@nocobase/server 2.2.0-alpha.1 → 2.2.0-alpha.10

package/lib/app-supervisor/index.d.ts

@@ -49,6 +49,8 @@ export declare class AppSupervisor extends EventEmitter implements AsyncEmitter
     private commandAdapterName;
     private appDbCreator;
     private appConditions;
+    private appManifests;
+    private appSsoIssuer?;
     appOptionsFactory: AppOptionsFactory;
     private environmentHeartbeatInterval;
     private environmentHeartbeatTimer;
@@ -81,6 +83,8 @@ export declare class AppSupervisor extends EventEmitter implements AsyncEmitter
     registerAppDbCreator(condition: Predicate<AppDbCreatorOptions>, creator: AppDbCreator, priority?: number): void;
     createDatabase(options: AppDbCreatorOptions): Promise<void>;
     setAppOptionsFactory(factory: AppOptionsFactory): void;
+    setAppSsoIssuer(issuer?: string): void;
+    getAppSsoIssuer(): string;
     bootstrapApp(appName: string): Promise<void>;
     initApp({ appName, options }: {
         appName: string;
@@ -108,6 +112,14 @@ export declare class AppSupervisor extends EventEmitter implements AsyncEmitter
     getAppLastSeenAt(appName: string): Promise<number>;
     addAppModel(appModel: AppModel): Promise<void>;
     getAppModel(appName: string): Promise<AppModel>;
+    listAppModels(): Promise<AppModel[]>;
+    setAppManifestItem(appName: string, namespace: string, itemKey: string, item: unknown): Promise<void>;
+    removeAppManifestItem(appName: string, namespace: string, itemKey: string): Promise<void>;
+    removeAppManifest(appName: string, namespace: string): Promise<void>;
+    getAppManifestItems<T = unknown>(appName: string, namespace: string): Promise<T[]>;
+    getAppManifests<T = unknown>(namespace: string, appNames: string[]): Promise<Record<string, T[]>>;
+    private getAppManifestKey;
+    private getOrCreateAppManifest;
     registerAppCondition(name: string, condition: AppCondition): void;
     unregisterAppCondition(name: string): void;
     getAppCondition(name: string): AppCondition;

