@nocobase/server 2.1.0-alpha.4 → 2.1.0-alpha.45

package/lib/commands/pm.js

@@ -32,9 +32,16 @@ __export(pm_exports, {
 module.exports = __toCommonJS(pm_exports);
 var import_app_supervisor = require("../app-supervisor");
 var import_plugin_command_error = require("../errors/plugin-command-error");
+var import_utils = require("../plugin-manager/utils");
 /* istanbul ignore file -- @preserve */
 var pm_default = /* @__PURE__ */ __name((app) => {
   const pm = app.command("pm");
+  pm.command("list").action(async () => {
+    const items = await (0, import_utils.pmListSummary)(app);
+    console.log("--- BEGIN_PLUGIN_LIST_JSON ---");
+    console.log(JSON.stringify(items));
+    console.log("--- END_PLUGIN_LIST_JSON ---");
+  });
   pm.command("create").argument("plugin").option("--force-recreate").action(async (plugin, options) => {
     await app.pm.create(plugin, options);
   });

package/lib/commands/start.js

@@ -41,19 +41,17 @@ __export(start_exports, {
 });
 module.exports = __toCommonJS(start_exports);
 var import_fs_extra = __toESM(require("fs-extra"));
-var import_path = require("path");
-var import_create_docs_index = require("../ai/create-docs-index");
+var import_utils = require("@nocobase/utils");
 var import_application_not_install = require("../errors/application-not-install");
 /* istanbul ignore file -- @preserve */
 var start_default = /* @__PURE__ */ __name((app) => {
   app.command("start").auth().option("--db-sync").option("--quickstart").action(async (...cliArgs) => {
     const [options] = cliArgs;
-    const file = (0, import_path.resolve)(process.cwd(), "storage/.upgrading");
+    const file = (0, import_utils.storagePathJoin)(".upgrading");
     const upgrading = await import_fs_extra.default.exists(file);
     if (upgrading) {
       if (!process.env.VITEST) {
         if (await app.isInstalled()) {
-          await (0, import_create_docs_index.createDocsIndex)(app);
           await app.upgrade();
         }
       }
@@ -62,7 +60,6 @@ var start_default = /* @__PURE__ */ __name((app) => {
       } catch (error) {
       }
     } else if (options.quickstart) {
-      await (0, import_create_docs_index.createDocsIndex)(app);
       if (await app.isInstalled()) {
         await app.upgrade({ quickstart: true });
       } else {

package/lib/commands/upgrade.js

@@ -30,11 +30,9 @@ __export(upgrade_exports, {
   default: () => upgrade_default
 });
 module.exports = __toCommonJS(upgrade_exports);
-var import_create_docs_index = require("../ai/create-docs-index");
 /* istanbul ignore file -- @preserve */
 var upgrade_default = /* @__PURE__ */ __name((app) => {
   app.command("upgrade").ipc().auth().action(async (options) => {
-    await (0, import_create_docs_index.createDocsIndex)(app);
     await app.upgrade(options);
     app.log.info(`\u2728  NocoBase has been upgraded to v${app.getVersion()}`);
   });

package/lib/{ai/create-docs-index.d.ts → constants.d.ts}

@@ -6,8 +6,4 @@
  * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
-import type Application from '../application';
-export type DocsIndexOptions = {
-    pkg?: string | string[];
-};
-export declare function createDocsIndex(app: Application, options?: DocsIndexOptions): Promise<void>;
+export declare const OFFICIAL_PLUGIN_PREFIX = "@nocobase/plugin-";

package/lib/constants.js

@@ -0,0 +1,36 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var constants_exports = {};
+__export(constants_exports, {
+  OFFICIAL_PLUGIN_PREFIX: () => OFFICIAL_PLUGIN_PREFIX
+});
+module.exports = __toCommonJS(constants_exports);
+const OFFICIAL_PLUGIN_PREFIX = "@nocobase/plugin-";
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OFFICIAL_PLUGIN_PREFIX
+});

package/lib/event-queue.js

@@ -71,7 +71,7 @@ const _MemoryEventQueueAdapter = class _MemoryEventQueueAdapter {
     return null;
   }
   get storagePath() {
-    return import_path.default.resolve(process.cwd(), "storage", "apps", this.options.appName, "event-queue.json");
+    return (0, import_utils.storagePathJoin)("apps", this.options.appName, "event-queue.json");
   }
   listen = /* @__PURE__ */ __name((channel) => {
     if (!this.connected) {

