@nocobase/portal-template-default 1.0.0 → 1.0.1

package/src/lib/nocobase/client.ts

@@ -0,0 +1,262 @@
+import {
+  API_ORIGIN,
+  API_URL,
+  NOCOBASE_AUTHENTICATOR,
+  NOCOBASE_ROLE_KEY,
+  NOCOBASE_TOKEN_KEY,
+} from "@/providers/constants";
+import { getNocoBaseErrorMessage, NocoBaseHttpError } from "./error";
+
+type QueryValue =
+  | string
+  | number
+  | boolean
+  | null
+  | undefined
+  | Array<string | number | boolean>;
+
+export type NocoBaseRequestOptions = {
+  method?: "GET" | "POST" | "PUT" | "DELETE";
+  query?: Record<string, QueryValue>;
+  body?: unknown;
+  signal?: AbortSignal;
+  token?: string;
+  role?: string;
+  includeRole?: boolean;
+  includeAuthenticator?: boolean;
+  withAclMeta?: boolean;
+  headers?: Record<string, string>;
+  accept?: "json" | "stream";
+  unwrap?: "data" | "deep-data" | "none";
+};
+
+const getClientLocale = () =>
+  typeof navigator === "undefined" ? undefined : navigator.language;
+
+const getClientTimezone = () => {
+  const offsetMinutes = -new Date().getTimezoneOffset();
+  const sign = offsetMinutes >= 0 ? "+" : "-";
+  const absoluteMinutes = Math.abs(offsetMinutes);
+  const hours = String(Math.floor(absoluteMinutes / 60)).padStart(2, "0");
+  const minutes = String(absoluteMinutes % 60).padStart(2, "0");
+  return `${sign}${hours}:${minutes}`;
+};
+
+const unwrapPayload = (
+  payload: unknown,
+  mode: NocoBaseRequestOptions["unwrap"]
+) => {
+  if (mode === "none") return payload;
+  if (!payload || typeof payload !== "object") return payload;
+  const data = (payload as { data?: unknown }).data;
+  if (mode === "deep-data" && data && typeof data === "object") {
+    return (data as { data?: unknown }).data ?? data;
+  }
+  return data ?? payload;
+};
+
+export class NocoBaseClient {
+  private readonly apiOrigin?: string;
+
+  constructor(
+    private readonly apiUrl = API_URL,
+    apiOrigin = getUrlOrigin(apiUrl) ?? API_ORIGIN
+  ) {
+    this.apiOrigin = apiOrigin;
+  }
+
+  getApiUrl() {
+    return this.apiUrl;
+  }
+
+  resolveUrl(value: string) {
+    if (!value || /^[a-z][a-z\d+.-]*:/i.test(value)) return value;
+    const base =
+      this.apiOrigin ??
+      (typeof window === "undefined" ? undefined : window.location.origin);
+    if (!base) return value;
+    try {
+      return new URL(value, `${base.replace(/\/$/, "")}/`).toString();
+    } catch {
+      return value;
+    }
+  }
+
+  getToken() {
+    return (
+      (typeof localStorage === "undefined"
+        ? undefined
+        : localStorage.getItem(NOCOBASE_TOKEN_KEY) ?? undefined) ??
+      import.meta.env.NOCOBASE_API_TOKEN
+    );
+  }
+
+  setToken(token?: string | null) {
+    if (typeof localStorage === "undefined") return;
+    if (token) localStorage.setItem(NOCOBASE_TOKEN_KEY, token);
+    else localStorage.removeItem(NOCOBASE_TOKEN_KEY);
+  }
+
+  getRole() {
+    return typeof localStorage === "undefined"
+      ? undefined
+      : localStorage.getItem(NOCOBASE_ROLE_KEY) ?? undefined;
+  }
+
+  setRole(role?: string | null) {
+    if (typeof localStorage === "undefined") return;
+    if (role) localStorage.setItem(NOCOBASE_ROLE_KEY, role);
+    else localStorage.removeItem(NOCOBASE_ROLE_KEY);
+  }
+
+  buildUrl(endpoint: string, query?: Record<string, QueryValue>) {
+    const base = `${this.apiUrl.replace(/\/$/, "")}/${endpoint.replace(
+      /^\//,
+      ""
+    )}`;
+    const url = /^https?:\/\//.test(base)
+      ? new URL(base)
+      : new URL(base, window.location.origin);
+
+    for (const [key, value] of Object.entries(query ?? {})) {
+      if (value === undefined) continue;
+      if (Array.isArray(value)) {
+        value.forEach((item) => url.searchParams.append(key, String(item)));
+      } else if (value !== null) {
+        url.searchParams.set(key, String(value));
+      }
+    }
+    return url;
+  }
+
+  getHeaders({
