@nocobase/portal-template-default 1.0.9 → 1.0.10

package/src/lib/nocobase/acl/types.ts

@@ -1,25 +1,26 @@
 import type { BaseKey, IResourceItem } from "@refinedev/core";
 
-export type RoleMode =
-  | "default"
-  | "allow-use-union"
-  | "only-use-union";
+export type RoleMode = "default" | "allow-use-union" | "only-use-union";
 
 export type Role = {
   name: string;
   title?: string;
 };
 
+export type RoleConstraint = {
+  anyOf?: string[];
+  allOf?: string[];
+  noneOf?: string[];
+};
+
 export type AclActionParams = Record<string, unknown> & {
   fields?: string[];
   whitelist?: string[];
   appends?: string[];
 };
 
-export type AclRoleData = {
+export type AclResourcePermissions = {
   snippets?: string[];
-  role?: string;
-  roleMode?: RoleMode;
   resources?: string[];
   actions?: Record<string, AclActionParams>;
   actionAlias?: Record<string, string>;
@@ -34,26 +35,44 @@ export type AclRoleData = {
   uiButtonSchemasBlacklist?: string[];
 };
 
-export type AclMeta = {
-  dataSources?: Record<string, Partial<AclRoleData>>;
+export type AclPermissionSet = AclResourcePermissions & {
+  currentRole?: string;
+  roles: string[];
+  roleMode?: RoleMode;
+  dataSources?: Record<string, Partial<AclResourcePermissions>>;
 };
 
 export type AclResponse = {
-  data?: AclRoleData;
-  meta?: AclMeta;
+  data?: AclResourcePermissions & {
+    role?: string;
+    roles?: string[];
+    roleMode?: RoleMode;
+  };
+  meta?: {
+    dataSources?: Record<string, Partial<AclResourcePermissions>>;
+  };
 };
 
-export type AclSnapshot = {
-  status: "idle" | "loading" | "ready" | "error";
-  identity?: string;
-  data: AclRoleData;
-  meta: AclMeta;
-  error?: Error;
-  version: number;
-};
+export type AclState =
+  | {
+      status: "idle" | "loading";
+      permissions?: undefined;
+      error?: undefined;
+    }
+  | {
+      status: "ready";
+      permissions: AclPermissionSet;
+      error?: undefined;
+    }
+  | {
+      status: "error";
+      permissions?: undefined;
+      error: Error;
+    };
 
-export type ResourceAcl =
-  | false
+type ResourceAclRule = {
+  roles?: RoleConstraint;
+} & (
   | {
       type: "authenticated";
     }
@@ -70,19 +89,20 @@ export type ResourceAcl =
   | {
       type: "route";
       routeId: string | number;
-    };
+    }
+);
 
-export type AclCanParams = {
+export type ResourceAcl = false | ResourceAclRule;
+
+export type AclAccessRequest = {
+  roles?: RoleConstraint;
   resource?: string;
-  action: string;
-  params?: {
-    id?: BaseKey;
-    field?: string;
-    dataSourceKey?: string;
-    meta?: Record<string, unknown>;
-    resource?: IResourceItem;
-    [key: string]: unknown;
-  };
+  action?: string;
+  id?: BaseKey;
+  field?: string;
+  dataSourceKey?: string;
+  meta?: Record<string, unknown>;
+  resourceItem?: IResourceItem;
 };
 
