@nocobase/portal-template-default 1.0.8 → 1.0.10

package/src/providers/access-control.ts

@@ -1,15 +1,42 @@
 import type { AccessControlProvider } from "@refinedev/core";
 
 import {
-  canAccessWithSnapshot,
-  getAclSnapshot,
+  aclStore,
+  evaluateAccess,
+  getAclState,
   loadAcl,
+  type AclAccessRequest,
+  type RoleConstraint,
 } from "@/lib/nocobase/acl";
 
+const toAclAccessRequest = ({
+  resource,
+  action,
+  params,
+}: Parameters<AccessControlProvider["can"]>[0]): AclAccessRequest => ({
+  resource,
+  action,
+  id: params?.id,
+  field: typeof params?.field === "string" ? params.field : undefined,
+  dataSourceKey:
+    typeof params?.dataSourceKey === "string"
+      ? params.dataSourceKey
+      : undefined,
+  roles: params?.roles as RoleConstraint | undefined,
+  meta: params?.meta as Record<string, unknown> | undefined,
+  resourceItem: params?.resource,
+});
+
 export const accessControlProvider: AccessControlProvider = {
-  can: async ({ resource, action, params }) => {
-    const snapshot = await loadAcl();
-    const can = canAccessWithSnapshot(snapshot, { resource, action, params });
+  can: async (request) => {
+    const state = await loadAcl();
+    const can =
+      state.status === "ready" &&
+      evaluateAccess(
+        state.permissions,
+        toAclAccessRequest(request),
+        aclStore.recordPermissions.getPermission
+      );
 
     return {
       can,
@@ -29,6 +56,14 @@ export const accessControlProvider: AccessControlProvider = {
   },
 };
 
-export const canAccessCurrentAcl = (
-  params: Parameters<typeof canAccessWithSnapshot>[1]
-) => canAccessWithSnapshot(getAclSnapshot(), params);
+export const canAccessCurrentAcl = (request: AclAccessRequest) => {
+  const state = getAclState();
+  return (
+    state.status === "ready" &&
+    evaluateAccess(
+      state.permissions,
+      request,
+      aclStore.recordPermissions.getPermission
+    )
+  );
+};

package/src/providers/auth-callback.ts

@@ -12,6 +12,7 @@ export function captureAuthenticationCallback() {
 
   nocobaseClient.setToken(token);
   nocobaseClient.setAuthenticator(authenticator);
+  nocobaseClient.setRole(null);
   clearAcl();
 
   url.searchParams.delete("token");

package/src/providers/auth.ts

@@ -30,7 +30,7 @@ type NocoBaseSignOutResponse = {
 };
 
 type CurrentUserCache = {
-  token: string;
+  sessionKey: string;
   user: NocoBaseUser;
   expiresAt: number;
 };
@@ -51,10 +51,14 @@ const clearCurrentUserCache = () => {
 
 const getCurrentUser = async (): Promise<NocoBaseUser> => {
   const token = nocobaseClient.getToken();
-  if (!token) throw new Error("No NocoBase token");
+  const sessionKey = token ?? "cookie";
 
   const cached = currentUserCache;
-  if (cached && cached.token === token && cached.expiresAt > Date.now()) {
+  if (
+    cached &&
+    cached.sessionKey === sessionKey &&
+    cached.expiresAt > Date.now()
+  ) {
     return cached.user;
   }
 