package/lib/gateway/index.d.ts

@@ -19,6 +19,7 @@ import { IPCSocketClient } from './ipc-socket-client';
 import { IPCSocketServer } from './ipc-socket-server';
 import { WSServer } from './ws-server';
 import { Duplex } from 'node:stream';
+export { getHost, getHostname } from './utils';
 export interface IncomingRequest {
     url: string;
     headers: any;
@@ -40,7 +41,7 @@ interface RunOptions {
     mainAppOptions: ApplicationOptions;
 }
 export interface AppSelectorMiddlewareContext {
-    req: IncomingRequest;
+    req: IncomingMessage | IncomingRequest;
     resolvedAppName: string | null;
 }
 export declare class Gateway extends EventEmitter {
@@ -57,7 +58,10 @@ export declare class Gateway extends EventEmitter {
     private port;
     private host;
     private socketPath;
+    private v2IndexTemplateCache;
     private terminating;
+    private getOriginalRequestUrl;
+    private proxyRequestToSubApp;
     private onTerminate;
     private constructor();
     static getInstance(options?: any): Gateway;
@@ -74,9 +78,18 @@ export declare class Gateway extends EventEmitter {
         code: string;
     }): void;
     responseErrorWithCode(code: any, res: any, options: any): void;
+    private getV2PublicPath;
+    private getAppPublicPath;
+    private isV2Request;
+    private isV2IndexRequest;
+    private getV2RuntimeConfig;
+    private getV2RuntimeConfigScript;
+    private getV2AssetPublicPath;
+    private getV2IndexTemplate;
+    private renderV2IndexHtml;
     requestHandler(req: IncomingMessage, res: ServerResponse): Promise<void>;
     getAppSelectorMiddlewares(): Toposort<AppSelectorMiddleware>;
-    getRequestHandleAppName(req: IncomingRequest): Promise<string>;
+    getRequestHandleAppName(req: IncomingMessage | IncomingRequest): Promise<string>;
     getCallback(): any;
     watch(): Promise<void>;
     run(options: RunOptions): Promise<void>;
@@ -96,4 +109,3 @@ export declare class Gateway extends EventEmitter {
     static registerWsHandler(wsServer: (req: IncomingMessage, socket: Duplex, head: Buffer, app: Application) => boolean | void): void;
     static unregisterWsHandler(wsServer: (req: IncomingMessage, socket: Duplex, head: Buffer, app: Application) => boolean | void): void;
 }
-export {};

