@nocobase/plugin-flow-engine 3.0.0-alpha.5 → 3.0.0-alpha.7

package/dist/server/variables/allow-list.d.ts

@@ -0,0 +1,48 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import type { ResourcerContext } from '@nocobase/resourcer';
+import { type FlowModelNodeSnapshot } from '../repository';
+import { type AnalyzeTemplateMode, type AnalyzedTemplate, type ResolvePathPolicy } from '../template/variable-expression';
+import type { JSONValue } from '../template/resolver';
+import { type RecordBindingPlan } from './record-bindings';
+import { type RecordSlotPolicies } from './record-slot-policy';
+type AuthorizationResultBase = {
+    contextParams: Readonly<Record<string, unknown>>;
+    flowModelUid?: string;
+    policy: ResolvePathPolicy;
+    recordSlotPolicies: RecordSlotPolicies;
+};
+export type AuthorizationResult = AuthorizationResultBase & ({
+    allowed: true;
+    analysis: AnalyzedTemplate;
+    bindingPlan: RecordBindingPlan;
+} | {
+    allowed: false;
+    analysis?: AnalyzedTemplate;
+});
+export type TemplateAnalysisResult = {
+    ok: true;
+    analysis: AnalyzedTemplate;
+} | {
+    ok: false;
+    errorType: string;
+};
+export declare function analyzeVariableTemplateSafely(template: unknown, options?: Readonly<{
+    mode?: AnalyzeTemplateMode;
+}>): TemplateAnalysisResult;
+export declare function clearVariableAllowListCache(app?: object): object;
+export declare function hasRecordContextParams(value: unknown): boolean;
+export declare function sanitizeContextParams(value?: Record<string, unknown>): Record<string, unknown>;
+export declare function resolveFlowModelNodeFromRequestRd(ctx: ResourcerContext, rd?: string | number): Promise<FlowModelNodeSnapshot>;
+export declare function authorizeVariablesResolve(ctx: ResourcerContext, options: {
+    contextParams?: Record<string, unknown>;
+    rd?: string | number;
+    template: JSONValue;
+}): Promise<AuthorizationResult>;
+export {};

package/dist/server/variables/allow-list.js

@@ -0,0 +1,374 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var allow_list_exports = {};
+__export(allow_list_exports, {
+  analyzeVariableTemplateSafely: () => analyzeVariableTemplateSafely,
+  authorizeVariablesResolve: () => authorizeVariablesResolve,
+  clearVariableAllowListCache: () => clearVariableAllowListCache,
+  hasRecordContextParams: () => hasRecordContextParams,
+  resolveFlowModelNodeFromRequestRd: () => resolveFlowModelNodeFromRequestRd,
+  sanitizeContextParams: () => sanitizeContextParams
+});
+module.exports = __toCommonJS(allow_list_exports);
+var import_utils = require("@nocobase/utils");
+var import_variable_expression = require("../template/variable-expression");
+var import_record_bindings = require("./record-bindings");
+var import_record_slot_policy = require("./record-slot-policy");
+var import_registry = require("./registry");
+var import_runjs_variable_dependencies = require("./runjs-variable-dependencies");
+function analyzeVariableTemplateSafely(template, options = {}) {
+  let analysis;
+  try {
+    analysis = (0, import_variable_expression.analyzeVariableTemplate)(template, options);
+  } catch (error) {
+    return { ok: false, errorType: error instanceof Error ? error.name : typeof error };
+  }
+  return { ok: true, analysis };
+}
+const MAX_FLOW_MODEL_ANCESTORS = 64;
+function clearVariableAllowListCache(app) {
+  return app;
+}
+function isObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isRecordParams(value) {
+  return isObject(value) && typeof value.collection === "string" && Object.prototype.hasOwnProperty.call(value, "filterByTk") && (typeof value.dataSourceKey === "undefined" || typeof value.dataSourceKey === "string") && (typeof value.associationName === "undefined" || typeof value.associationName === "string") && (typeof value.fields === "undefined" || Array.isArray(value.fields) && value.fields.every((field) => typeof field === "string")) && (typeof value.appends === "undefined" || Array.isArray(value.appends) && value.appends.every((append) => typeof append === "string"));
+}
+function hasRecordContextParams(value) {
+  if (isRecordParams(value)) return true;
+  if (Array.isArray(value)) return value.some((item) => hasRecordContextParams(item));
+  if (!isObject(value)) return false;
+  return Object.values(value).some((item) => hasRecordContextParams(item));
+}
+function sanitizeContextParams(value = {}) {
+  const sanitizeStringArray = (input) => Array.isArray(input) && input.every((item) => typeof item === "string") ? input : void 0;
+  const sanitize = (input) => {
+    if (isRecordParams(input)) {
+      const { associationName, collection, filterByTk, dataSourceKey, sourceId } = input;
+      const fields = sanitizeStringArray(input.fields);
+      const appends = sanitizeStringArray(input.appends);
+      return {
+        associationName,
+        collection,
+        filterByTk,
+        dataSourceKey,
+        sourceId,
+        ...fields ? { fields } : {},
+        ...appends ? { appends } : {}
+      };
+    }
+    if (Array.isArray(input)) return input.map((item) => sanitize(item));
+    if (!isObject(input)) return input;
+    const output = {};
+    for (const [key, child] of Object.entries(input)) output[key] = sanitize(child);
+    return output;
+  };
+  return sanitize(value);
+}
+function getRequestState(ctx) {
+  const request = ctx;
+  if (!request.state) request.state = {};
+  return request.state;
+}
+function getFlowModelRepository(ctx) {
+  return ctx.db.getCollection("flowModels").repository;
+}
+async function getFlowModelNode(ctx, flowModelUid) {
+  const state = getRequestState(ctx);
+  const cacheKey = "__variableResolveFlowModelCache";
+  const cache = state[cacheKey] || /* @__PURE__ */ new Map();
+  state[cacheKey] = cache;
+  if (cache.has(flowModelUid)) return await cache.get(flowModelUid) || null;
+  const load = getFlowModelRepository(ctx).findModelNodeSnapshotById(flowModelUid);
+  cache.set(flowModelUid, load);
+  const model = await load;
+  cache.set(flowModelUid, model);
+  return model;
+}
+async function loadFlowModelAncestors(ctx, currentNode) {
+  const ancestors = [];
+  const seen = /* @__PURE__ */ new Set([currentNode.uid]);
+  let parentId = currentNode.parentId;
+  while (parentId) {
+    if (seen.has(parentId) || ancestors.length >= MAX_FLOW_MODEL_ANCESTORS) {
+      throw new Error("Invalid FlowModel ancestor chain");
+    }
+    seen.add(parentId);
+    const parent = await getFlowModelNode(ctx, parentId);
+    if (!parent) throw new Error("Missing FlowModel ancestor");
+    ancestors.push(parent);
+    parentId = parent.parentId;
+  }
+  return Object.freeze(ancestors);
+}
+function createRecordSlotCompilerOptions(ctx, currentNode) {
+  let ancestors;
+  return {
+    app: ctx.app,
+    ctx,
+    currentNode,
+    getCollection: (dataSourceKey, collection) => {
+      var _a, _b, _c;
+      return dataSourceKey === "main" ? ctx.db.getCollection(collection) : (_c = (_b = (_a = ctx.app.dataSourceManager.get(dataSourceKey)) == null ? void 0 : _a.collectionManager) == null ? void 0 : _b.getCollection) == null ? void 0 : _c.call(_b, collection);
+    },
+    loadAncestors: currentNode ? () => {
+      ancestors ||= loadFlowModelAncestors(ctx, currentNode);
+      return ancestors;
+    } : void 0
+  };
+}
+async function getFlowModelVariableContract(ctx, flowModelUid) {
+  const state = getRequestState(ctx);
+  const cacheKey = "__variableResolveContractCache";
+  const cache = state[cacheKey] || /* @__PURE__ */ new Map();
+  state[cacheKey] = cache;
+  if (cache.has(flowModelUid)) return await cache.get(flowModelUid) || null;
+  const load = createFlowModelVariableContractFromNode(ctx, flowModelUid);
+  cache.set(flowModelUid, load);
+  const contract = await load;
+  cache.set(flowModelUid, contract);
+  return contract;
+}
+async function createFlowModelVariableContractFromNode(ctx, flowModelUid) {
+  const node = await getFlowModelNode(ctx, flowModelUid);
+  if (!node) return null;
+  const prepared = (0, import_runjs_variable_dependencies.prepareFlowModelVariableSource)(node.options);
+  const contractSource = prepared.ok ? prepared.runJsTemplates.length ? [prepared.templateSource, ...prepared.runJsTemplates] : prepared.templateSource : {};
+  const result = analyzeVariableTemplateSafely(contractSource, { mode: "flow-model" });
+  const analysis = result.ok ? result.analysis : (0, import_variable_expression.analyzeVariableTemplate)({}, { mode: "flow-model" });
+  return await (0, import_record_slot_policy.createFlowModelVariableContract)(analysis, createRecordSlotCompilerOptions(ctx, node));
+}
+function getCurrentRoleNames(ctx) {
+  const state = ctx.state;
+  const roleNames = /* @__PURE__ */ new Set();
+  const currentRoles = state == null ? void 0 : state.currentRoles;
+  if (Array.isArray(currentRoles)) {
+    currentRoles.forEach((roleName) => {
+      if (typeof roleName === "string" && roleName) roleNames.add(roleName);
+    });
+  }
+  if (typeof (state == null ? void 0 : state.currentRole) === "string" && state.currentRole) roleNames.add(state.currentRole);
+  return Array.from(roleNames);
+}
+async function readCurrentRoleAllowsConfigure(ctx) {
+  const roleNames = getCurrentRoleNames(ctx);
+  if (!roleNames.length) return false;
+  if (roleNames.includes("root")) return true;
+  const acl = ctx.app.acl;
+  if (roleNames.some((roleName) => {
+    var _a, _b, _c, _d;
+    return ((_d = (_c = (_b = (_a = acl == null ? void 0 : acl.getRole) == null ? void 0 : _a.call(acl, roleName)) == null ? void 0 : _b.getStrategy) == null ? void 0 : _c.call(_b)) == null ? void 0 : _d.allowConfigure) === true;
+  })) return true;
+  const roles = await ctx.db.getRepository("roles").find({
+    filter: { name: roleNames },
+    fields: ["name", "allowConfigure"]
+  });
+  return roles.some(
+    (role) => typeof (role == null ? void 0 : role.get) === "function" ? role.get("allowConfigure") === true : (role == null ? void 0 : role.allowConfigure) === true
+  );
+}
+async function currentRoleAllowsConfigure(ctx) {
+  const state = getRequestState(ctx);
+  const cacheKey = "__variableResolveRoleAllowsConfigure";
+  const cached = state[cacheKey];
+  if (typeof cached === "boolean") return cached;
+  if (cached instanceof Promise) return await cached;
+  const pending = readCurrentRoleAllowsConfigure(ctx);
+  state[cacheKey] = pending;
+  const allowed = await pending;
+  state[cacheKey] = allowed;
+  return allowed;
+}
+function getRequestBearerToken(ctx) {
+  var _a, _b;
+  const contextWithBearerToken = ctx;
+  const token = (_a = contextWithBearerToken.getBearerToken) == null ? void 0 : _a.call(contextWithBearerToken);
+  if (token) return token;
+  const authorization = typeof ctx.get === "function" ? ctx.get("authorization") || ctx.get("Authorization") : void 0;
+  if (typeof authorization !== "string") return "";
+  return ((_b = authorization.match(/^Bearer\s+(.+)$/i)) == null ? void 0 : _b[1]) || "";
+}
+function getCurrentRequestRdSessionId(ctx) {
+  const state = getRequestState(ctx);
+  const cacheKey = "__variableResolveRdSessionId";
+  const cached = state[cacheKey];
+  if (typeof cached === "string") return cached;
+  const sessionId = (0, import_utils.getFlowModelRdSessionId)((0, import_utils.decodeJwtSessionPayload)(getRequestBearerToken(ctx)));
+  state[cacheKey] = sessionId;
+  return sessionId;
+}
+function resolveFlowModelUidFromRequestRd(ctx, rd) {