package/lib/app-supervisor/index.js

@@ -70,6 +70,8 @@ const _AppSupervisor = class _AppSupervisor extends import_events.EventEmitter {
   commandAdapterName;
   appDbCreator = new import_condition_registry.ConditionalRegistry();
   appConditions = /* @__PURE__ */ new Map();
+  appManifests = /* @__PURE__ */ new Map();
+  appSsoIssuer;
   appOptionsFactory = import_app_options_factory.appOptionsFactory;
   environmentHeartbeatInterval = 2 * 60 * 1e3;
   environmentHeartbeatTimer = null;
@@ -228,6 +230,13 @@ const _AppSupervisor = class _AppSupervisor extends import_events.EventEmitter {
   setAppOptionsFactory(factory) {
     this.appOptionsFactory = factory ?? import_app_options_factory.appOptionsFactory;
   }
+  setAppSsoIssuer(issuer) {
+    const normalized = String(issuer || "").trim().replace(/\/+$/, "");
+    this.appSsoIssuer = normalized || void 0;
+  }
+  getAppSsoIssuer() {
+    return this.appSsoIssuer;
+  }
   async bootstrapApp(appName) {
     return this.processAdapter.bootstrapApp(appName);
   }
@@ -276,6 +285,7 @@ const _AppSupervisor = class _AppSupervisor extends import_events.EventEmitter {
     await this.processAdapter.removeAllApps();
     await ((_b = (_a = this.discoveryAdapter).dispose) == null ? void 0 : _b.call(_a));
     await ((_d = (_c = this.commandAdapter) == null ? void 0 : _c.dispose) == null ? void 0 : _d.call(_c));
+    this.appManifests.clear();
     if (this.environmentHeartbeatTimer) {
       this.environmentHeartbeatTimer = null;
     }
@@ -421,6 +431,67 @@ const _AppSupervisor = class _AppSupervisor extends import_events.EventEmitter {
   async getAppModel(appName) {
     return this.discoveryAdapter.getAppModel(appName);
   }
+  async listAppModels() {
+    if (typeof this.discoveryAdapter.listAppModels !== "function") {
+      return [];
+    }
+    return this.discoveryAdapter.listAppModels();
+  }
+  async setAppManifestItem(appName, namespace, itemKey, item) {
+    if (typeof this.discoveryAdapter.setAppManifestItem === "function") {
+      return this.discoveryAdapter.setAppManifestItem(appName, namespace, itemKey, item);
+    }
+    const manifest = this.getOrCreateAppManifest(appName, namespace);
+    manifest.set(itemKey, item);
+  }
+  async removeAppManifestItem(appName, namespace, itemKey) {
+    var _a;
+    if (typeof this.discoveryAdapter.removeAppManifestItem === "function") {
+      return this.discoveryAdapter.removeAppManifestItem(appName, namespace, itemKey);
+    }
+    (_a = this.appManifests.get(this.getAppManifestKey(appName, namespace))) == null ? void 0 : _a.delete(itemKey);
+  }
+  async removeAppManifest(appName, namespace) {
+    if (typeof this.discoveryAdapter.removeAppManifest === "function") {
+      return this.discoveryAdapter.removeAppManifest(appName, namespace);
+    }
+    this.appManifests.delete(this.getAppManifestKey(appName, namespace));
+  }
+  async getAppManifestItems(appName, namespace) {
+    var _a;
+    if (typeof this.discoveryAdapter.getAppManifestItems === "function") {
+      return this.discoveryAdapter.getAppManifestItems(appName, namespace);
+    }
+    return Array.from(((_a = this.appManifests.get(this.getAppManifestKey(appName, namespace))) == null ? void 0 : _a.values()) || []);
+  }
+  async getAppManifests(namespace, appNames) {
+    if (typeof this.discoveryAdapter.getAppManifests === "function") {
+      return this.discoveryAdapter.getAppManifests(namespace, appNames);
+    }
+    const result = {};
+    await Promise.all(
+      appNames.map(async (appName) => {
+        const manifest = await this.getAppManifestItems(appName, namespace);
+        if (manifest.length > 0) {
+          result[appName] = manifest;
+        }
+      })
+    );
+    return result;
+  }
+  getAppManifestKey(appName, namespace) {
+    return `${namespace}:${appName}`;
+  }
+  getOrCreateAppManifest(appName, namespace) {
+    const key = this.getAppManifestKey(appName, namespace);
+    const manifest = this.appManifests.get(key);
+    if (manifest) {
+      return manifest;
+    }
+    const nextManifest = /* @__PURE__ */ new Map();
+    this.appManifests.set(key, nextManifest);
+    return nextManifest;
+  }
   registerAppCondition(name, condition) {
     this.appConditions.set(name, condition);
   }

package/lib/app-supervisor/main-only-adapter.d.ts

@@ -21,6 +21,7 @@ export declare class MainOnlyAdapter implements AppDiscoveryAdapter, AppProcessA
     bootstrapApp(appName: string): Promise<void>;
     addApp(app: Application): Application<import("../application").DefaultState, import("../application").DefaultContext>;
     getApps(): Application<import("../application").DefaultState, import("../application").DefaultContext>[];
+    listAppModels(): Promise<any[]>;
     hasApp(appName: string): boolean;
     startApp(appName: string): Promise<void>;
     stopApp(appName: string): Promise<void>;

package/lib/app-supervisor/main-only-adapter.js

@@ -78,6 +78,9 @@ const _MainOnlyAdapter = class _MainOnlyAdapter {
   getApps() {
     return Object.values(this.apps);
   }
+  async listAppModels() {
+    return [];
+  }
   hasApp(appName) {
     if (appName !== "main") {
       return false;

package/lib/app-supervisor/types.d.ts

@@ -66,6 +66,7 @@ export type AppModel = {
     environments?: string[];
     options: AppModelOptions;
 };
+export type AppManifestValue = unknown;
 export type AppCondition = {
     filter?: Record<string, any>;
     match?: (appModel: AppModel) => boolean;
@@ -115,11 +116,17 @@ export interface AppDiscoveryAdapter {
     loadAppModels?(mainApp: Application): Promise<void>;
     getAppsStatuses?(appNames?: string[]): Promise<AppStatusesResult> | AppStatusesResult;
     getAppsByCondition?(conditionName: string, condition: AppCondition, options?: GetAppsByConditionOptions): Promise<string[]>;
+    listAppModels?(): Promise<AppModel[]>;
     addAppsToCondition?(conditionName: string, environmentName: string, appNames: string[]): Promise<void>;
     removeAppsFromCondition?(conditionName: string, environmentName: string, appNames: string[]): Promise<void>;
     addAppModel?(appModel: AppModel): Promise<void>;
     getAppModel?(appName: string): