;
+export declare function prepareFlowModelVariableSource(value: unknown, options?: Readonly<{
+    isRunJsValuePath?: (pathTail: readonly string[]) => boolean;
+}>): PreparedFlowModelVariableSource;
+export declare function collectPersistedRunJsVariableTemplates(value: unknown): string[];

package/dist/server/variables/runjs-variable-dependencies.js

@@ -0,0 +1,407 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var runjs_variable_dependencies_exports = {};
+__export(runjs_variable_dependencies_exports, {
+  MAX_FLOW_MODEL_VARIABLE_SOURCE_DEPTH: () => MAX_FLOW_MODEL_VARIABLE_SOURCE_DEPTH,
+  MAX_FLOW_MODEL_VARIABLE_SOURCE_NODES: () => MAX_FLOW_MODEL_VARIABLE_SOURCE_NODES,
+  MAX_FLOW_MODEL_VARIABLE_STRING_LENGTH: () => MAX_FLOW_MODEL_VARIABLE_STRING_LENGTH,
+  MAX_FLOW_MODEL_VARIABLE_TOTAL_STRING_LENGTH: () => MAX_FLOW_MODEL_VARIABLE_TOTAL_STRING_LENGTH,
+  collectPersistedRunJsVariableTemplates: () => collectPersistedRunJsVariableTemplates,
+  prepareFlowModelVariableSource: () => prepareFlowModelVariableSource
+});
+module.exports = __toCommonJS(runjs_variable_dependencies_exports);
+var import_bindings = require("../flow-surfaces/runjs-authoring/ast/bindings");
+var import_source = require("../flow-surfaces/runjs-authoring/ast/source");
+var import_static_bindings = require("../flow-surfaces/runjs-authoring/ast/static-bindings");
+var import_static_values = require("../flow-surfaces/runjs-authoring/ast/static-values");
+var import_parser = require("../flow-surfaces/runjs-authoring/ast/parser");
+var import_walk = require("../flow-surfaces/runjs-authoring/ast/walk");
+var import_constants = require("../flow-surfaces/runjs-authoring/runtime/constants");
+var import_variable_expression = require("../template/variable-expression");
+const RUNJS_VALUE_KEYS = /* @__PURE__ */ new Set(["code", "version"]);
+const RUNJS_PATH_SUFFIXES = /* @__PURE__ */ new Set(["stepParams.jsSettings.runJs", "stepParams.clickSettings.runJs"]);
+const MUTATING_CTX_METHODS = /* @__PURE__ */ new Set(["__defineGetter__", "__defineSetter__"]);
+const GLOBAL_OBJECT_NAMES = /* @__PURE__ */ new Set(["globalThis"]);
+const DYNAMIC_CODE_EXECUTION_NAMES = /* @__PURE__ */ new Set(["eval", "Function"]);
+const MAX_FLOW_MODEL_VARIABLE_SOURCE_DEPTH = 128;
+const MAX_FLOW_MODEL_VARIABLE_SOURCE_NODES = 1e4;
+const MAX_FLOW_MODEL_VARIABLE_STRING_LENGTH = 256 * 1024;
+const MAX_FLOW_MODEL_VARIABLE_TOTAL_STRING_LENGTH = 1024 * 1024;
+function getEnumerableDataEntries(value) {
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  const entries = [];
+  for (const key of Object.keys(descriptors)) {
+    const descriptor = descriptors[key];
+    if (!descriptor.enumerable) continue;
+    if (!Object.prototype.hasOwnProperty.call(descriptor, "value")) {
+      throw new TypeError("FlowModel variable source must not contain accessors");
+    }
+    entries.push([key, descriptor.value]);
+  }
+  return { descriptors, entries };
+}
+function readPersistedRunJsValue(entries) {
+  if (!entries.length || entries.some(([key]) => !RUNJS_VALUE_KEYS.has(key))) return;
+  const values = new Map(entries);
+  const code = values.get("code");
+  const version = values.get("version");
+  if (typeof code !== "string" || version != null && typeof version !== "string") return;
+  return { code, version };
+}
+function isPersistedRunJsPath(pathTail) {
+  return RUNJS_PATH_SUFFIXES.has(pathTail.slice(-3).join("."));
+}
+function createTraversalContainer(input, descriptors) {
+  var _a;
+  if (!Array.isArray(input)) return /* @__PURE__ */ Object.create(null);
+  const length = (_a = descriptors.length) == null ? void 0 : _a.value;
+  if (!Number.isInteger(length) || length < 0 || length > MAX_FLOW_MODEL_VARIABLE_SOURCE_NODES) {
