@nocobase/plugin-public-forms 2.2.0-beta.13 → 2.2.0-beta.14

package/dist/externalVersion.js

@@ -8,12 +8,13 @@
  */
 
 module.exports = {
-  "@nocobase/client": "2.2.0-beta.13",
+  "@nocobase/client": "2.2.0-beta.14",
   "react-i18next": "11.18.6",
-  "@nocobase/flow-engine": "2.2.0-beta.13",
-  "@nocobase/client-v2": "2.2.0-beta.13",
-  "@nocobase/plugin-ui-schema-storage": "2.2.0-beta.13",
-  "@nocobase/server": "2.2.0-beta.13",
+  "@nocobase/flow-engine": "2.2.0-beta.14",
+  "@nocobase/client-v2": "2.2.0-beta.14",
+  "@nocobase/plugin-ui-schema-storage": "2.2.0-beta.14",
+  "@nocobase/server": "2.2.0-beta.14",
+  "@nocobase/utils": "2.2.0-beta.14",
   "react": "18.2.0",
   "@ant-design/icons": "5.6.1",
   "antd": "5.24.2",
@@ -26,6 +27,6 @@ module.exports = {
   "@formily/core": "2.3.7",
   "@formily/shared": "2.3.7",
   "@formily/reactive": "2.3.7",
-  "@nocobase/database": "2.2.0-beta.13",
+  "@nocobase/database": "2.2.0-beta.14",
   "dayjs": "1.11.13"
 };

package/dist/server/plugin.d.ts

@@ -7,8 +7,27 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 import { Plugin } from '@nocobase/server';
+type PublicFormTokenPayload = {
+    collectionName: string;
+    formKey: string;
+    targetCollections: string[];
+    exp?: number;
+};
+type PublicFormCookiePayload = PublicFormTokenPayload & {
+    v: 1;
+    appName?: string;
+    files: Record<string, Array<string | number>>;
+};
+type FileAccessAuthorizeParams = {
+    appName: string;
+    dataSourceKey: string;
+    collectionName: string;
+    id: string;
+    preview: boolean;
+};
 export declare class PluginPublicFormsServer extends Plugin {
     protected associationFieldTypes: string[];
+    protected fileAccessAuthorizerRegistered: boolean;
     parseCollectionData(dataSourceKey: any, formCollection: any, appends: any): Promise<any[]>;
     getFlowModelTree(uid: string, options?: {
         includeAsyncNode?: boolean;
@@ -45,10 +64,17 @@ export declare class PluginPublicFormsServer extends Plugin {
         title: any;
         passwordRequired?: undefined;
     }>;
+    getPublicFormCookieName(formKey: string): string;
+    decodePublicFormCookie(value?: string | null): Promise<PublicFormCookiePayload | null>;
+    readPublicFormCookie(ctx: any, formKey: string): Promise<PublicFormCookiePayload>;
+    setPublicFormCookie(ctx: any, payload: PublicFormCookiePayload, maxAge?: number): void;
     getPublicFormsMeta: (ctx: any, next: any) => Promise<void>;
     getPublicFormFlowModel: (ctx: any, next: any) => Promise<void>;
     parseToken: (ctx: any, next: any) => Promise<any>;
     parseACL: (ctx: any, next: any) => Promise<any>;
+    appendUploadedFileToPublicFormCookie: (ctx: any, next: any) => Promise<void>;
+    authorizePublicFormFileAccess: (ctx: any, params: FileAccessAuthorizeParams) => Promise<boolean>;
+    registerFileAccessAuthorizer(): void;
     load(): Promise<void>;
     install(): Promise<void>;
     afterEnable(): Promise<void>;