+  if (typeof rd !== "string" || !rd) return "";
+  const state = getRequestState(ctx);
+  const cacheKey = "__variableResolveRdUidCache";
+  const cache = state[cacheKey] || /* @__PURE__ */ new Map();
+  state[cacheKey] = cache;
+  if (cache.has(rd)) return cache.get(rd) || "";
+  const flowModelUid = (0, import_utils.resolveFlowModelUidFromRd)(rd, getCurrentRequestRdSessionId(ctx)) || "";
+  cache.set(rd, flowModelUid);
+  return flowModelUid;
+}
+async function resolveFlowModelNodeFromRequestRd(ctx, rd) {
+  const flowModelUid = resolveFlowModelUidFromRequestRd(ctx, rd);
+  return flowModelUid ? getFlowModelNode(ctx, flowModelUid) : null;
+}
+function createPolicy(allowAll = false, allowedPaths = /* @__PURE__ */ new Set(), unrestrictedVariables = /* @__PURE__ */ new Set()) {
+  return { allowAll, allowedPaths, unrestrictedVariables };
+}
+function denied(analysis, contextParams, policy, recordSlotPolicies, flowModelUid) {
+  return { allowed: false, analysis, contextParams, flowModelUid, policy, recordSlotPolicies };
+}
+async function createRecordBindingPlan(ctx, contextParams, usage, recordSlotPolicies) {
+  return await (0, import_record_bindings.planRecordBindings)({ contextParams, koaCtx: ctx, policies: recordSlotPolicies, usage });
+}
+function recordBindingPlanAllowed(plan) {
+  return plan.rejections.length === 0 && plan.bindings.every(import_registry.isSafeRecordBinding);
+}
+async function authorizeVariablesResolve(ctx, options) {
+  var _a;
+  let contextParams = sanitizeContextParams(options.contextParams || {});
+  const flowModelUid = resolveFlowModelUidFromRequestRd(ctx, options.rd);
+  const unrestrictedVariables = /* @__PURE__ */ new Set();
+  let policy = createPolicy(false, /* @__PURE__ */ new Set(), unrestrictedVariables);
+  let recordSlotPolicies = /* @__PURE__ */ new Map();
+  const result = analyzeVariableTemplateSafely(options.template, { mode: "untrusted-request" });
+  if (!result.ok) {
+    contextParams = sanitizeContextParams((0, import_registry.sanitizeRegisteredVariableContextParams)(contextParams));
+    return {
+      allowed: false,
+      contextParams: (await createRecordBindingPlan(ctx, contextParams, {})).contextParams,
+      flowModelUid: flowModelUid || void 0,
+      policy,
+      recordSlotPolicies
+    };
+  }
+  const { analysis } = result;
+  if (!analysis.supported) {
+    contextParams = sanitizeContextParams((0, import_registry.sanitizeRegisteredVariableContextParams)(contextParams));
+    return denied(
+      analysis,
+      (await createRecordBindingPlan(ctx, contextParams, analysis.usage)).contextParams,
+      policy,
+      recordSlotPolicies,
+      flowModelUid || void 0
+    );
+  }
+  const flowModelRequiredVars = /* @__PURE__ */ new Set();
+  for (const [varName, usedPaths] of Object.entries(analysis.usage)) {
+    const def = import_registry.variables.get(varName);
+    const validation = await ((_a = def == null ? void 0 : def.validateContextParams) == null ? void 0 : _a.call(def, {
+      contextParams,
+      flowModelUid: flowModelUid || void 0,
+      koaCtx: ctx,
+      usage: usedPaths,
+      varName
+    })) || {};
+    contextParams = sanitizeContextParams((validation == null ? void 0 : validation.contextParams) || contextParams);
+    if ((validation == null ? void 0 : validation.allowed) === false) {
+      contextParams = sanitizeContextParams((0, import_registry.sanitizeRegisteredVariableContextParams)(contextParams));
+      return denied(
+        analysis,
+        (await createRecordBindingPlan(ctx, contextParams, analysis.usage)).contextParams,
+        policy,
+        recordSlotPolicies,
+        flowModelUid || void 0
+      );
+    }
+    if ((validation == null ? void 0 : validation.requireFlowModel) === false) unrestrictedVariables.add(varName);