package/lib/gateway/index.js

@@ -39,7 +39,9 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 var gateway_exports = {};
 __export(gateway_exports, {
-  Gateway: () => Gateway
+  Gateway: () => Gateway,
+  getHost: () => import_utils4.getHost,
+  getHostname: () => import_utils4.getHostname
 });
 module.exports = __toCommonJS(gateway_exports);
 var import_logger = require("@nocobase/logger");
@@ -54,6 +56,7 @@ var import_fs = __toESM(require("fs"));
 var import_http = __toESM(require("http"));
 var import_koa_compose = __toESM(require("koa-compose"));
 var import_node_util = require("node:util");
+var import_node_os = require("node:os");
 var import_path = require("path");
 var import_qs = __toESM(require("qs"));
 var import_serve_handler = __toESM(require("serve-handler"));
@@ -63,16 +66,27 @@ var import_plugin_manager = require("../plugin-manager");
 var import_errors = require("./errors");
 var import_ipc_socket_client = require("./ipc-socket-client");
 var import_ipc_socket_server = require("./ipc-socket-server");
+var import_static_file_security = require("./static-file-security");
+var import_utils3 = require("./utils");
 var import_ws_server = require("./ws-server");
 var import_node_worker_threads = require("node:worker_threads");
 var import_node_process = __toESM(require("node:process"));
+var import_utils4 = require("./utils");
 const compress = (0, import_node_util.promisify)((0, import_compression.default)());
+function normalizeBasePath(path = "") {
+  const normalized = path.replace(/\/+/g, "/").replace(/\/$/, "");
+  return normalized || "/";
+}
+__name(normalizeBasePath, "normalizeBasePath");
 function getSocketPath() {
-  const { SOCKET_PATH } = import_node_process.default.env;
-  if ((0, import_path.isAbsolute)(SOCKET_PATH)) {
-    return SOCKET_PATH;
+  const socketPath = import_node_process.default.env.SOCKET_PATH;
+  if (socketPath) {
+    return (0, import_path.isAbsolute)(socketPath) ? socketPath : (0, import_path.resolve)(import_node_process.default.cwd(), socketPath);
+  }
+  if (import_node_process.default.env.NOCOBASE_RUNNING_IN_DOCKER === "true") {
+    return (0, import_path.resolve)((0, import_node_os.homedir)(), ".nocobase", "gateway.sock");
   }
-  return (0, import_path.resolve)(import_node_process.default.cwd(), SOCKET_PATH);
+  return (0, import_utils.storagePathJoin)("gateway.sock");
 }
 __name(getSocketPath, "getSocketPath");
 const _Gateway = class _Gateway extends import_events.EventEmitter {
@@ -87,8 +101,21 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
   loggers = new import_utils.Registry();
   port = import_node_process.default.env.APP_PORT ? parseInt(import_node_process.default.env.APP_PORT) : null;
   host = "0.0.0.0";
-  socketPath = (0, import_path.resolve)(import_node_process.default.cwd(), "storage", "gateway.sock");
+  socketPath = getSocketPath();
+  v2IndexTemplateCache = null;
   terminating = false;
+  getOriginalRequestUrl(req) {
+    return req.originalUrl || req.url;
+  }
+  async proxyRequestToSubApp(supervisor, appName, req, res) {
+    const internalUrl = req.url;
+    req.url = this.getOriginalRequestUrl(req);
+    try {
+      return await supervisor.proxyWeb(appName, req, res);
+    } finally {
+      req.url = internalUrl;
+    }
+  }
   onTerminate = /* @__PURE__ */ __name(async (signal) => {
     var _a;
     if (this.terminating) {
@@ -119,7 +146,6 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
   constructor() {
     super();
     this.reset();
-    this.socketPath = getSocketPath();
     import_node_process.default.once("SIGTERM", this.onTerminate);
     import_node_process.default.once("SIGINT", this.onTerminate);
   }
@@ -151,14 +177,30 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
     this.selectorMiddlewares = new import_utils.Toposort();
     this.addAppSelectorMiddleware(
       async (ctx, next) => {
-        var _a;
+        var _a, _b;
         const { req } = ctx;
-        const appName = (_a = import_qs.default.parse((0, import_url.parse)(req.url).query)) == null ? void 0 : _a.__appName;
+        const parsedUrl = (0, import_url.parse)(req.url);
+        const appName = (_a = import_qs.default.parse(parsedUrl.query)) == null ? void 0 : _a.__appName;
+        const apiBasePath = normalizeBasePath(import_node_process.default.env.API_BASE_PATH || "/api");
+        const appPathPrefix = `${apiBasePath}/__app/`;
+        if (req.headers["x-app"]) {
+          ctx.resolvedAppName = req.headers["x-app"];
+        }
         if (appName) {
           ctx.resolvedAppName = appName;
         }
-        if (req.headers["x-app"]) {
-          ctx.resolvedAppName = req.headers["x-app"];
+        if ((_b = parsedUrl.pathname) == null ? void 0 : _b.startsWith(appPathPrefix)) {
+          const restPath = parsedUrl.pathname.slice(appPathPrefix.length);
+          const [pathAppName, ...segments] = restPath.split("/");
+          if (pathAppName) {
+            ctx.resolvedAppName = pathAppName;
+            const rewrittenPath = `${apiBasePath}${segments.length ? `/${segments.join("/")}` : ""}`;
+            const rewrittenUrl = `${rewrittenPath}${parsedUrl.search || ""}`;
+            if (!req.originalUrl) {
+              req.originalUrl = req.url;
+            }
+            req.url = rewrittenUrl;
+          }
         }
         await next();
       },
@@ -222,9 +264,81 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
     });
     this.responseError(res, error);
   }
+  getV2PublicPath() {
+    return (0, import_utils3.resolveV2PublicPath)(import_node_process.default.env.APP_PUBLIC_PATH || "/");
+  }
+  getAppPublicPath() {
+    return (0, import_utils3.resolvePublicPath)(import_node_process.default.env.APP_PUBLIC_PATH || "/");
+  }
+  isV2Request(pathname) {
+    const v2PublicPath = this.getV2PublicPath();
+    return pathname === v2PublicPath.slice(0, -1) || pathname.startsWith(v2PublicPath);
+  }
+  isV2IndexRequest(pathname) {
+    if (!this.isV2Request(pathname)) {
+      return false;
+    }
+    const v2PublicPath = this.getV2PublicPath();
+    if (pathname === v2PublicPath || pathname === v2PublicPath.slice(0, -1) || pathname === `${v2PublicPath}index.html`) {
+      return true;
+    }
+    return !(0, import_path.extname)(pathname);
+  }
+  getV2RuntimeConfig() {
+    return {