 export type AclIdentity = {

package/src/lib/nocobase/auth-session.ts

@@ -0,0 +1,128 @@
+import { getNocoBaseAppName } from "@/providers/runtime-config";
+
+export type AuthStorageType = "localStorage" | "sessionStorage" | "memory";
+export type AuthSessionField = "token" | "auth" | "role" | "locale";
+
+type AuthSessionRuntime = Window & {
+  __nocobase_api_client_storage_prefix__?: string;
+  __nocobase_api_client_storage_type__?: string;
+  __nocobase_api_client_share_token__?: boolean | string;
+};
+
+type StorageLike = Pick<Storage, "getItem" | "setItem" | "removeItem">;
+
+type AuthSessionOptions = {
+  appName?: string;
+  storagePrefix?: string;
+  storageType?: AuthStorageType;
+  shareToken?: boolean;
+  storage?: StorageLike;
+};
+
+const DEFAULT_STORAGE_PREFIX = "NOCOBASE_";
+const DEFAULT_STORAGE_TYPE: AuthStorageType = "localStorage";
+const memoryStorage = new Map<string, string>();
+
+const memoryStorageAdapter: StorageLike = {
+  getItem: (key) => memoryStorage.get(key) ?? null,
+  setItem: (key, value) => memoryStorage.set(key, value),
+  removeItem: (key) => memoryStorage.delete(key),
+};
+
+const normalizeStorageType = (value?: string): AuthStorageType => {
+  if (value === "sessionStorage" || value === "memory") return value;
+  return DEFAULT_STORAGE_TYPE;
+};
+
+const parseBoolean = (value: boolean | string | undefined) =>
+  value === true || (typeof value === "string" && /^true$/i.test(value));
+
+const getRuntimeWindow = () =>
+  typeof window === "undefined" ? undefined : (window as AuthSessionRuntime);
+
+const getStorage = (type: AuthStorageType): StorageLike => {
+  if (typeof window === "undefined" || type === "memory") {
+    return memoryStorageAdapter;
+  }
+  return type === "sessionStorage" ? window.sessionStorage : window.localStorage;
+};
+
+const getCookie = (name: string) => {
+  if (typeof document === "undefined") return undefined;
+  const prefix = `${name}=`;
+  const value = document.cookie
+    .split(";")
+    .map((item) => item.trim())
+    .find((item) => item.startsWith(prefix))
+    ?.slice(prefix.length);
+  if (value === undefined) return undefined;
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+};
+
+export class AuthSession {
+  readonly appName: string;
+  readonly storagePrefix: string;
+  readonly storageType: AuthStorageType;
+  readonly shareToken: boolean;
+  private readonly storage: StorageLike;
+
+  constructor(options: AuthSessionOptions = {}) {
+    const runtime = getRuntimeWindow();
+    this.appName = options.appName ?? getNocoBaseAppName();
+    this.storagePrefix =
+      options.storagePrefix ||
+      runtime?.__nocobase_api_client_storage_prefix__ ||
+      import.meta.env.API_CLIENT_STORAGE_PREFIX ||
+      DEFAULT_STORAGE_PREFIX;
+    this.storageType =
+      options.storageType ??
+      normalizeStorageType(
+        runtime?.__nocobase_api_client_storage_type__ ??
+          import.meta.env.API_CLIENT_STORAGE_TYPE
+      );
+    this.shareToken =
+      options.shareToken ??
+      parseBoolean(
+        runtime?.__nocobase_api_client_share_token__ ??
+          import.meta.env.API_CLIENT_SHARE_TOKEN
+      );
+    this.storage = options.storage ?? getStorage(this.storageType);
+  }
+
+  getStorageKey(field: AuthSessionField) {
+    const isSharedSubAppToken =
+      field === "token" && this.appName !== "main" && this.shareToken;
+    const appPrefix =
+      this.appName === "main" || isSharedSubAppToken
+        ? this.storagePrefix
+        : `${this.storagePrefix}${this.appName.toUpperCase()}_`;
+    return `${appPrefix}${field}`.toUpperCase();
+  }
+
+  get(field: AuthSessionField) {
+    return this.storage.getItem(this.getStorageKey(field)) || undefined;
+  }
+
+  set(field: AuthSessionField, value?: string | null) {
+    const key = this.getStorageKey(field);
+    if (value) this.storage.setItem(key, value);
+    else this.storage.removeItem(key);
+  }
+
+  clearAuthentication() {
+    this.set("token", null);
+    this.set("auth", null);
+    this.set("role", null);
+  }
+
+  getCookie(type: "role" | "csrfToken") {
+    const prefix = type === "role" ? "nb_role" : "nb_csrf_token";
+    return getCookie(`${prefix}_${this.appName}`);
+  }
+}
+
+export const authSession = new AuthSession();

