@nocobase/portal-template-default 1.0.0 → 1.0.2

package/src/providers/access-control.ts

@@ -0,0 +1,34 @@
+import type { AccessControlProvider } from "@refinedev/core";
+
+import {
+  canAccessWithSnapshot,
+  getAclSnapshot,
+  loadAcl,
+} from "@/lib/nocobase/acl";
+
+export const accessControlProvider: AccessControlProvider = {
+  can: async ({ resource, action, params }) => {
+    const snapshot = await loadAcl();
+    const can = canAccessWithSnapshot(snapshot, { resource, action, params });
+
+    return {
+      can,
+      reason: can
+        ? undefined
+        : "You don't have permission to perform this action.",
+    };
+  },
+  options: {
+    buttons: {
+      enableAccessControl: true,
+      hideIfUnauthorized: true,
+    },
+    queryOptions: {
+      staleTime: Infinity,
+    },
+  },
+};
+
+export const canAccessCurrentAcl = (
+  params: Parameters<typeof canAccessWithSnapshot>[1]
+) => canAccessWithSnapshot(getAclSnapshot(), params);

package/src/providers/auth.ts

@@ -1,10 +1,15 @@
 import type { AuthProvider } from "@refinedev/core";
 
+import { nocobaseClient } from "@/lib/nocobase/client";
 import {
-  AUTH_API_URL,
-  getNocoBaseHeaders,
-  NOCOBASE_TOKEN_KEY,
-} from "./constants";
+  clearAcl,
+  loadAcl,
+  type Role,
+} from "@/lib/nocobase/acl";
+import {
+  getNocoBaseErrorMessage,
+  NocoBaseHttpError,
+} from "@/lib/nocobase/error";
 
 type NocoBaseUser = {
   id: number | string;
@@ -12,6 +17,7 @@ type NocoBaseUser = {
   username?: string;
   email?: string;
   avatar?: string;
+  roles?: Role[];
 };
 
 type NocoBaseSignInResponse = {
@@ -29,18 +35,9 @@ const CURRENT_USER_CACHE_MS = 30_000;
 let currentUserCache: CurrentUserCache | undefined;
 let currentUserRequest: Promise<NocoBaseUser> | undefined;
 
-const authUrl = (action: "signIn" | "signOut" | "check") =>
-  `${AUTH_API_URL.replace(/\/$/, "")}/auth:${action}`;
-
 const getErrorMessage = (payload: unknown, fallback: string) => {
-  if (typeof payload !== "object" || payload === null) return fallback;
-  const error = payload as { message?: string; errors?: Array<{ message?: string }> };
-  return error.errors?.[0]?.message ?? error.message ?? fallback;
-};
-
-const saveRenewedToken = (response: Response) => {
-  const token = response.headers.get("x-new-token");
-  if (token) localStorage.setItem(NOCOBASE_TOKEN_KEY, token);
+  if (payload instanceof NocoBaseHttpError) return payload.message;
+  return getNocoBaseErrorMessage(payload, fallback);
 };
 
 const clearCurrentUserCache = () => {
@@ -49,26 +46,23 @@ const clearCurrentUserCache = () => {
 };
 
 const getCurrentUser = async (): Promise<NocoBaseUser> => {
-  const token = localStorage.getItem(NOCOBASE_TOKEN_KEY);
+  const token = nocobaseClient.getToken();
   if (!token) throw new Error("No NocoBase token");
 
-  if (currentUserCache?.token === token && currentUserCache.expiresAt > Date.now()) {
-    return currentUserCache.user;
+  const cached = currentUserCache;
+  if (cached && cached.token === token && cached.expiresAt > Date.now()) {
+    return cached.user;
   }
 
   if (currentUserRequest) return currentUserRequest;
 
   currentUserRequest = (async () => {
-    const response = await fetch(authUrl("check"), {
-      headers: getNocoBaseHeaders({ token, includeAuthenticator: true }),
+    const user = await nocobaseClient.action<NocoBaseUser>("auth", "check", {
+      token,
+      includeAuthenticator: true,
     });
-    const payload = await response.json().catch(() => undefined);
-    if (!response.ok) throw new Error(getErrorMessage(payload, "NocoBase session is invalid"));
-
-    saveRenewedToken(response);
-    const user = (payload?.data ?? payload) as NocoBaseUser;
     currentUserCache = {
-      token: localStorage.getItem(NOCOBASE_TOKEN_KEY) ?? token,
+      token: nocobaseClient.getToken() ?? token,
       user,
       expiresAt: Date.now() + CURRENT_USER_CACHE_MS,
     };
@@ -89,7 +83,8 @@ export const authProvider: AuthProvider = {
         success: false,
         error: {
           name: "UnsupportedAuthenticator",
-          message: "Configure this provider as a NocoBase authenticator before using social sign-in.",
+          message:
+            "Configure this provider as a NocoBase authenticator before using social sign-in.",
         },
       };
     }
@@ -98,62 +93,68 @@ export const authProvider: AuthProvider = {
     if (!account || !password) {
       return {
         success: false,
-        error: { name: "LoginError", message: "Please enter your account and password." },
+        error: {
+          name: "LoginError",
+          message: "Please enter your account and password.",
+        },
       };
     }
 
     try {
-      const response = await fetch(authUrl("signIn"), {
-        method: "POST",
-        headers: getNocoBaseHeaders({
+      const result = await nocobaseClient.action<NocoBaseSignInResponse>(
+        "auth",
+        "signIn",
+        {
+          method: "POST",
           includeAuthenticator: true,
-          includeContentType: true,
-        }),
-        body: JSON.stringify({ account, password }),
-      });
-      const payload = await response.json().catch(() => undefined);
-      if (!response.ok) {
-        return {
-          success: false,
-          error: { name: "LoginError", message: getErrorMessage(payload, "Unable to sign in.") },
-        };
-      }
-
-      const result = (payload?.data ?? payload) as NocoBaseSignInResponse;
+          body: { account, password },
+        }
+      );
       if (!result.token) {
         return {
           success: false,
-          error: { name: "LoginError", message: "NocoBase did not return an access token." },
+          error: {
+            name: "LoginError",
+            message: "NocoBase did not return an access token.",
+          },
         };
       }
 
-      localStorage.setItem(NOCOBASE_TOKEN_KEY, result.token);
+      nocobaseClient.setToken(result.token);
+      nocobaseClient.setRole(null);
       clearCurrentUserCache();
+      clearAcl();
       return { success: true, redirectTo: "/" };
-    } catch {
+    } catch (error) {
       return {
         success: false,
         error: {
-          name: "NetworkError",
-          message:
-            "Unable to reach the NocoBase server. If this is a remote NocoBase from localhost, enable backend CORS for X-Authenticator or use the Vite proxy.",
+          name:
+            error instanceof NocoBaseHttpError ? "LoginError" : "NetworkError",
+          message: getErrorMessage(
+            error,
+            "Unable to reach the NocoBase server. If this is a remote NocoBase from localhost, enable backend CORS for X-Authenticator or use the Vite proxy."
+          ),
         },
       };
     }
   },
 
   logout: async () => {
-    const token = localStorage.getItem(NOCOBASE_TOKEN_KEY);
+    const token = nocobaseClient.getToken();
     try {
       if (token) {
-        await fetch(authUrl("signOut"), {
+        await nocobaseClient.action("auth", "signOut", {
           method: "POST",
-          headers: getNocoBaseHeaders({ token, includeAuthenticator: true }),
+          token,
+          includeAuthenticator: true,
         });
       }
     } finally {
-      localStorage.removeItem(NOCOBASE_TOKEN_KEY);
+      nocobaseClient.setToken(null);
+      nocobaseClient.setRole(null);
       clearCurrentUserCache();
+      clearAcl();
     }
 
     return { success: true, redirectTo: "/login" };
@@ -164,18 +165,27 @@ export const authProvider: AuthProvider = {
       await getCurrentUser();
       return { authenticated: true };
     } catch {
-      localStorage.removeItem(NOCOBASE_TOKEN_KEY);
+      nocobaseClient.setToken(null);
+      nocobaseClient.setRole(null);
       clearCurrentUserCache();
+      clearAcl();
       return { authenticated: false, redirectTo: "/login" };
     }
   },
 
-  getPermissions: async () => null,
+  getPermissions: async () => {
+    try {
+      return await loadAcl();
+    } catch {
+      return null;
+    }
+  },
 
   getIdentity: async () => {
     try {
       const user = await getCurrentUser();
-      const fullName = user.nickname ?? user.username ?? user.email ?? "NocoBase user";
+      const fullName =
+        user.nickname ?? user.username ?? user.email ?? "NocoBase user";
       return {
         id: user.id,
         firstName: fullName,
@@ -183,6 +193,7 @@ export const authProvider: AuthProvider = {
         fullName,
         email: user.email ?? "",
         avatar: user.avatar,
+        roles: user.roles ?? [],
       };
     } catch {
       return null;
@@ -190,12 +201,15 @@ export const authProvider: AuthProvider = {
   },
 
   onError: async (error) => {
-    const status = (error as { status?: number; statusCode?: number }).status ??
+    const status =
+      (error as { status?: number; statusCode?: number }).status ??
       (error as { status?: number; statusCode?: number }).statusCode;
 
-    if (status === 401 || status === 403) {
-      localStorage.removeItem(NOCOBASE_TOKEN_KEY);
+    if (status === 401) {
+      nocobaseClient.setToken(null);
+      nocobaseClient.setRole(null);
       clearCurrentUserCache();
+      clearAcl();
       return { logout: true, redirectTo: "/login" };
     }
 

package/src/providers/constants.ts

@@ -32,44 +32,10 @@ const toProxyRelativeUrl = (url: string, target?: string) => {
   return url;
 };
 
-const getClientLocale = () =>
-  typeof navigator !== "undefined" ? navigator.language : undefined;
-
-const getClientTimezone = () => {
-  const offsetMinutes = -new Date().getTimezoneOffset();
-  const sign = offsetMinutes >= 0 ? "+" : "-";
-  const absoluteMinutes = Math.abs(offsetMinutes);
-  const hours = String(Math.floor(absoluteMinutes / 60)).padStart(2, "0");
-  const minutes = String(absoluteMinutes % 60).padStart(2, "0");
-
-  return `${sign}${hours}:${minutes}`;
-};
-
 export const API_URL = toProxyRelativeUrl(rawApiUrl, proxyTarget);
-export const AUTH_API_URL = API_URL;
-export const TOKEN_KEY = "refine-auth";
+export const API_ORIGIN = getDefaultProxyTarget(rawApiUrl);
 export const NOCOBASE_TOKEN_KEY = "nocobase-auth-token";
+export const NOCOBASE_ROLE_KEY = "nocobase-auth-role";
+export const NOCOBASE_LOCALE_KEY = "nocobase-locale";
 export const NOCOBASE_AUTHENTICATOR =
   import.meta.env.NOCOBASE_AUTHENTICATOR ?? "basic";
-
-export const getNocoBaseHeaders = ({
-  token,
-  includeAuthenticator = false,
-  includeContentType = false,
-}: {
-  token?: string;
-  includeAuthenticator?: boolean;
-  includeContentType?: boolean;
-} = {}) => {
-  const locale = getClientLocale();
-  const timezone = getClientTimezone();
-
-  return {
-    Accept: "application/json",
-    ...(includeContentType ? { "Content-Type": "application/json" } : {}),
-    ...(includeAuthenticator ? { "X-Authenticator": NOCOBASE_AUTHENTICATOR } : {}),
-    ...(locale ? { "X-Locale": locale } : {}),
-    ...(timezone ? { "X-Timezone": timezone } : {}),
-    ...(token ? { Authorization: `Bearer ${token}` } : {}),
-  };
-};