+      __nocobase_public_path__: this.getV2PublicPath(),
+      __webpack_public_path__: import_node_process.default.env.CDN_BASE_URL ? `${import_node_process.default.env.CDN_BASE_URL.replace(/\/+$/, "")}/` : "",
+      __nocobase_api_base_url__: import_node_process.default.env.API_BASE_URL || import_node_process.default.env.API_BASE_PATH,
+      __nocobase_api_client_storage_prefix__: import_node_process.default.env.API_CLIENT_STORAGE_PREFIX,
+      __nocobase_api_client_storage_type__: import_node_process.default.env.API_CLIENT_STORAGE_TYPE,
+      __nocobase_api_client_share_token__: import_node_process.default.env.API_CLIENT_SHARE_TOKEN === "true",
+      __nocobase_ws_url__: import_node_process.default.env.WEBSOCKET_URL || "",
+      __nocobase_ws_path__: import_node_process.default.env.WS_PATH,
+      __nocobase_app_dev__: import_node_process.default.env.NOCOBASE_APP_DEV === "true",
+      __esm_cdn_base_url__: import_node_process.default.env.ESM_CDN_BASE_URL || "https://esm.sh",
+      __esm_cdn_suffix__: import_node_process.default.env.ESM_CDN_SUFFIX || ""
+    };
+  }
+  getV2RuntimeConfigScript() {
+    const runtimeConfig = this.getV2RuntimeConfig();
+    const scriptContent = Object.entries(runtimeConfig).map(([key, value]) => `window['${key}'] = ${JSON.stringify(value)};`).join("\n");
+    return `<script>${scriptContent}</script>`;
+  }
+  getV2AssetPublicPath() {
+    if (import_node_process.default.env.CDN_BASE_URL) {
+      return `${import_node_process.default.env.CDN_BASE_URL.replace(/\/+$/, "")}/v2/`;
+    }
+    return this.getV2PublicPath();
+  }
+  getV2IndexTemplate() {
+    const file = `${import_node_process.default.env.APP_PACKAGE_ROOT}/dist/client/v2/index.html`;
+    if (!import_fs.default.existsSync(file)) {
+      return null;
+    }
+    const stat = import_fs.default.statSync(file);
+    if (this.v2IndexTemplateCache && this.v2IndexTemplateCache.file === file && this.v2IndexTemplateCache.mtimeMs === stat.mtimeMs) {
+      return this.v2IndexTemplateCache.html;
+    }
+    const html = import_fs.default.readFileSync(file, "utf-8");
+    this.v2IndexTemplateCache = {
+      file,
+      mtimeMs: stat.mtimeMs,
+      html
+    };
+    return html;
+  }
+  renderV2IndexHtml() {
+    const template = this.getV2IndexTemplate();
+    if (!template) {
+      return null;
+    }
+    const html = (0, import_utils3.rewriteV2AssetPublicPath)(template, this.getV2AssetPublicPath());
+    return (0, import_utils3.injectRuntimeScript)(html, this.getV2RuntimeConfigScript());
+  }
   async requestHandler(req, res) {
     const { pathname } = (0, import_url.parse)(req.url);
-    const { PLUGIN_STATICS_PATH, APP_PUBLIC_PATH } = import_node_process.default.env;
+    const { PLUGIN_STATICS_PATH } = import_node_process.default.env;
+    const APP_PUBLIC_PATH = this.getAppPublicPath();
     if (pathname.endsWith("/__umi/api/bundle-status")) {
       res.statusCode = 200;
       res.end("ok");
@@ -241,21 +355,25 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
     }
     if (pathname.startsWith(APP_PUBLIC_PATH + "storage/uploads/")) {
       if (handleApp !== "main") {
-        const isProxy = await supervisor.proxyWeb(handleApp, req, res);
+        const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);
         if (isProxy) {
           return;
         }
       }
-      req.url = req.url.substring(APP_PUBLIC_PATH.length - 1);
+      const headers = (0, import_static_file_security.getStorageUploadSecurityHeaders)(pathname);
+      for (const [key, value] of Object.entries(headers)) {
+        res.setHeader(key, value);
+      }
+      req.url = req.url.substring(APP_PUBLIC_PATH.length + "storage".length);
       await compress(req, res);
       return (0, import_serve_handler.default)(req, res, {
-        public: (0, import_path.resolve)(import_node_process.default.cwd()),
+        public: (0, import_utils.resolveStorageRoot)(),
         directoryListing: false
       });
     }
     if (pathname.startsWith(PLUGIN_STATICS_PATH) && !pathname.includes("/server/")) {
       if (handleApp !== "main") {
-        const isProxy = await supervisor.proxyWeb(handleApp, req, res);
+        const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);
         if (isProxy) {
           return;
         }
@@ -275,8 +393,29 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
       });
     }
     if (!pathname.startsWith(import_node_process.default.env.API_BASE_PATH)) {
+      if (this.isV2Request(pathname)) {
+        if (handleApp !== "main") {
+          const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);
+          if (isProxy) {
+            return;
+          }
+        }
+        if (this.isV2IndexRequest(pathname)) {
+          const v2Html = this.renderV2IndexHtml();
+          if (v2Html) {
+            res.setHeader("Content-Type", "text/html; charset=utf-8");
+            res.end(v2Html);
+            return;
+          }
+        }
+        req.url = req.url.substring(APP_PUBLIC_PATH.length - 1);
+        await compress(req, res);
+        return (0, import_serve_handler.default)(req, res, {
+          public: `${import_node_process.default.env.APP_PACKAGE_ROOT}/dist/client`
+        });
+      }
       if (handleApp !== "main") {
-        const isProxy = await supervisor.proxyWeb(handleApp, req, res);
+        const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);
         if (isProxy) {
           return;
         }
@@ -289,7 +428,7 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
       });
     }
     if (handleApp !== "main") {
-      const isProxy = await supervisor.proxyWeb(handleApp, req, res);
+      const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);
       if (isProxy) {
         return;
       }
@@ -399,7 +538,7 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
       }
     }
     if (isStart || !ipcClient) {
-      await (0, import_plugin_symlink.createStoragePluginsSymlink)();
+      await (0, import_plugin_symlink.syncPluginSymlinks)();
     }
     const mainApp = import_app_supervisor.AppSupervisor.getInstance().bootMainApp(options.mainAppOptions);
     mainApp.setMaxListeners(50);
@@ -541,5 +680,7 @@ __publicField(_Gateway, "wsServers", []);
 let Gateway = _Gateway;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  Gateway
+  Gateway,
+  getHost,
+  getHostname
 });