+    throw new RangeError("FlowModel variable source array exceeds its limit");
+  }
+  return new Array(length);
+}
+function defineTraversalValue(parent, key, value) {
+  Object.defineProperty(parent, key, {
+    configurable: true,
+    enumerable: true,
+    value,
+    writable: true
+  });
+}
+function functionBindsCtxParameter(node, cache) {
+  if (!(0, import_bindings.isAstFunctionLike)(node)) return false;
+  const objectNode = node;
+  const cached = cache.get(objectNode);
+  if (typeof cached === "boolean") return cached;
+  let bindsCtx = false;
+  for (const parameter of node.params || []) {
+    (0, import_static_values.collectAstPatternBindingIdentifiers)(parameter, (name) => {
+      if (name === "ctx") bindsCtx = true;
+    });
+  }
+  cache.set(objectNode, bindsCtx);
+  return bindsCtx;
+}
+function hasCtxParameterInFunctionAncestors(ancestors, cache) {
+  return ancestors.some((ancestor) => functionBindsCtxParameter(ancestor, cache));
+}
+function getDirectCtxMethodName(node, identifierBindings) {
+  const member = (0, import_bindings.unwrapAstChainExpression)(node);
+  if ((member == null ? void 0 : member.type) !== "MemberExpression" || !(0, import_static_values.isUnshadowedCtxIdentifier)(member.object, identifierBindings)) return;
+  return (0, import_static_values.getAstStaticPropertyName)(member);
+}
+function isCtxRootedMember(node, identifierBindings) {
+  const member = (0, import_bindings.unwrapAstChainExpression)(node);
+  if ((member == null ? void 0 : member.type) !== "MemberExpression") return false;
+  const root = (0, import_static_values.getAstMemberRootIdentifier)(member);
+  return (root == null ? void 0 : root.name) === "ctx" && !(0, import_static_values.hasAstActiveBinding)("ctx", root.index, identifierBindings);
+}
+function isCtxMutationTarget(target, identifierBindings) {
+  const node = (0, import_bindings.unwrapAstChainExpression)(target);
+  if (!node) return false;
+  if (node.type === "Identifier") return (0, import_static_values.isUnshadowedCtxIdentifier)(node, identifierBindings);
+  if (node.type === "MemberExpression") return isCtxRootedMember(node, identifierBindings);
+  if (node.type === "AssignmentPattern") return isCtxMutationTarget(node.left, identifierBindings);
+  if (node.type === "RestElement") return isCtxMutationTarget(node.argument, identifierBindings);
+  if (node.type === "ArrayPattern") {
+    return (node.elements || []).some((element) => isCtxMutationTarget(element, identifierBindings));
+  }
+  if (node.type !== "ObjectPattern") return false;
+  return (node.properties || []).some((propertyValue) => {
+    const property = propertyValue;
+    if ((property == null ? void 0 : property.type) === "RestElement") {
+      return isCtxMutationTarget(property.argument, identifierBindings);
+    }
+    return (property == null ? void 0 : property.type) === "Property" && isCtxMutationTarget(property.value, identifierBindings);
+  });
+}
+function isNonReferenceIdentifier(node, parent) {
+  if (!parent) return false;
+  if (parent.type === "MemberExpression" && parent.property === node && !parent.computed) return true;
+  if (parent.type === "Property" && parent.key === node && !parent.computed && !parent.shorthand) return true;
+  if ((parent.type === "MethodDefinition" || parent.type === "PropertyDefinition") && parent.key === node && !parent.computed) {
+    return true;
+  }
+  return (parent.type === "LabeledStatement" || parent.type === "BreakStatement" || parent.type === "ContinueStatement") && parent.value === node;
+}
+function thisUsesTopLevelBinding(ancestors) {
+  for (let index = 0; index < ancestors.length; index += 1) {
+    const ancestor = ancestors[index];