package/src/lib/nocobase/client.ts

@@ -2,11 +2,8 @@ import {
   API_ORIGIN,
   API_URL,
   NOCOBASE_AUTHENTICATOR,
-  NOCOBASE_AUTHENTICATOR_KEY,
-  NOCOBASE_LOCALE_KEY,
-  NOCOBASE_ROLE_KEY,
-  NOCOBASE_TOKEN_KEY,
 } from "@/providers/constants";
+import { authSession } from "./auth-session";
 import { getNocoBaseErrorMessage, NocoBaseHttpError } from "./error";
 
 type QueryValue =
@@ -26,7 +23,6 @@ export type NocoBaseRequestOptions = {
   authenticator?: string | null;
   role?: string;
   includeRole?: boolean;
-  includeAuthenticator?: boolean;
   withAclMeta?: boolean;
   headers?: Record<string, string>;
   accept?: "json" | "stream";
@@ -36,6 +32,8 @@ export type NocoBaseRequestOptions = {
 const getBrowserLocale = () =>
   typeof navigator === "undefined" ? undefined : navigator.language;
 
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+
 const getClientTimezone = () => {
   const offsetMinutes = -new Date().getTimezoneOffset();
   const sign = offsetMinutes >= 0 ? "+" : "-";
@@ -73,6 +71,10 @@ export class NocoBaseClient {
     return this.apiUrl;
   }
 
+  getAppName() {
+    return authSession.appName;
+  }
+
   resolveUrl(value: string) {
     if (!value || /^[a-z][a-z\d+.-]*:/i.test(value)) return value;
     const base =
@@ -87,18 +89,11 @@ export class NocoBaseClient {
   }
 
   getToken() {
-    return (
-      (typeof localStorage === "undefined"
-        ? undefined
-        : localStorage.getItem(NOCOBASE_TOKEN_KEY) ?? undefined) ??
-      import.meta.env.NOCOBASE_API_TOKEN
-    );
+    return authSession.get("token") ?? import.meta.env.NOCOBASE_API_TOKEN;
   }
 
   getStoredAuthenticator() {
-    return typeof localStorage === "undefined"
-      ? undefined
-      : localStorage.getItem(NOCOBASE_AUTHENTICATOR_KEY) ?? undefined;
+    return authSession.get("auth");
   }
 
   getAuthenticator() {
@@ -106,36 +101,23 @@ export class NocoBaseClient {
   }
 
   setAuthenticator(authenticator?: string | null) {
-    if (typeof localStorage === "undefined") return;
-    if (authenticator) {
-      localStorage.setItem(NOCOBASE_AUTHENTICATOR_KEY, authenticator);
-    } else {
-      localStorage.removeItem(NOCOBASE_AUTHENTICATOR_KEY);
-    }
+    authSession.set("auth", authenticator);
   }
 
   setToken(token?: string | null) {
-    if (typeof localStorage === "undefined") return;
-    if (token) localStorage.setItem(NOCOBASE_TOKEN_KEY, token);
-    else localStorage.removeItem(NOCOBASE_TOKEN_KEY);
+    authSession.set("token", token);
   }
 
   getRole() {
-    return typeof localStorage === "undefined"
-      ? undefined
-      : localStorage.getItem(NOCOBASE_ROLE_KEY) ?? undefined;
+    return authSession.get("role") ?? authSession.getCookie("role");
   }
 
   setRole(role?: string | null) {
-    if (typeof localStorage === "undefined") return;
-    if (role) localStorage.setItem(NOCOBASE_ROLE_KEY, role);
-    else localStorage.removeItem(NOCOBASE_ROLE_KEY);
+    authSession.set("role", role);
   }
 
   getStoredLocale() {
-    return typeof localStorage === "undefined"
-      ? undefined
-      : localStorage.getItem(NOCOBASE_LOCALE_KEY) ?? undefined;
+    return authSession.get("locale");
   }
 