package/lib/gateway/static-file-security.d.ts

@@ -0,0 +1,10 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export declare function hasActiveContentExtension(pathname?: string): boolean;
+export declare function getStorageUploadSecurityHeaders(pathname?: string): Record<string, string>;

package/lib/gateway/static-file-security.js

@@ -0,0 +1,69 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var static_file_security_exports = {};
+__export(static_file_security_exports, {
+  getStorageUploadSecurityHeaders: () => getStorageUploadSecurityHeaders,
+  hasActiveContentExtension: () => hasActiveContentExtension
+});
+module.exports = __toCommonJS(static_file_security_exports);
+var import_node_path = __toESM(require("node:path"));
+const ACTIVE_CONTENT_EXTENSIONS = /* @__PURE__ */ new Set([".htm", ".html", ".pdf", ".svg", ".svgz", ".xhtml"]);
+function stripQueryAndHash(pathname = "") {
+  return pathname.split("?")[0].split("#")[0];
+}
+__name(stripQueryAndHash, "stripQueryAndHash");
+function hasActiveContentExtension(pathname = "") {
+  const ext = import_node_path.default.extname(stripQueryAndHash(pathname)).toLowerCase();
+  return ACTIVE_CONTENT_EXTENSIONS.has(ext);
+}
+__name(hasActiveContentExtension, "hasActiveContentExtension");
+function getStorageUploadSecurityHeaders(pathname = "") {
+  const headers = {
+    "X-Content-Type-Options": "nosniff"
+  };
+  if (hasActiveContentExtension(pathname)) {
+    headers["Content-Disposition"] = "attachment";
+  }
+  return headers;
+}
+__name(getStorageUploadSecurityHeaders, "getStorageUploadSecurityHeaders");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getStorageUploadSecurityHeaders,
+  hasActiveContentExtension
+});