+    if ((0, import_bindings.isAstFunctionLike)(ancestor) && ancestor.type !== "ArrowFunctionExpression") return false;
+    if (ancestor.type === "StaticBlock") return false;
+    if (ancestor.type === "PropertyDefinition" && (0, import_bindings.unwrapAstChainExpression)(ancestor.value) === ancestors[index + 1]) {
+      return false;
+    }
+  }
+  return true;
+}
+function hasUnsafeCtxUsage(ast, identifierBindings) {
+  let unsafe = false;
+  (0, import_walk.walkAstAncestor)(ast, {
+    Identifier(node, ancestors) {
+      const parent = ancestors[ancestors.length - 2];
+      if (isNonReferenceIdentifier(node, parent)) return;
+      if (node.name && (GLOBAL_OBJECT_NAMES.has(node.name) || DYNAMIC_CODE_EXECUTION_NAMES.has(node.name)) && !(0, import_static_values.hasAstActiveBinding)(node.name, node.start || 0, identifierBindings)) {
+        unsafe = true;
+        return;
+      }
+      if (!(0, import_static_values.isUnshadowedCtxIdentifier)(node, identifierBindings)) return;
+      if ((parent == null ? void 0 : parent.type) === "MemberExpression" && (0, import_bindings.unwrapAstChainExpression)(parent.object) === node) return;
+      unsafe = true;
+    },
+    ThisExpression(_node, ancestors) {
+      if (thisUsesTopLevelBinding(ancestors)) unsafe = true;
+    },
+    WithStatement() {
+      unsafe = true;
+    }
+  });
+  return unsafe;
+}
+function hasCtxMutation(ast, identifierBindings) {
+  let mutated = false;
+  (0, import_walk.walkAstSimple)(ast, {
+    AssignmentExpression(node) {
+      if (isCtxMutationTarget(node.left, identifierBindings)) mutated = true;
+    },
+    CallExpression(node) {
+      const callee = (0, import_bindings.unwrapAstChainExpression)(node.callee);
+      if ((callee == null ? void 0 : callee.type) === "MemberExpression" && MUTATING_CTX_METHODS.has((0, import_static_values.getAstStaticPropertyName)(callee)) && isCtxRootedMember(callee, identifierBindings)) {
+        mutated = true;
+      }
+    },
+    ForInStatement(node) {
+      if (isCtxMutationTarget(node.left, identifierBindings)) mutated = true;
+    },
+    ForOfStatement(node) {
+      if (isCtxMutationTarget(node.left, identifierBindings)) mutated = true;
+    },
+    UnaryExpression(node) {
+      if (node.operator === "delete" && isCtxMutationTarget(node.argument, identifierBindings)) {
+        mutated = true;
+      }
+    },
+    UpdateExpression(node) {
+      if (isCtxMutationTarget(node.argument, identifierBindings)) mutated = true;
+    }
+  });
+  return mutated;
+}
+function createValidatedGetVarTemplate(value, code) {
+  var _a;
+  const path = (_a = (0, import_static_values.resolveAstStaticStringValue)(value, code)) == null ? void 0 : _a.trim();
+  if (!path) return;
+  const template = `{{${path}}}`;
+  const analysis = (0, import_variable_expression.analyzeVariableTemplate)(template, { mode: "flow-model" });
+  if (analysis.errors.length !== 0 || analysis.paths.length !== 1 || analysis.value.kind !== "string") return;
+  if (analysis.value.expressions.length !== 1) return;
+  const expression = analysis.value.expressions[0];
+  const variablePath = expression.paths[0];
+  if (!variablePath || !expression.supported || expression.paths.length !== 1 || expression.expressionSpan.start !== 2 || expression.expressionSpan.end !== 2 + path.length || expression.placeholderSpan.start !== 0 || expression.placeholderSpan.end !== template.length || variablePath.span.start !== 2 || variablePath.span.end !== 2 + path.length) {
+    return;
+  }
+  return `{{ ${path} }}`;
+}
+function resolveStaticJsonValue(node, code) {
+  var _a;
+  const valueNode = (0, import_bindings.unwrapAstChainExpression)(node);
+  if (!valueNode) return { ok: false };