   getLocale() {
@@ -143,9 +125,11 @@ export class NocoBaseClient {
   }
 
   setLocale(locale?: string | null) {
-    if (typeof localStorage === "undefined") return;
-    if (locale) localStorage.setItem(NOCOBASE_LOCALE_KEY, locale);
-    else localStorage.removeItem(NOCOBASE_LOCALE_KEY);
+    authSession.set("locale", locale);
+  }
+
+  clearAuthentication() {
+    authSession.clearAuthentication();
   }
 
   setRuntimeLocale(locale?: string | null) {
@@ -173,38 +157,35 @@ export class NocoBaseClient {
   }
 
   getHeaders({
+    method = "GET",
     token = this.getToken(),
     authenticator,
     role = this.getRole(),
     includeRole = true,
-    includeAuthenticator = false,
     withAclMeta = true,
     headers,
     accept = "json",
     body,
   }: Pick<
     NocoBaseRequestOptions,
+    | "method"
     | "token"
     | "authenticator"
     | "role"
     | "includeRole"
-    | "includeAuthenticator"
     | "withAclMeta"
     | "headers"
     | "accept"
     | "body"
-  > = {}) {
+  > = {}): Record<string, string> {
     const resolvedAuthenticator =
       authenticator === null
         ? undefined
-        : authenticator ??
-          (includeAuthenticator
-            ? this.getAuthenticator()
-            : this.getStoredAuthenticator());
+        : authenticator ?? this.getStoredAuthenticator();
     const locale = this.getLocale();
     const formData =
       typeof FormData !== "undefined" && body instanceof FormData;
-    return {
+    const requestHeaders: Record<string, string> = {
       Accept: accept === "stream" ? "text/event-stream" : "application/json",
       ...(body !== undefined && !formData
         ? { "Content-Type": "application/json" }
@@ -222,6 +203,17 @@ export class NocoBaseClient {
       ...(token ? { Authorization: `Bearer ${token}` } : {}),
       ...headers,
     };
+    const csrfToken = authSession.getCookie("csrfToken");
+    if (
+      !SAFE_METHODS.has(method) &&
+      csrfToken &&
+      !Object.keys(requestHeaders).some(
+        (key) => key.toLowerCase() === "x-csrf-token"
+      )
+    ) {
+      requestHeaders["X-CSRF-Token"] = csrfToken;
+    }
+    return requestHeaders;
   }
 
   async request<T>(
@@ -230,9 +222,11 @@ export class NocoBaseClient {
   ): Promise<T> {
     const method =
       options.method ?? (options.body === undefined ? "GET" : "POST");
+    const headers = this.getHeaders({ ...options, method, body: options.body });
     const response = await fetch(this.buildUrl(endpoint, options.query), {
       method,
-      headers: this.getHeaders({ ...options, body: options.body }),
+      headers,
+      credentials: "include",
       body:
         options.body === undefined
           ? undefined
@@ -270,13 +264,17 @@ export class NocoBaseClient {
     endpoint: string,
     options: Omit<NocoBaseRequestOptions, "accept" | "unwrap"> = {}
   ) {
+    const method = options.method ?? "POST";
+    const headers = this.getHeaders({
+      ...options,
+      method,
+      accept: "stream",
+      body: options.body,
+    });
     const response = await fetch(this.buildUrl(endpoint, options.query), {
-      method: options.method ?? "POST",
-      headers: this.getHeaders({
-        ...options,
-        accept: "stream",
-        body: options.body,
-      }),
+      method,
+      headers,
+      credentials: "include",
       body:
         options.body === undefined ? undefined : JSON.stringify(options.body),
       signal: options.signal,