@@ -63,10 +67,12 @@ const getCurrentUser = async (): Promise<NocoBaseUser> => {
   currentUserRequest = (async () => {
     const user = await nocobaseClient.action<NocoBaseUser>("auth", "check", {
       token,
-      includeAuthenticator: true,
+      // A default authenticator header would override the server's
+      // authenticator cookie during a Cookie-only SSO session.
+      authenticator: token ? undefined : null,
     });
     currentUserCache = {
-      token: nocobaseClient.getToken() ?? token,
+      sessionKey: nocobaseClient.getToken() ?? "cookie",
       user,
       expiresAt: Date.now() + CURRENT_USER_CACHE_MS,
     };
@@ -216,22 +222,18 @@ export const authProvider: AuthProvider = {
     const token = nocobaseClient.getToken();
     let redirect: string | undefined;
     try {
-      if (token) {
-        const result = await nocobaseClient.action<NocoBaseSignOutResponse>(
-          "auth",
-          "signOut",
-          {
-            method: "POST",
-            token,
-            includeAuthenticator: true,
-          }
-        );
-        redirect = result?.redirect;
-      }
+      const result = await nocobaseClient.action<NocoBaseSignOutResponse>(
+        "auth",
+        "signOut",
+        {
+          method: "POST",
+          token,
+          authenticator: token ? undefined : null,
+        }
+      );
+      redirect = result?.redirect;
     } finally {
-      nocobaseClient.setToken(null);
-      nocobaseClient.setAuthenticator(null);
-      nocobaseClient.setRole(null);
+      nocobaseClient.clearAuthentication();
       clearCurrentUserCache();
       clearAcl();
     }
@@ -249,9 +251,7 @@ export const authProvider: AuthProvider = {
       await getCurrentUser();
       return { authenticated: true };
     } catch {
-      nocobaseClient.setToken(null);
-      nocobaseClient.setAuthenticator(null);
-      nocobaseClient.setRole(null);
+      nocobaseClient.clearAuthentication();
       clearCurrentUserCache();
       clearAcl();
       return { authenticated: false, redirectTo: "/login" };
@@ -291,9 +291,7 @@ export const authProvider: AuthProvider = {
       (error as { status?: number; statusCode?: number }).statusCode;
 
     if (status === 401) {
-      nocobaseClient.setToken(null);
-      nocobaseClient.setAuthenticator(null);
-      nocobaseClient.setRole(null);
+      nocobaseClient.clearAuthentication();
       clearCurrentUserCache();
       clearAcl();
       return { logout: true, redirectTo: "/login" };

package/src/providers/constants.ts

@@ -36,9 +36,5 @@ const toProxyRelativeUrl = (url: string, target?: string) => {
 
 export const API_URL = toProxyRelativeUrl(rawApiUrl, proxyTarget);
 export const API_ORIGIN = getDefaultProxyTarget(rawApiUrl);
-export const NOCOBASE_TOKEN_KEY = "nocobase-auth-token";
-export const NOCOBASE_AUTHENTICATOR_KEY = "nocobase-authenticator";
-export const NOCOBASE_ROLE_KEY = "nocobase-auth-role";
-export const NOCOBASE_LOCALE_KEY = "nocobase-locale";
 export const NOCOBASE_AUTHENTICATOR =
   import.meta.env.NOCOBASE_AUTHENTICATOR ?? "basic";

package/src/providers/data.ts

@@ -24,7 +24,6 @@ import type {
 
 import { nocobaseClient } from "@/lib/nocobase/client";
 import {
-  notifyRecordPermissionsChanged,
   resolveAclDataSourceKey,
   type ResourceAcl,
   updateRecordPermissions,
@@ -122,9 +121,7 @@ const request = async <T>(
     },
     body: options.body,
     token: options.meta?.token,
-    headers: dataSourceKey
-      ? { "X-Data-Source": dataSourceKey }
-      : undefined,
+    headers: dataSourceKey ? { "X-Data-Source": dataSourceKey } : undefined,
     unwrap: options.unwrapData === false ? "none" : "data",
   });
 };
@@ -200,9 +197,7 @@ export const dataProvider: DataProvider = {
       ? { rows: response.data, count: response.meta?.count }
       : response.data ?? response;
     const records = list.rows ?? [];
-    if (cacheAllowedActions({ resource, records, response, meta })) {
-      notifyRecordPermissionsChanged();
-    }
+    cacheAllowedActions({ resource, records, response, meta });
 