package/dist/server/plugin.js

@@ -7,9 +7,11 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -23,6 +25,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var plugin_exports = {};
 __export(plugin_exports, {
@@ -31,11 +41,66 @@ __export(plugin_exports, {
 });
 module.exports = __toCommonJS(plugin_exports);
 var import_server = require("@nocobase/server");
+var import_utils = require("@nocobase/utils");
+var import_crypto = __toESM(require("crypto"));
 var import_hook = require("./hook");
 class PasswordError extends Error {
 }
+const PUBLIC_FORM_COOKIE_PREFIX = "nb_pf_";
+const PUBLIC_FORM_TOKEN_EXPIRES_IN = "1h";
+const PUBLIC_FORM_COOKIE_MAX_AGE = 60 * 60 * 1e3;
+function parseCookieHeader(header) {
+  const cookies = [];
+  if (!header) {
+    return cookies;
+  }
+  for (const item of header.split(";")) {
+    const index = item.indexOf("=");
+    if (index < 0) {
+      continue;
+    }
+    const name = item.slice(0, index).trim();
+    const value = item.slice(index + 1).trim();
+    if (!name) {
+      continue;
+    }
+    try {
+      cookies.push([name, decodeURIComponent(value)]);
+    } catch {
+      cookies.push([name, value]);
+    }
+  }
+  return cookies;
+}
+function normalizeFiles(value) {
+  const files = {};
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return files;
+  }
+  for (const [key, ids] of Object.entries(value)) {
+    if (typeof key !== "string" || !Array.isArray(ids)) {
+      continue;
+    }
+    files[key] = ids.filter((id) => typeof id === "string" || typeof id === "number");
+  }
+  return files;
+}
+function getResponseRecordId(body) {
+  const responseBody = body && typeof body === "object" && "data" in body ? body.data : body;
+  if (!responseBody || typeof responseBody !== "object") {
+    return null;
+  }
+  if ("get" in responseBody && typeof responseBody.get === "function") {
+    return responseBody.get("id");
+  }
+  if ("id" in responseBody) {
+    return responseBody.id;
+  }
+  return null;
+}
 class PluginPublicFormsServer extends import_server.Plugin {
   associationFieldTypes = ["hasOne", "hasMany", "belongsTo", "belongsToMany", "belongsToArray"];
+  fileAccessAuthorizerRegistered = false;
   async parseCollectionData(dataSourceKey, formCollection, appends) {
     const dataSource = this.app.dataSourceManager.dataSources.get(dataSourceKey);
     const serializeCollection = (collection2) => ({
@@ -223,33 +288,92 @@ class PluginPublicFormsServer extends import_server.Plugin {
       ])
     ];
     const collections = await this.parseCollectionData(dataSourceKey, collectionName, appends);
+    const tokenPayload = {
+      collectionName,
+      formKey: filterByTk,
+      targetCollections: appends
+    };
     return {
       dataSource: {
         key: dataSourceKey,
         displayName: dataSourceKey,
         collections
       },
-      token: this.app.authManager.jwt.sign(
-        {
-          collectionName,
-          formKey: filterByTk,
-          targetCollections: appends
-        },
-        {
-          expiresIn: "1h"
-        }
-      ),
+      token: this.app.authManager.jwt.sign(tokenPayload, {
+        expiresIn: PUBLIC_FORM_TOKEN_EXPIRES_IN
+      }),
       schema,
       flowModel,
       title
     };
   }
+  getPublicFormCookieName(formKey) {
+    const appName = this.app.name || "main";
+    const hash = import_crypto.default.createHash("sha256").update(`${appName}:${formKey}`).digest("hex").slice(0, 32);
+    return `${PUBLIC_FORM_COOKIE_PREFIX}${hash}`;
+  }
+  async decodePublicFormCookie(value) {
+    if (!value) {
+      return null;
+    }
+    const decoded = await this.app.authManager.jwt.decode(value);
+    if ((decoded == null ? void 0 : decoded.v) !== 1 || typeof decoded.formKey !== "string" || typeof decoded.collectionName !== "string" || !Array.isArray(decoded.targetCollections)) {
+      return null;
+    }
+    return {
+      v: 1,
+      appName: typeof decoded.appName === "string" ? decoded.appName : void 0,
+      formKey: decoded.formKey,
+      collectionName: decoded.collectionName,
+      targetCollections: decoded.targetCollections.filter((name) => typeof name === "string"),
+      files: normalizeFiles(decoded.files),
+      exp: typeof decoded.exp === "number" ? decoded.exp : void 0