package/src/locales/en-US.ts

@@ -85,81 +85,3 @@ export const starter = {
   Anonymous: "Anonymous",
   "Full permissions": "Full permissions",
 } as const;
-
-export const app = {
-  "resources.users": "Users",
-  "resources.user": "User",
-  "resources.users.description":
-    "Manage the people who can sign in and work in this NocoBase application.",
-  "users.fields.id": "ID",
-  "users.fields.nickname": "Nickname",
-  "users.fields.username": "Username",
-  "users.fields.email": "Email",
-  "users.fields.phone": "Phone",
-  "users.fields.password": "Password",
-  "users.fields.roles": "Roles",
-  "users.fields.createdAt": "Created at",
-  "users.fields.updatedAt": "Updated at",
-  "users.fields.actions": "Actions",
-  "users.filters.roles.placeholder": "Select roles...",
-  "users.filters.roles.noResults": "No roles found.",
-  "users.actions.view": "View user",
-  "users.actions.edit": "Edit user",
-  "users.actions.delete": "Delete user",
-  "users.drawer.create.title": "Create user",
-  "users.drawer.create.description":
-    "Add a user who can sign in to this NocoBase application.",
-  "users.drawer.edit.title": "Edit user",
-  "users.drawer.edit.description":
-    "Update this user's identity and contact information.",
-  "users.drawer.show.description":
-    "Review this user's identity, contact information, and roles.",
-  "users.form.create.submit": "Create user",
-  "users.form.create.submitting": "Creating...",
-  "users.form.edit.submit": "Save changes",
-  "users.form.edit.submitting": "Saving...",
-  "users.form.cancel": "Cancel",
-  "users.form.nickname.placeholder": "Enter a display name",
-  "users.form.username.placeholder": "Enter a unique username",
-  "users.form.email.placeholder": "Enter an email address",
-  "users.form.phone.placeholder": "Enter a phone number",
-  "users.form.password.placeholder": "Set an initial password",
-  "users.form.password.aiNotice":
-    "Passwords are never included in AI page context or Form filler.",
-  "users.validation.username": "Username is required",
-  "users.validation.email": "Email is required",
-  "users.validation.emailFormat": "Enter a valid email address",
-  "users.validation.phone": "Phone is required",
-  "users.validation.password": "Password is required",
-  "users.detail.identity": "Identity",
-  "users.detail.contact": "Contact",
-  "users.detail.access": "Access",
-  "users.detail.timestamps": "Timestamps",
-  "users.detail.noRoles": "No assigned roles",
-  "users.detail.unnamed": "Unnamed user",
-  "users.detail.loadError.title": "Unable to load user",
-  "users.detail.loadError.description":
-    "The user may no longer exist, or you may not have permission to view it.",
-  "users.ai.table": "Users table",
-  "users.ai.detail": "User details",
-  "users.ai.createForm": "Create user form",
-  "users.ai.editForm": "Edit user form",
-  "common.yes": "Yes",
-  "common.no": "No",
-  "roles.drawer.description": "Review the role associated with this user.",
-  "roles.fields.name": "Name",
-  "roles.fields.title": "Title",
-  "roles.fields.description": "Description",
-  "roles.fields.default": "Default role",
-  "roles.fields.hidden": "Hidden",
-  "roles.fields.allowConfigure": "Can configure",
-  "roles.fields.createdAt": "Created at",
-  "roles.fields.updatedAt": "Updated at",
-  "roles.detail.identity": "Role identity",
-  "roles.detail.settings": "Settings",
-  "roles.detail.actions": "Allowed actions",
-  "roles.detail.timestamps": "Timestamps",
-  "roles.detail.unavailable":
-    "Additional role details are unavailable. Showing the relation data included with the user.",
-  "roles.ai.detail": "Role details",
-} as const;

package/src/locales/index.ts

@@ -1,13 +1,8 @@
 import { registerTranslationResources } from "@/lib/i18n";
-import { app as enUSApp, starter as enUSStarter } from "./en-US";
-import { app as zhCNApp, starter as zhCNStarter } from "./zh-CN";
+import { starter as enUSStarter } from "./en-US";
+import { starter as zhCNStarter } from "./zh-CN";
 
 registerTranslationResources("starter", {
   "en-US": enUSStarter,
   "zh-CN": zhCNStarter,
 });
-
-registerTranslationResources("app", {
-  "en-US": enUSApp,
-  "zh-CN": zhCNApp,
-});