+  if (valueNode.type === "Literal") {
+    const literalValue = valueNode.value;
+    if (literalValue === null) return { ok: true, value: null };
+    if (typeof literalValue === "string") return { ok: true, value: literalValue };
+    if (typeof literalValue === "boolean") return { ok: true, value: literalValue };
+    if (typeof literalValue === "number" && Number.isFinite(literalValue)) return { ok: true, value: literalValue };
+    return { ok: false };
+  }
+  if (valueNode.type === "TemplateLiteral" && !((_a = valueNode.expressions) == null ? void 0 : _a.length)) {
+    const value2 = (0, import_static_values.resolveAstStaticStringValue)(valueNode, code);
+    return typeof value2 === "string" ? { ok: true, value: value2 } : { ok: false };
+  }
+  if (valueNode.type === "UnaryExpression" && valueNode.operator === "-") {
+    const argument = (0, import_bindings.unwrapAstChainExpression)(valueNode.argument);
+    return (argument == null ? void 0 : argument.type) === "Literal" && typeof argument.value === "number" && Number.isFinite(argument.value) ? { ok: true, value: -argument.value } : { ok: false };
+  }
+  if (valueNode.type === "ArrayExpression") {
+    const value2 = [];
+    for (const element of valueNode.elements || []) {
+      if (!element || element.type === "SpreadElement") return { ok: false };
+      const resolved = resolveStaticJsonValue(element, code);
+      if (!resolved.ok) return resolved;
+      value2.push(resolved.value);
+    }
+    return { ok: true, value: value2 };
+  }
+  if (valueNode.type !== "ObjectExpression") return { ok: false };
+  const value = /* @__PURE__ */ Object.create(null);
+  for (const propertyValue of valueNode.properties || []) {
+    const property = propertyValue;
+    if ((property == null ? void 0 : property.type) !== "Property" || property.computed || property.kind !== "init" || property.method || property.shorthand) {
+      return { ok: false };
+    }
+    const keyNode = (0, import_bindings.unwrapAstChainExpression)(property.key);
+    const key = (keyNode == null ? void 0 : keyNode.type) === "Identifier" ? keyNode.name : (keyNode == null ? void 0 : keyNode.type) === "Literal" && (typeof keyNode.value === "string" || typeof keyNode.value === "number") ? String(keyNode.value) : void 0;
+    if (typeof key !== "string" || key === "__proto__" || Object.prototype.hasOwnProperty.call(value, key)) {
+      return { ok: false };
+    }
+    const resolved = resolveStaticJsonValue(property.value, code);
+    if (!resolved.ok) return resolved;
+    value[key] = resolved.value;
+  }
+  return { ok: true, value };
+}
+function collectValidatedResolveJsonTemplates(value) {
+  const analysis = (0, import_variable_expression.analyzeVariableTemplate)(value, { mode: "untrusted-request" });
+  if (!analysis.supported || analysis.errors.length) return [];
+  const templates = /* @__PURE__ */ new Set();
+  const visit = (current) => {
+    if (typeof current === "string") {
+      if ((0, import_variable_expression.analyzeVariableTemplate)(current, { mode: "untrusted-request" }).paths.length) templates.add(current);
+      return;
+    }
+    if (Array.isArray(current)) {
+      current.forEach(visit);
+      return;
+    }
+    if (current && typeof current === "object") Object.values(current).forEach(visit);
+  };
+  visit(value);
+  return Array.from(templates);
+}
+function extractStaticVariableTemplates(code) {
+  const parsed = (0, import_parser.parseRunJsAuthoringAst)(code);
+  if (!parsed.ast) return [];
+  const identifierBindings = (0, import_static_bindings.collectAstIdentifierBindingsFromAst)(parsed.ast, code);
+  if (hasUnsafeCtxUsage(parsed.ast, identifierBindings) || hasCtxMutation(parsed.ast, identifierBindings)) {