+    else flowModelRequiredVars.add(varName);
+  }
+  contextParams = sanitizeContextParams((0, import_registry.sanitizeRegisteredVariableContextParams)(contextParams));
+  let bindingPlan = await createRecordBindingPlan(ctx, contextParams, analysis.usage);
+  const configureRole = await currentRoleAllowsConfigure(ctx);
+  const currentNode = flowModelUid ? await getFlowModelNode(ctx, flowModelUid) : null;
+  if (configureRole) {
+    policy = createPolicy(true, /* @__PURE__ */ new Set(), unrestrictedVariables);
+    recordSlotPolicies = await (0, import_record_slot_policy.compileRecordSlotPolicies)(
+      analysis,
+      createRecordSlotCompilerOptions(ctx, currentNode || void 0)
+    );
+    bindingPlan = await createRecordBindingPlan(ctx, contextParams, analysis.usage, recordSlotPolicies);
+    return recordBindingPlanAllowed(bindingPlan) ? {
+      allowed: true,
+      analysis,
+      bindingPlan,
+      contextParams: bindingPlan.contextParams,
+      ...currentNode ? { flowModelUid: currentNode.uid } : {},
+      policy,
+      recordSlotPolicies
+    } : denied(analysis, bindingPlan.contextParams, policy, recordSlotPolicies, flowModelUid || void 0);
+  }
+  if (flowModelRequiredVars.size > 0 && !flowModelUid) {
+    return denied(analysis, bindingPlan.contextParams, policy, recordSlotPolicies);
+  }
+  const contract = flowModelUid ? await getFlowModelVariableContract(ctx, flowModelUid) : null;
+  const allowedPaths = (contract == null ? void 0 : contract.allowedPaths) || null;
+  recordSlotPolicies = (contract == null ? void 0 : contract.recordSlots) || /* @__PURE__ */ new Map();
+  policy = createPolicy(false, allowedPaths || /* @__PURE__ */ new Set(), unrestrictedVariables);
+  if (flowModelRequiredVars.size > 0 && !allowedPaths) {
+    return denied(analysis, bindingPlan.contextParams, policy, recordSlotPolicies, flowModelUid || void 0);
+  }
+  for (const path of analysis.paths) {
+    if (unrestrictedVariables.has(path.varName)) continue;
+    if (!(allowedPaths == null ? void 0 : allowedPaths.has(path.canonicalKey))) {
+      return denied(analysis, bindingPlan.contextParams, policy, recordSlotPolicies, flowModelUid || void 0);
+    }
+  }
+  if (unrestrictedVariables.size) {
+    const requestPolicies = await (0, import_record_slot_policy.compileRecordSlotPolicies)(
+      analysis,
+      createRecordSlotCompilerOptions(ctx, currentNode || void 0)
+    );
+    const mergedPolicies = new Map(recordSlotPolicies);
+    for (const path of analysis.paths) {
+      if (!unrestrictedVariables.has(path.varName)) continue;
+      const requestPolicy = requestPolicies.get(path.canonicalKey);
+      if (requestPolicy) mergedPolicies.set(path.canonicalKey, requestPolicy);
+    }
+    recordSlotPolicies = mergedPolicies;
+  }
+  bindingPlan = await createRecordBindingPlan(ctx, contextParams, analysis.usage, recordSlotPolicies);
+  return recordBindingPlanAllowed(bindingPlan) ? {
+    allowed: true,
+    analysis,
+    bindingPlan,
+    contextParams: bindingPlan.contextParams,
+    flowModelUid: flowModelUid || void 0,
+    policy,
+    recordSlotPolicies
+  } : denied(analysis, bindingPlan.contextParams, policy, recordSlotPolicies, flowModelUid || void 0);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  analyzeVariableTemplateSafely,
+  authorizeVariablesResolve,
+  clearVariableAllowListCache,
+  hasRecordContextParams,
+  resolveFlowModelNodeFromRequestRd,
+  sanitizeContextParams
+});

package/dist/server/variables/form-item-record-slot-resolvers.d.ts

@@ -0,0 +1,10 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import type { RecordSlotResolverRegistration } from './record-slot-resolvers';
+export declare function createFormItemRecordSlotResolvers(): readonly RecordSlotResolverRegistration[];