+    };
+  }
+  async readPublicFormCookie(ctx, formKey) {
+    var _a;
+    try {
+      return await this.decodePublicFormCookie((_a = ctx.cookies) == null ? void 0 : _a.get(this.getPublicFormCookieName(formKey)));
+    } catch {
+      return null;
+    }
+  }
+  setPublicFormCookie(ctx, payload, maxAge = PUBLIC_FORM_COOKIE_MAX_AGE) {
+    var _a;
+    (_a = ctx.cookies) == null ? void 0 : _a.set(
+      this.getPublicFormCookieName(payload.formKey),
+      this.app.authManager.jwt.sign(
+        {
+          v: 1,
+          appName: this.app.name || "main",
+          formKey: payload.formKey,
+          collectionName: payload.collectionName,
+          targetCollections: payload.targetCollections,
+          files: normalizeFiles(payload.files)
+        },
+        { expiresIn: Math.max(1, Math.floor(maxAge / 1e3)) }
+      ),
+      (0, import_utils.getAuthCookieOptions)(ctx, true, maxAge)
+    );
+  }
   // TODO
   getPublicFormsMeta = async (ctx, next) => {
+    var _a;
     const token = ctx.get("X-Form-Token");
     const { filterByTk, password } = ctx.action.params;
     try {
+      const existingCookie = password === void 0 ? await this.readPublicFormCookie(ctx, filterByTk) : null;
       ctx.body = await this.getMetaByTk(filterByTk, { password, token });
+      if (((_a = ctx.body) == null ? void 0 : _a.token) && (password !== void 0 || !existingCookie)) {
+        const tokenPayload = await this.app.authManager.jwt.decode(ctx.body.token);
+        this.setPublicFormCookie(ctx, {
+          v: 1,
+          formKey: tokenPayload.formKey,
+          collectionName: tokenPayload.collectionName,
+          targetCollections: tokenPayload.targetCollections,
+          files: (existingCookie == null ? void 0 : existingCookie.formKey) === tokenPayload.formKey ? existingCookie.files : {}
+        });
+      }
     } catch (error) {
       if (error instanceof PasswordError) {
         ctx.throw(401, error.message);
@@ -285,7 +409,8 @@ class PluginPublicFormsServer extends import_server.Plugin {
         ctx.PublicForm = {
           collectionName: tokenData.collectionName,
           formKey: tokenData.formKey,
-          targetCollections: tokenData.targetCollections
+          targetCollections: tokenData.targetCollections,
+          exp: tokenData.exp
         };
         const publicForms = this.db.getRepository("publicForms");
         const instance = await publicForms.findOne({
@@ -320,13 +445,100 @@ class PluginPublicFormsServer extends import_server.Plugin {
       ctx.permission = {
         skip: true
       };
-    } else if (["list", "get"].includes(actionName) && ctx.PublicForm["targetCollections"].includes(resourceName) || (collection == null ? void 0 : collection.options.template) === "file" && actionName === "create" || resourceName === "storages" && ["getBasicInfo", "createPresignedUrl", "check"].includes(actionName) || resourceName === "vditor" && ["check"].includes(actionName) || resourceName === "map-configuration" && actionName === "get") {
+    } else if (["list", "get"].includes(actionName) && ctx.PublicForm["targetCollections"].includes(resourceName) || (collection == null ? void 0 : collection.options.template) === "file" && ["create", "upload"].includes(actionName) || resourceName === "storages" && ["getBasicInfo", "createPresignedUrl", "check"].includes(actionName) || resourceName === "vditor" && ["check"].includes(actionName) || resourceName === "map-configuration" && actionName === "get") {
       ctx.permission = {
         skip: true
       };
     }
     await next();
   };
+  appendUploadedFileToPublicFormCookie = async (ctx, next) => {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
+    await next();
+    if (!ctx.PublicForm || !["create", "upload"].includes((_a = ctx.action) == null ? void 0 : _a.actionName)) {
+      return;
+    }
+    const collection = ((_c = (_b = ctx.dataSource) == null ? void 0 : _b.collectionManager) == null ? void 0 : _c.getCollection(ctx.action.resourceName)) || ((_e = (_d = ctx.db) == null ? void 0 : _d.getCollection) == null ? void 0 : _e.call(_d, ctx.action.resourceName));
+    if (((_f = collection == null ? void 0 : collection.options) == null ? void 0 : _f.template) !== "file") {
+      return;
+    }