     return {
       data: records,
@@ -226,16 +221,12 @@ export const dataProvider: DataProvider = {
       }
     );
     const data = getResponseData(response);
-    if (
-      cacheAllowedActions({
-        resource,
-        records: [data],
-        response: response as NocoBaseListResponse<TData>,
-        meta,
-      })
-    ) {
-      notifyRecordPermissionsChanged();
-    }
+    cacheAllowedActions({
+      resource,
+      records: [data],
+      response: response as NocoBaseListResponse<TData>,
+      meta,
+    });
     return {
       data,
     };
@@ -256,17 +247,14 @@ export const dataProvider: DataProvider = {
       )
     );
     const data = responses.map(getResponseData);
-    let permissionsChanged = false;
     responses.forEach((response, index) => {
-      permissionsChanged =
-        cacheAllowedActions({
-          resource,
-          records: [data[index]],
-          response: response as NocoBaseListResponse<TData>,
-          meta,
-        }) || permissionsChanged;
+      cacheAllowedActions({
+        resource,
+        records: [data[index]],
+        response: response as NocoBaseListResponse<TData>,
+        meta,
+      });
     });
-    if (permissionsChanged) notifyRecordPermissionsChanged();
     return { data };
   },
 

package/src/providers/runtime-config.ts

@@ -17,3 +17,43 @@ export const getPortalBase = () =>
 
 export const getRuntimeApiUrl = () =>
   getWindowValue("NOCOBASE_API_URL") ?? import.meta.env.NOCOBASE_API_URL;
+
+const getAppNameFromPortalBase = (base: string) =>
+  base.match(/\/x\/apps\/([^/]+)(?:\/|$)/)?.[1];
+
+const getAppNameFromApiUrl = (apiUrl?: string) =>
+  apiUrl?.match(/\/api\/__app\/([^/?#]+)(?:[/?#]|$)/)?.[1];
+
+export const resolveNocoBaseAppName = (portalBase: string, apiUrl?: string) =>
+  getAppNameFromPortalBase(portalBase) ??
+  getAppNameFromApiUrl(apiUrl) ??
+  "main";
+
+export const getNocoBaseAppName = () =>
+  resolveNocoBaseAppName(getPortalBase(), getRuntimeApiUrl());
+
+export const resolvePortalUrl = (path = "/") => {
+  if (typeof window === "undefined") return path;
+  if (/^[a-z][a-z\d+.-]*:/i.test(path)) return path;
+
+  const portalBase = getPortalBase();
+  const relativePath = path.replace(/^\/+/, "");
+  const portalUrl = new URL(
+    relativePath,
+    `${window.location.origin}${portalBase}`
+  );
+  const apiUrl = new URL(
+    getRuntimeApiUrl() || "/api",
+    window.location.origin
+  );
+
+  // Same-origin deployments should use a root-relative callback. Besides
+  // avoiding unnecessary origin coupling, this remains compatible with older
+  // SSO plugins that only accept NocoBase-local redirect paths. A standalone
+  // Portal dev server keeps the absolute URL so the callback can return to
+  // Vite instead of the deployed Portal route.
+  if (apiUrl.origin === portalUrl.origin) {
+    return `${portalUrl.pathname}${portalUrl.search}${portalUrl.hash}`;
+  }
+  return portalUrl.toString();
+};

package/src/vite-env.d.ts

@@ -3,4 +3,13 @@
 interface Window {
   NOCOBASE_PORTAL_BASE?: string;
   NOCOBASE_API_URL?: string;
+  __nocobase_api_client_storage_prefix__?: string;
+  __nocobase_api_client_storage_type__?: string;
+  __nocobase_api_client_share_token__?: boolean | string;
+}
+
+interface ImportMetaEnv {
+  readonly API_CLIENT_STORAGE_PREFIX?: string;
+  readonly API_CLIENT_STORAGE_TYPE?: string;
+  readonly API_CLIENT_SHARE_TOKEN?: string;
 }

package/tests/auth-session-regression.mjs

@@ -0,0 +1,101 @@
+import assert from "node:assert/strict";
+import { createServer } from "vite";
+
+const server = await createServer({
+  appType: "custom",
+  logLevel: "silent",
+  server: { middlewareMode: true },
+});
+
+const createStorage = () => {
+  const values = new Map();
+  return {
+    getItem: (key) => values.get(key) ?? null,
+    setItem: (key, value) => values.set(key, value),
+    removeItem: (key) => values.delete(key),
+  };
+};
+
+try {
+  const { AuthSession } = await server.ssrLoadModule(
+    "/src/lib/nocobase/auth-session.ts"
+  );
+  const { resolveNocoBaseAppName, resolvePortalUrl } = await server.ssrLoadModule(
+    "/src/providers/runtime-config.ts"
+  );
+
+  assert.equal(
+    resolveNocoBaseAppName(
+      "/nocobase/x/apps/crm/customer/",
+      "/nocobase/api/__app/crm"
+    ),
+    "crm"
+  );
+  assert.equal(
+    resolveNocoBaseAppName("/x/customer/", "/api/__app/analytics"),
+    "analytics"
+  );
+  assert.equal(resolveNocoBaseAppName("/x/customer/", "/api"), "main");
+
+  const originalWindow = globalThis.window;
+  Object.defineProperty(globalThis, "window", {
+    configurable: true,
+    value: {
+      location: { origin: "http://localhost:14000" },
+      NOCOBASE_API_URL: "/api",
+      NOCOBASE_PORTAL_BASE: "/x/demo/",
+    },
+  });
+  assert.equal(
+    resolvePortalUrl("/users?tab=active#list"),
+    "/x/demo/users?tab=active#list"
+  );
+
+  window.NOCOBASE_API_URL = "/api/__app/crm";
+  window.NOCOBASE_PORTAL_BASE = "/x/apps/crm/customer/";
+  assert.equal(
+    resolvePortalUrl("/users?tab=active#list"),
+    "/x/apps/crm/customer/users?tab=active#list"
+  );
+
+  window.NOCOBASE_API_URL = "http://127.0.0.1:13000/api";
+  window.NOCOBASE_PORTAL_BASE = "/x/demo/";
+  assert.equal(
+    resolvePortalUrl("/users?tab=active#list"),
+    "http://localhost:14000/x/demo/users?tab=active#list"
+  );
+
+  if (originalWindow === undefined) {
+    delete globalThis.window;
+  } else {
+    Object.defineProperty(globalThis, "window", {
+      configurable: true,
+      value: originalWindow,
+    });
+  }
+
+  const main = new AuthSession({ appName: "main", storage: createStorage() });
+  assert.equal(main.getStorageKey("token"), "NOCOBASE_TOKEN");
+  assert.equal(main.getStorageKey("auth"), "NOCOBASE_AUTH");
+  assert.equal(main.getStorageKey("role"), "NOCOBASE_ROLE");
+
+  const subApp = new AuthSession({
+    appName: "crm",
+    storage: createStorage(),
+  });
+  assert.equal(subApp.getStorageKey("token"), "NOCOBASE_CRM_TOKEN");
+  assert.equal(subApp.getStorageKey("auth"), "NOCOBASE_CRM_AUTH");
+  assert.equal(subApp.getStorageKey("role"), "NOCOBASE_CRM_ROLE");
+
+  const sharedToken = new AuthSession({
+    appName: "crm",
+    shareToken: true,
+    storage: createStorage(),
+  });
+  assert.equal(sharedToken.getStorageKey("token"), "NOCOBASE_TOKEN");
+  assert.equal(sharedToken.getStorageKey("auth"), "NOCOBASE_CRM_AUTH");
+
+  console.log("NocoBase authentication session regression tests passed");
+} finally {
+  await server.close();
+}

package/tsconfig.json

@@ -18,8 +18,9 @@
     "noUncheckedSideEffectImports": true,
     "baseUrl": ".",
     "paths": {
+      "@/extensions/*": ["./registry/*", "./src/extensions/*"],
       "@/*": ["./src/*"]
     }
   },
-  "include": ["src"]
+  "include": ["src", "registry"]
 }

package/vite.config.ts

@@ -37,6 +37,9 @@ const defaultRuntimeConfig = `<!-- nocobase-runtime-config:start -->
 <script>
   window.NOCOBASE_PORTAL_BASE = "/";
   window.NOCOBASE_API_URL = "/api";
+  window.__nocobase_api_client_storage_prefix__ = window.__nocobase_api_client_storage_prefix__ ?? "NOCOBASE_";
+  window.__nocobase_api_client_storage_type__ = window.__nocobase_api_client_storage_type__ ?? "localStorage";
+  window.__nocobase_api_client_share_token__ = window.__nocobase_api_client_share_token__ ?? false;
 </script>
 <!-- nocobase-runtime-config:end -->
 `;
@@ -96,13 +99,18 @@ export default defineConfig(({ mode }) => {
     : undefined;
 