+    token = this.getToken(),
+    role = this.getRole(),
+    includeRole = true,
+    includeAuthenticator = false,
+    withAclMeta = true,
+    headers,
+    accept = "json",
+    body,
+  }: Pick<
+    NocoBaseRequestOptions,
+    | "token"
+    | "role"
+    | "includeRole"
+    | "includeAuthenticator"
+    | "withAclMeta"
+    | "headers"
+    | "accept"
+    | "body"
+  > = {}) {
+    const locale = getClientLocale();
+    const formData =
+      typeof FormData !== "undefined" && body instanceof FormData;
+    return {
+      Accept: accept === "stream" ? "text/event-stream" : "application/json",
+      ...(body !== undefined && !formData
+        ? { "Content-Type": "application/json" }
+        : {}),
+      ...(accept === "stream"
+        ? { "Cache-Control": "no-cache", Pragma: "no-cache" }
+        : {}),
+      ...(includeAuthenticator
+        ? { "X-Authenticator": NOCOBASE_AUTHENTICATOR }
+        : {}),
+      ...(includeRole && role ? { "X-Role": role } : {}),
+      ...(withAclMeta ? { "X-With-ACL-Meta": "true" } : {}),
+      ...(locale ? { "X-Locale": locale } : {}),
+      "X-Timezone": getClientTimezone(),
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+      ...headers,
+    };
+  }
+
+  async request<T>(
+    endpoint: string,
+    options: NocoBaseRequestOptions = {}
+  ): Promise<T> {
+    const method =
+      options.method ?? (options.body === undefined ? "GET" : "POST");
+    const response = await fetch(this.buildUrl(endpoint, options.query), {
+      method,
+      headers: this.getHeaders({ ...options, body: options.body }),
+      body:
+        options.body === undefined
+          ? undefined
+          : options.body instanceof FormData
+          ? options.body
+          : JSON.stringify(options.body),
+      signal: options.signal,
+    });
+    this.captureRenewedToken(response);
+    const payload = await response.json().catch(() => undefined);
+    if (!response.ok) {
+      throw new NocoBaseHttpError({
+        status: response.status,
+        payload,
+        message: getNocoBaseErrorMessage(
+          payload,
+          `NocoBase request failed (${response.status})`
+        ),
+      });
+    }
+    return unwrapPayload(payload, options.unwrap ?? "data") as T;
+  }
+
+  action<T>(
+    resource: string,
+    action: string,
+    options: Omit<NocoBaseRequestOptions, "accept"> = {}
+  ) {
+    const method =
+      options.method ?? (["get", "list"].includes(action) ? "GET" : "POST");
+    return this.request<T>(`${resource}:${action}`, { ...options, method });
+  }
+
+  async stream(
+    endpoint: string,
+    options: Omit<NocoBaseRequestOptions, "accept" | "unwrap"> = {}
+  ) {
+    const response = await fetch(this.buildUrl(endpoint, options.query), {
+      method: options.method ?? "POST",
+      headers: this.getHeaders({
+        ...options,
+        accept: "stream",
+        body: options.body,
+      }),
+      body:
+        options.body === undefined ? undefined : JSON.stringify(options.body),
+      signal: options.signal,
+    });
+    this.captureRenewedToken(response);
+    if (!response.ok || !response.body) {
+      const payload = await response.json().catch(() => undefined);
+      throw new NocoBaseHttpError({
+        status: response.status,
+        payload,
+        message: getNocoBaseErrorMessage(
+          payload,
+          `NocoBase stream failed (${response.status})`
+        ),
+      });
+    }
+    return response.body;
+  }
+
+  private captureRenewedToken(response: Response) {
+    const token = response.headers.get("x-new-token");
+    if (token) this.setToken(token);
+  }
+}
+
+const getUrlOrigin = (value: string) => {
+  if (!/^https?:\/\//i.test(value)) return undefined;
+  try {
+    return new URL(value).origin;
+  } catch {
+    return undefined;
+  }
+};
+
+export const nocobaseClient = new NocoBaseClient();