+    return [];
+  }
+  const functionCtxParameterCache = /* @__PURE__ */ new WeakMap();
+  const templates = /* @__PURE__ */ new Set();
+  (0, import_walk.walkAstAncestor)(parsed.ast, {
+    CallExpression(node, ancestors) {
+      var _a, _b;
+      const methodName = getDirectCtxMethodName(node.callee, identifierBindings);
+      if (hasCtxParameterInFunctionAncestors(ancestors, functionCtxParameterCache)) return;
+      if (methodName === "getVar") {
+        const template = createValidatedGetVarTemplate((_a = node.arguments) == null ? void 0 : _a[0], code);
+        if (template) templates.add(template);
+        return;
+      }
+      if (methodName !== "resolveJsonTemplate" || ((_b = node.arguments) == null ? void 0 : _b.length) !== 1) return;
+      const resolved = resolveStaticJsonValue(node.arguments[0], code);
+      if (!resolved.ok) return;
+      collectValidatedResolveJsonTemplates(resolved.value).forEach((template) => templates.add(template));
+    }
+  });
+  return Array.from(templates);
+}
+function prepareFlowModelVariableSource(value, options = {}) {
+  var _a;
+  try {
+    const templates = /* @__PURE__ */ new Set();
+    const seen = /* @__PURE__ */ new WeakSet();
+    const root = /* @__PURE__ */ Object.create(null);
+    const stack = [{ depth: 0, input: value, key: "value", parent: root, pathTail: [] }];
+    let scheduledNodes = 1;
+    let sourceCount = 0;
+    let totalStringLength = 0;
+    let totalSourceLength = 0;
+    while (stack.length) {
+      const frame = stack.pop();
+      if (!frame) break;
+      const { depth, input, key, parent, pathTail } = frame;
+      if (!input || typeof input !== "object") {
+        if (typeof input === "string") {
+          totalStringLength += input.length;
+          if (input.length > MAX_FLOW_MODEL_VARIABLE_STRING_LENGTH || totalStringLength > MAX_FLOW_MODEL_VARIABLE_TOTAL_STRING_LENGTH) {
+            return { ok: false };
+          }
+        }
+        defineTraversalValue(parent, key, input);
+        continue;
+      }
+      if (seen.has(input)) return { ok: false };
+      seen.add(input);
+      const { descriptors, entries } = getEnumerableDataEntries(input);
+      for (const [entryKey] of entries) {
+        totalStringLength += entryKey.length;
+        if (entryKey.length > MAX_FLOW_MODEL_VARIABLE_STRING_LENGTH || totalStringLength > MAX_FLOW_MODEL_VARIABLE_TOTAL_STRING_LENGTH) {
+          return { ok: false };
+        }
+      }
+      const runJsPath = options.isRunJsValuePath ? options.isRunJsValuePath(pathTail) : isPersistedRunJsPath(pathTail);
+      const runJs = !Array.isArray(input) && runJsPath ? readPersistedRunJsValue(entries) : void 0;
+      const output = createTraversalContainer(input, descriptors);
+      defineTraversalValue(parent, key, output);
+      if (runJs) {
+        scheduledNodes += entries.length;
+        sourceCount += 1;
+        totalStringLength += runJs.code.length + (((_a = runJs.version) == null ? void 0 : _a.length) || 0);
+        totalSourceLength += runJs.code.length;
+        if (scheduledNodes > MAX_FLOW_MODEL_VARIABLE_SOURCE_NODES || runJs.code.length > MAX_FLOW_MODEL_VARIABLE_STRING_LENGTH || runJs.version != null && runJs.version.length > MAX_FLOW_MODEL_VARIABLE_STRING_LENGTH || totalStringLength > MAX_FLOW_MODEL_VARIABLE_TOTAL_STRING_LENGTH || sourceCount > import_constants.MAX_RUNJS_SOURCES_PER_REQUEST || runJs.code.length > import_constants.MAX_RUNJS_SOURCE_LENGTH || totalSourceLength > import_constants.MAX_RUNJS_TOTAL_SOURCE_LENGTH) {
+          return { ok: false };
+        }
+        for (const [entryKey, entryValue] of entries) {