+    const id = getResponseRecordId(ctx.body);
+    if (id === null || id === void 0 || id === "") {
+      return;
+    }
+    const formKey = ctx.PublicForm.formKey;
+    const existingCookie = await this.readPublicFormCookie(ctx, formKey);
+    const files = normalizeFiles(existingCookie == null ? void 0 : existingCookie.files);
+    const dataSourceKey = ((_g = ctx.dataSource) == null ? void 0 : _g.name) || ((_h = ctx.action.params) == null ? void 0 : _h.dataSourceKey) || "main";
+    const fileKey = `${dataSourceKey}/${collection.name}`;
+    const ids = files[fileKey] || [];
+    if (!ids.some((existingId) => String(existingId) === String(id))) {
+      ids.push(id);
+    }
+    files[fileKey] = ids;
+    const expiresAt = (existingCookie == null ? void 0 : existingCookie.exp) || ctx.PublicForm.exp;
+    const maxAge = expiresAt ? expiresAt * 1e3 - Date.now() : PUBLIC_FORM_COOKIE_MAX_AGE;
+    if (maxAge <= 0) {
+      return;
+    }
+    this.setPublicFormCookie(
+      ctx,
+      {
+        v: 1,
+        formKey,
+        collectionName: ctx.PublicForm.collectionName,
+        targetCollections: ctx.PublicForm.targetCollections || [],
+        files
+      },
+      maxAge
+    );
+  };
+  authorizePublicFormFileAccess = async (ctx, params) => {
+    var _a, _b;
+    const cookies = parseCookieHeader((_a = ctx.get) == null ? void 0 : _a.call(ctx, "cookie"));
+    const fileKey = `${params.dataSourceKey}/${params.collectionName}`;
+    for (const [name, value] of cookies) {
+      if (!name.startsWith(PUBLIC_FORM_COOKIE_PREFIX)) {
+        continue;
+      }
+      try {
+        const payload = await this.decodePublicFormCookie(value);
+        if (!payload) {
+          continue;
+        }
+        if (payload.appName && payload.appName !== params.appName) {
+          continue;
+        }
+        if ((_b = payload.files[fileKey]) == null ? void 0 : _b.some((id) => String(id) === String(params.id))) {
+          const instance = await this.db.getRepository("publicForms").findOne({
+            filter: {
+              key: payload.formKey
+            }
+          });
+          if (instance == null ? void 0 : instance.get("enabled")) {
+            return true;
+          }
+        }
+      } catch {
+        continue;
+      }
+    }
+    return false;
+  };
+  registerFileAccessAuthorizer() {
+    if (this.fileAccessAuthorizerRegistered) {
+      return;
+    }
+    const fileManager = this.app.pm.get("file-manager") || this.app.pm.get("@nocobase/plugin-file-manager");
+    if (typeof (fileManager == null ? void 0 : fileManager.registerFileAccessAuthorizer) !== "function") {
+      return;
+    }
+    fileManager.registerFileAccessAuthorizer({
+      name: "public-forms",
+      authorize: this.authorizePublicFormFileAccess
+    });
+    this.fileAccessAuthorizerRegistered = true;
+  }
   async load() {
     this.app.acl.registerSnippet({
       name: `pm.${this.name}`,
@@ -337,10 +549,17 @@ class PluginPublicFormsServer extends import_server.Plugin {
       "publicForms:getMeta": this.getPublicFormsMeta,
       "publicForms:getFlowModel": this.getPublicFormFlowModel
     });
+    this.registerFileAccessAuthorizer();
+    this.app.on("afterLoad", () => {
+      this.registerFileAccessAuthorizer();
+    });
     this.app.dataSourceManager.afterAddDataSource((dataSource) => {
       dataSource.resourceManager.use(this.parseToken, {
         before: "auth"
       });
+      dataSource.resourceManager.use(this.appendUploadedFileToPublicFormCookie, {
+        after: "acl"
+      });
       dataSource.acl.use(this.parseACL, {
         before: "core"
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/plugin-public-forms",
-  "version": "2.2.0-beta.13",
+  "version": "2.2.0-beta.14",
   "main": "dist/server/index.js",
   "displayName": "Public forms",
   "displayName.ru-RU": "Публичные формы",
@@ -20,10 +20,11 @@
     "@nocobase/plugin-flow-engine": "2.x",
     "@nocobase/plugin-ui-schema-storage": "2.x",
     "@nocobase/server": "2.x",
-    "@nocobase/test": "2.x"
+    "@nocobase/test": "2.x",
+    "@nocobase/utils": "2.x"
   },
   "devDependencies": {
     "react-device-detect": "2.2.3"
   },
-  "gitHead": "8fff12b34f41f4336075cdafcc700ec694f9b78a"
+  "gitHead": "1ef021f3ce0a84469e40f181a19551a50b6f850c"
 }