package/src/lib/nocobase/error.ts

@@ -0,0 +1,32 @@
+export class NocoBaseHttpError extends Error {
+  readonly status: number;
+  readonly payload: unknown;
+
+  constructor({
+    message,
+    status,
+    payload,
+  }: {
+    message: string;
+    status: number;
+    payload?: unknown;
+  }) {
+    super(message);
+    this.name = "NocoBaseHttpError";
+    this.status = status;
+    this.payload = payload;
+  }
+}
+
+export const getNocoBaseErrorMessage = (payload: unknown, fallback: string) => {
+  if (!payload || typeof payload !== "object") return fallback;
+  const value = payload as {
+    message?: string;
+    error?: { message?: string };
+    errors?: Array<{ message?: string } | string>;
+    messages?: Array<{ message?: string } | string>;
+  };
+  const first = value.errors?.[0] ?? value.messages?.[0];
+  if (typeof first === "string") return first;
+  return first?.message ?? value.error?.message ?? value.message ?? fallback;
+};

package/src/providers/access-control.ts

@@ -0,0 +1,34 @@
+import type { AccessControlProvider } from "@refinedev/core";
+
+import {
+  canAccessWithSnapshot,
+  getAclSnapshot,
+  loadAcl,
+} from "@/lib/nocobase/acl";
+
+export const accessControlProvider: AccessControlProvider = {
+  can: async ({ resource, action, params }) => {
+    const snapshot = await loadAcl();
+    const can = canAccessWithSnapshot(snapshot, { resource, action, params });
+
+    return {
+      can,
+      reason: can
+        ? undefined
+        : "You don't have permission to perform this action.",
+    };
+  },
+  options: {
+    buttons: {
+      enableAccessControl: true,
+      hideIfUnauthorized: true,
+    },
+    queryOptions: {
+      staleTime: Infinity,
+    },
+  },
+};
+
+export const canAccessCurrentAcl = (
+  params: Parameters<typeof canAccessWithSnapshot>[1]
+) => canAccessWithSnapshot(getAclSnapshot(), params);

package/src/providers/auth.ts

@@ -1,10 +1,15 @@
 import type { AuthProvider } from "@refinedev/core";
 
+import { nocobaseClient } from "@/lib/nocobase/client";
 import {
-  AUTH_API_URL,
-  getNocoBaseHeaders,
-  NOCOBASE_TOKEN_KEY,
-} from "./constants";
+  clearAcl,
+  loadAcl,
+  type Role,
+} from "@/lib/nocobase/acl";
+import {
+  getNocoBaseErrorMessage,
+  NocoBaseHttpError,
+} from "@/lib/nocobase/error";
 
 type NocoBaseUser = {
   id: number | string;
@@ -12,6 +17,7 @@ type NocoBaseUser = {
   username?: string;
   email?: string;
   avatar?: string;
+  roles?: Role[];
 };
 
 type NocoBaseSignInResponse = {
@@ -29,18 +35,9 @@ const CURRENT_USER_CACHE_MS = 30_000;
 let currentUserCache: CurrentUserCache | undefined;
 let currentUserRequest: Promise<NocoBaseUser> | undefined;
 
-const authUrl = (action: "signIn" | "signOut" | "check") =>
-  `${AUTH_API_URL.replace(/\/$/, "")}/auth:${action}`;
-
 const getErrorMessage = (payload: unknown, fallback: string) => {
-  if (typeof payload !== "object" || payload === null) return fallback;
-  const error = payload as { message?: string; errors?: Array<{ message?: string }> };
-  return error.errors?.[0]?.message ?? error.message ?? fallback;
-};
-
-const saveRenewedToken = (response: Response) => {
-  const token = response.headers.get("x-new-token");
-  if (token) localStorage.setItem(NOCOBASE_TOKEN_KEY, token);
+  if (payload instanceof NocoBaseHttpError) return payload.message;
+  return getNocoBaseErrorMessage(payload, fallback);
 };
 
 const clearCurrentUserCache = () => {
@@ -49,26 +46,23 @@ const clearCurrentUserCache = () => {
 };
 
 const getCurrentUser = async (): Promise<NocoBaseUser> => {
-  const token = localStorage.getItem(NOCOBASE_TOKEN_KEY);
+  const token = nocobaseClient.getToken();
   if (!token) throw new Error("No NocoBase token");
 