   const portalBase = normalizeBase(env.NOCOBASE_PORTAL_BASE);
+  const registrySourceRoot = path.resolve(__dirname, "./registry");
+  const extensionsRoot = fs.existsSync(registrySourceRoot)
+    ? registrySourceRoot
+    : path.resolve(__dirname, "./src/extensions");
 
   return {
     base: portalBase,
-    envPrefix: ["VITE_", "NOCOBASE_"],
+    envPrefix: ["VITE_", "NOCOBASE_", "API_CLIENT_"],
     plugins: [react(), tailwindcss(), copyRawIndexHtmlPlugin(portalBase)],
     resolve: {
       alias: {
+        "@/extensions": extensionsRoot,
         "@": path.resolve(__dirname, "./src"),
       },
     },

package/registry/nocobase-acl/README.md

@@ -1,19 +0,0 @@
-# NocoBase ACL UI
-
-Reusable ACL composition components for the NocoBase Refine starter.
-
-After installation, import the components from `@/extensions/nocobase-acl`.
-
-- `AclPage` combines page-level permissions.
-- `AclRegion` hides or replaces individual data regions.
-- `AclField` applies NocoBase field whitelists.
-- `RoleSwitcher` can be placed in any application surface. It supports
-  normal roles, Anonymous when enabled, and Full permissions through the
-  `__union__` role when the system role mode allows it.
-
-Mark non-collection resources with `meta.acl.type = "authenticated"`, or use
-the `collection`, `snippet`, and `route` ACL metadata variants when the resource
-should participate in NocoBase permission checks.
-
-The underlying `accessControlProvider`, `roles:check` cache, record permissions,
-and Refine integration are provided by the compatible Starter.

package/registry/nocobase-acl/extension.tsx

@@ -1,71 +0,0 @@
-import type { AppExtension } from "@/app/extension";
-import { Blocks, PanelsTopLeft, ShieldCheck } from "lucide-react";
-import { lazy } from "react";
-import { Outlet, Route } from "react-router";
-import { LazyAclRoute } from "./demo/lazy-route";
-
-const AclComponentsPage = lazy(() =>
-  import("./demo/components").then((module) => ({
-    default: module.AclComponentsPage,
-  }))
-);
-const AclPatternsPage = lazy(() =>
-  import("./demo").then((module) => ({ default: module.AclPatternsPage }))
-);
-
-const nocobaseAclExtension: AppExtension = {
-  id: "nocobase-acl",
-  resources: [
-    {
-      name: "acl-integration",
-      meta: {
-        label: "Access control",
-        icon: <ShieldCheck />,
-        description: "NocoBase ACL integration for admin applications.",
-        acl: { type: "authenticated" },
-      },
-    },
-    {
-      name: "acl-components",
-      list: "/acl",
-      meta: {
-        parent: "acl-integration",
-        label: "Role switcher",
-        icon: <Blocks />,
-        acl: { type: "authenticated" },
-      },
-    },
-    {
-      name: "acl-patterns",
-      list: "/acl/patterns",
-      meta: {
-        parent: "acl-integration",
-        label: "Permission patterns",
-        icon: <PanelsTopLeft />,
-        acl: { type: "authenticated" },
-      },
-    },
-  ],
-  routes: (
-    <Route key="nocobase-acl" path="/acl" element={<Outlet />}>
-      <Route
-        index
-        element={
-          <LazyAclRoute>
-            <AclComponentsPage />
-          </LazyAclRoute>
-        }
-      />
-      <Route
-        path="patterns"
-        element={
-          <LazyAclRoute>
-            <AclPatternsPage />
-          </LazyAclRoute>
-        }
-      />
-    </Route>
-  ),
-};
-
-export default nocobaseAclExtension;