package/lib/gateway/utils.d.ts

@@ -0,0 +1,17 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+/// <reference types="node" />
+import { IncomingMessage } from 'http';
+import { IncomingRequest } from '.';
+export declare function resolvePublicPath(appPublicPath?: string): string;
+export declare function resolveV2PublicPath(appPublicPath?: string): string;
+export declare function rewriteV2AssetPublicPath(html: string, assetPublicPath: string): string;
+export declare function injectRuntimeScript(html: string, runtimeScript: string): string;
+export declare function getHost(req: IncomingMessage | IncomingRequest): any;
+export declare function getHostname(req: IncomingMessage | IncomingRequest): any;

package/lib/gateway/utils.js

@@ -0,0 +1,115 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var utils_exports = {};
+__export(utils_exports, {
+  getHost: () => getHost,
+  getHostname: () => getHostname,
+  injectRuntimeScript: () => injectRuntimeScript,
+  resolvePublicPath: () => resolvePublicPath,
+  resolveV2PublicPath: () => resolveV2PublicPath,
+  rewriteV2AssetPublicPath: () => rewriteV2AssetPublicPath
+});
+module.exports = __toCommonJS(utils_exports);
+function resolvePublicPath(appPublicPath = "/") {
+  const normalized = String(appPublicPath || "/").trim() || "/";
+  const withLeadingSlash = normalized.startsWith("/") ? normalized : `/${normalized}`;
+  return withLeadingSlash.endsWith("/") ? withLeadingSlash : `${withLeadingSlash}/`;
+}
+__name(resolvePublicPath, "resolvePublicPath");
+function resolveV2PublicPath(appPublicPath = "/") {
+  const publicPath = resolvePublicPath(appPublicPath);
+  return `${publicPath.replace(/\/$/, "")}/v2/`;
+}
+__name(resolveV2PublicPath, "resolveV2PublicPath");
+function ensureTrailingSlash(value) {
+  return value.endsWith("/") ? value : `${value}/`;
+}
+__name(ensureTrailingSlash, "ensureTrailingSlash");
+function rewriteV2AssetPublicPath(html, assetPublicPath) {
+  const normalizedAssetPublicPath = ensureTrailingSlash(assetPublicPath);
+  if (normalizedAssetPublicPath === "/v2/") {
+    return html;
+  }
+  return html.replace(/((?:src|href)=["'])\/v2\//g, `$1${normalizedAssetPublicPath}`);
+}
+__name(rewriteV2AssetPublicPath, "rewriteV2AssetPublicPath");
+function injectRuntimeScript(html, runtimeScript) {
+  const browserCheckerScriptMatch = html.match(/<script\b[^>]*browser-checker\.js[^>]*><\/script>/i);
+  if (browserCheckerScriptMatch == null ? void 0 : browserCheckerScriptMatch[0]) {
+    return html.replace(browserCheckerScriptMatch[0], `${runtimeScript}
+${browserCheckerScriptMatch[0]}`);
+  }
+  const moduleScriptMatch = html.match(/<script\b[^>]*type=["']module["'][^>]*>/i);
+  if (moduleScriptMatch == null ? void 0 : moduleScriptMatch[0]) {
+    return html.replace(moduleScriptMatch[0], `${runtimeScript}
+${moduleScriptMatch[0]}`);
+  }
+  if (html.includes("</head>")) {
+    return html.replace("</head>", `${runtimeScript}
+</head>`);
+  }
+  return `${runtimeScript}
+${html}`;
+}
+__name(injectRuntimeScript, "injectRuntimeScript");
+function splitCommaSeparatedValues(value, limit) {
+  return value.split(",", limit).map((v) => v.trim());
+}
+__name(splitCommaSeparatedValues, "splitCommaSeparatedValues");
+function getHost(req) {
+  let host = req.headers["x-forwarded-host"];
+  if (!host) {
+    host = req.headers[":authority"] || req.headers["host"];
+  }
+  if (!host) return "";
+  host = splitCommaSeparatedValues(host, 1)[0];
+  if (host.includes("@")) {
+    try {
+      host = new URL(`http://${host}`).host;
+    } catch (e) {
+      return "";
+    }
+  }
+  return host;
+}
+__name(getHost, "getHost");
+function getHostname(req) {
+  const host = getHost(req);
+  if (!host) return "";
+  return host.split(":", 1)[0];
+}
+__name(getHostname, "getHostname");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getHost,
+  getHostname,
+  injectRuntimeScript,
+  resolvePublicPath,
+  resolveV2PublicPath,
+  rewriteV2AssetPublicPath
+});