-  if (currentUserCache?.token === token && currentUserCache.expiresAt > Date.now()) {
-    return currentUserCache.user;
+  const cached = currentUserCache;
+  if (cached && cached.token === token && cached.expiresAt > Date.now()) {
+    return cached.user;
   }
 
   if (currentUserRequest) return currentUserRequest;
 
   currentUserRequest = (async () => {
-    const response = await fetch(authUrl("check"), {
-      headers: getNocoBaseHeaders({ token, includeAuthenticator: true }),
+    const user = await nocobaseClient.action<NocoBaseUser>("auth", "check", {
+      token,
+      includeAuthenticator: true,
     });
-    const payload = await response.json().catch(() => undefined);
-    if (!response.ok) throw new Error(getErrorMessage(payload, "NocoBase session is invalid"));
-
-    saveRenewedToken(response);
-    const user = (payload?.data ?? payload) as NocoBaseUser;
     currentUserCache = {
-      token: localStorage.getItem(NOCOBASE_TOKEN_KEY) ?? token,
+      token: nocobaseClient.getToken() ?? token,
       user,
       expiresAt: Date.now() + CURRENT_USER_CACHE_MS,
     };
@@ -89,7 +83,8 @@ export const authProvider: AuthProvider = {
         success: false,
         error: {
           name: "UnsupportedAuthenticator",
-          message: "Configure this provider as a NocoBase authenticator before using social sign-in.",
+          message:
+            "Configure this provider as a NocoBase authenticator before using social sign-in.",
         },
       };
     }
@@ -98,62 +93,68 @@ export const authProvider: AuthProvider = {
     if (!account || !password) {
       return {
         success: false,
-        error: { name: "LoginError", message: "Please enter your account and password." },
+        error: {
+          name: "LoginError",
+          message: "Please enter your account and password.",
+        },
       };
     }
 
     try {
-      const response = await fetch(authUrl("signIn"), {
-        method: "POST",
-        headers: getNocoBaseHeaders({
+      const result = await nocobaseClient.action<NocoBaseSignInResponse>(
+        "auth",
+        "signIn",
+        {
+          method: "POST",
           includeAuthenticator: true,
-          includeContentType: true,
-        }),
-        body: JSON.stringify({ account, password }),
-      });
-      const payload = await response.json().catch(() => undefined);
-      if (!response.ok) {
-        return {
-          success: false,
-          error: { name: "LoginError", message: getErrorMessage(payload, "Unable to sign in.") },
-        };
-      }
-
-      const result = (payload?.data ?? payload) as NocoBaseSignInResponse;
+          body: { account, password },
+        }
+      );
       if (!result.token) {
         return {
           success: false,
-          error: { name: "LoginError", message: "NocoBase did not return an access token." },
+          error: {
+            name: "LoginError",
+            message: "NocoBase did not return an access token.",
+          },
         };
       }
 
-      localStorage.setItem(NOCOBASE_TOKEN_KEY, result.token);
+      nocobaseClient.setToken(result.token);
+      nocobaseClient.setRole(null);
       clearCurrentUserCache();
+      clearAcl();
       return { success: true, redirectTo: "/" };
-    } catch {
+    } catch (error) {
       return {
         success: false,
         error: {
-          name: "NetworkError",
-          message:
-            "Unable to reach the NocoBase server. If this is a remote NocoBase from localhost, enable backend CORS for X-Authenticator or use the Vite proxy.",
+          name:
+            error instanceof NocoBaseHttpError ? "LoginError" : "NetworkError",
+          message: getErrorMessage(
+            error,
+            "Unable to reach the NocoBase server. If this is a remote NocoBase from localhost, enable backend CORS for X-Authenticator or use the Vite proxy."
+          ),
         },
       };
     }
   },
 
   logout: async () => {
-    const token = localStorage.getItem(NOCOBASE_TOKEN_KEY);
+    const token = nocobaseClient.getToken();
     try {
       if (token) {
-        await fetch(authUrl("signOut"), {
+        await nocobaseClient.action("auth", "signOut", {
           method: "POST",
-          headers: getNocoBaseHeaders({ token, includeAuthenticator: true }),
+          token,
+          includeAuthenticator: true,
         });
       }
     } finally {
-      localStorage.removeItem(NOCOBASE_TOKEN_KEY);
+      nocobaseClient.setToken(null);
+      nocobaseClient.setRole(null);
       clearCurrentUserCache();
+      clearAcl();
     }
 