+          const preparedEntryValue = entryKey === "code" ? runJs.version === "v2" ? "" : (0, import_source.maskJavaScriptComments)(runJs.code) : entryValue;
+          defineTraversalValue(output, entryKey, preparedEntryValue);
+        }
+        extractStaticVariableTemplates(runJs.code).forEach((template) => templates.add(template));
+        continue;
+      }
+      if (entries.length && depth >= MAX_FLOW_MODEL_VARIABLE_SOURCE_DEPTH) return { ok: false };
+      scheduledNodes += entries.length;
+      if (scheduledNodes > MAX_FLOW_MODEL_VARIABLE_SOURCE_NODES) return { ok: false };
+      for (let index = entries.length - 1; index >= 0; index -= 1) {
+        const [entryKey, entryValue] = entries[index];
+        const nextPath = [...pathTail, entryKey];
+        stack.push({
+          depth: depth + 1,
+          input: entryValue,
+          key: entryKey,
+          parent: output,
+          pathTail: options.isRunJsValuePath ? nextPath : nextPath.slice(-3)
+        });
+      }
+    }
+    return { ok: true, runJsTemplates: Array.from(templates), templateSource: root.value };
+  } catch {
+    return { ok: false };
+  }
+}
+function collectPersistedRunJsVariableTemplates(value) {
+  const prepared = prepareFlowModelVariableSource(value);
+  return prepared.ok ? Array.from(prepared.runJsTemplates) : [];
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MAX_FLOW_MODEL_VARIABLE_SOURCE_DEPTH,
+  MAX_FLOW_MODEL_VARIABLE_SOURCE_NODES,
+  MAX_FLOW_MODEL_VARIABLE_STRING_LENGTH,
+  MAX_FLOW_MODEL_VARIABLE_TOTAL_STRING_LENGTH,
+  collectPersistedRunJsVariableTemplates,
+  prepareFlowModelVariableSource
+});

package/dist/server/variables/selects.js

@@ -30,12 +30,15 @@ __export(selects_exports, {
 });
 module.exports = __toCommonJS(selects_exports);
 function adjustSelectsForCollection(koaCtx, dataSourceKey, collection, fields, appends) {
-  var _a, _b, _c, _d;
+  var _a, _b, _c, _d, _e;
   const ds = koaCtx.app.dataSourceManager.get(dataSourceKey || "main");
   const cm = ds.collectionManager;
   const coll = (_b = (_a = cm == null ? void 0 : cm.db) == null ? void 0 : _a.getCollection) == null ? void 0 : _b.call(_a, collection);
-  const assocKeys = Object.keys(((_c = coll == null ? void 0 : coll.model) == null ? void 0 : _c.associations) || {});
-  const rawAttrs = ((_d = coll == null ? void 0 : coll.model) == null ? void 0 : _d.rawAttributes) || {};
+  if (!((_c = coll == null ? void 0 : coll.model) == null ? void 0 : _c.rawAttributes)) {
+    return { fields, appends };
+  }
+  const assocKeys = Object.keys(((_d = coll == null ? void 0 : coll.model) == null ? void 0 : _d.associations) || {});
+  const rawAttrs = ((_e = coll == null ? void 0 : coll.model) == null ? void 0 : _e.rawAttributes) || {};
   const toCamel = (s) => s.replace(/_([a-zA-Z0-9])/g, (_m, c) => String(c).toUpperCase());
   const toSnake = (s) => s.replace(/([A-Z])/g, "_$1").toLowerCase().replace(/^_/, "");
   const assocMap = /* @__PURE__ */ new Map();

package/dist/server/variables/utils.d.ts

@@ -7,11 +7,8 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 import type { ResourcerContext } from '@nocobase/resourcer';
-import type { JSONValue } from '../template/resolver';
+import type { AuthorizedRecordBinding } from './record-bindings';
 /**
- * 预取：构建“同记录”的字段/关联并集，一次查询写入 ctx.state.__varResolveBatchCache，供后续解析复用
+ * Merge record selects for one resolve request and populate the request cache once per target.
  */
-export declare function prefetchRecordsForResolve(koaCtx: ResourcerContext, items: Array<{
-    template: JSONValue;
-    contextParams?: Record<string, unknown>;
-}>): Promise<void>;
+export declare function prefetchRecordsForResolve(koaCtx: ResourcerContext, bindings: readonly AuthorizedRecordBinding[]): Promise<void>;