package/src/locales/zh-CN.ts

@@ -82,77 +82,3 @@ export const starter = {
   Anonymous: "匿名用户",
   "Full permissions": "全部权限",
 } as const;
-
-export const app = {
-  "resources.users": "用户",
-  "resources.user": "用户",
-  "resources.users.description": "管理可以登录并使用此 NocoBase 应用的用户。",
-  "users.fields.id": "ID",
-  "users.fields.nickname": "昵称",
-  "users.fields.username": "用户名",
-  "users.fields.email": "邮箱",
-  "users.fields.phone": "手机号",
-  "users.fields.password": "密码",
-  "users.fields.roles": "角色",
-  "users.fields.createdAt": "创建时间",
-  "users.fields.updatedAt": "更新时间",
-  "users.fields.actions": "操作",
-  "users.filters.roles.placeholder": "选择角色…",
-  "users.filters.roles.noResults": "未找到角色。",
-  "users.actions.view": "查看用户",
-  "users.actions.edit": "编辑用户",
-  "users.actions.delete": "删除用户",
-  "users.drawer.create.title": "新建用户",
-  "users.drawer.create.description": "添加可以登录此 NocoBase 应用的用户。",
-  "users.drawer.edit.title": "编辑用户",
-  "users.drawer.edit.description": "更新用户的身份和联系方式。",
-  "users.drawer.show.description": "查看用户的身份、联系方式和关联角色。",
-  "users.form.create.submit": "创建用户",
-  "users.form.create.submitting": "正在创建...",
-  "users.form.edit.submit": "保存修改",
-  "users.form.edit.submitting": "正在保存...",
-  "users.form.cancel": "取消",
-  "users.form.nickname.placeholder": "输入显示名称",
-  "users.form.username.placeholder": "输入唯一用户名",
-  "users.form.email.placeholder": "输入邮箱地址",
-  "users.form.phone.placeholder": "输入手机号",
-  "users.form.password.placeholder": "设置初始密码",
-  "users.form.password.aiNotice":
-    "密码不会包含在 AI 页面上下文中，Form filler 也无法填写密码。",
-  "users.validation.username": "请输入用户名",
-  "users.validation.email": "请输入邮箱",
-  "users.validation.emailFormat": "请输入有效的邮箱地址",
-  "users.validation.phone": "请输入手机号",
-  "users.validation.password": "请输入密码",
-  "users.detail.identity": "身份信息",
-  "users.detail.contact": "联系方式",
-  "users.detail.access": "访问权限",
-  "users.detail.timestamps": "时间信息",
-  "users.detail.noRoles": "尚未分配角色",
-  "users.detail.unnamed": "未命名用户",
-  "users.detail.loadError.title": "无法加载用户",
-  "users.detail.loadError.description":
-    "该用户可能已不存在，或者你没有权限查看此用户。",
-  "users.ai.table": "用户表格",
-  "users.ai.detail": "用户详情",
-  "users.ai.createForm": "新建用户表单",
-  "users.ai.editForm": "编辑用户表单",
-  "common.yes": "是",
-  "common.no": "否",
-  "roles.drawer.description": "查看与当前用户关联的角色信息。",
-  "roles.fields.name": "名称",
-  "roles.fields.title": "标题",
-  "roles.fields.description": "描述",
-  "roles.fields.default": "默认角色",
-  "roles.fields.hidden": "隐藏",
-  "roles.fields.allowConfigure": "允许配置",
-  "roles.fields.createdAt": "创建时间",
-  "roles.fields.updatedAt": "更新时间",
-  "roles.detail.identity": "角色标识",
-  "roles.detail.settings": "角色设置",
-  "roles.detail.actions": "允许的操作",
-  "roles.detail.timestamps": "时间信息",
-  "roles.detail.unavailable":
-    "无法加载更多角色详情，当前展示用户关联数据中已有的信息。",
-  "roles.ai.detail": "角色详情",
-} as const;