     return { success: true, redirectTo: "/login" };
@@ -164,18 +165,27 @@ export const authProvider: AuthProvider = {
       await getCurrentUser();
       return { authenticated: true };
     } catch {
-      localStorage.removeItem(NOCOBASE_TOKEN_KEY);
+      nocobaseClient.setToken(null);
+      nocobaseClient.setRole(null);
       clearCurrentUserCache();
+      clearAcl();
       return { authenticated: false, redirectTo: "/login" };
     }
   },
 
-  getPermissions: async () => null,
+  getPermissions: async () => {
+    try {
+      return await loadAcl();
+    } catch {
+      return null;
+    }
+  },
 
   getIdentity: async () => {
     try {
       const user = await getCurrentUser();
-      const fullName = user.nickname ?? user.username ?? user.email ?? "NocoBase user";
+      const fullName =
+        user.nickname ?? user.username ?? user.email ?? "NocoBase user";
       return {
         id: user.id,
         firstName: fullName,
@@ -183,6 +193,7 @@ export const authProvider: AuthProvider = {
         fullName,
         email: user.email ?? "",
         avatar: user.avatar,
+        roles: user.roles ?? [],
       };
     } catch {
       return null;
@@ -190,12 +201,15 @@ export const authProvider: AuthProvider = {
   },
 
   onError: async (error) => {
-    const status = (error as { status?: number; statusCode?: number }).status ??
+    const status =
+      (error as { status?: number; statusCode?: number }).status ??
       (error as { status?: number; statusCode?: number }).statusCode;
 
-    if (status === 401 || status === 403) {
-      localStorage.removeItem(NOCOBASE_TOKEN_KEY);
+    if (status === 401) {
+      nocobaseClient.setToken(null);
+      nocobaseClient.setRole(null);
       clearCurrentUserCache();
+      clearAcl();
       return { logout: true, redirectTo: "/login" };
     }
 

package/src/providers/constants.ts

@@ -32,44 +32,9 @@ const toProxyRelativeUrl = (url: string, target?: string) => {
   return url;
 };
 
-const getClientLocale = () =>
-  typeof navigator !== "undefined" ? navigator.language : undefined;
-
-const getClientTimezone = () => {
-  const offsetMinutes = -new Date().getTimezoneOffset();
-  const sign = offsetMinutes >= 0 ? "+" : "-";
-  const absoluteMinutes = Math.abs(offsetMinutes);
-  const hours = String(Math.floor(absoluteMinutes / 60)).padStart(2, "0");
-  const minutes = String(absoluteMinutes % 60).padStart(2, "0");
-
-  return `${sign}${hours}:${minutes}`;
-};
-
 export const API_URL = toProxyRelativeUrl(rawApiUrl, proxyTarget);
-export const AUTH_API_URL = API_URL;
-export const TOKEN_KEY = "refine-auth";
+export const API_ORIGIN = getDefaultProxyTarget(rawApiUrl);
 export const NOCOBASE_TOKEN_KEY = "nocobase-auth-token";
+export const NOCOBASE_ROLE_KEY = "nocobase-auth-role";
 export const NOCOBASE_AUTHENTICATOR =
   import.meta.env.NOCOBASE_AUTHENTICATOR ?? "basic";
-
-export const getNocoBaseHeaders = ({
-  token,
-  includeAuthenticator = false,
-  includeContentType = false,
-}: {
-  token?: string;
-  includeAuthenticator?: boolean;
-  includeContentType?: boolean;
-} = {}) => {
-  const locale = getClientLocale();
-  const timezone = getClientTimezone();
-
-  return {
-    Accept: "application/json",
-    ...(includeContentType ? { "Content-Type": "application/json" } : {}),
-    ...(includeAuthenticator ? { "X-Authenticator": NOCOBASE_AUTHENTICATOR } : {}),
-    ...(locale ? { "X-Locale": locale } : {}),
-    ...(timezone ? { "X-Timezone": timezone } : {}),
-    ...(token ? { Authorization: `Bearer ${token}` } : {}),
-  };
-};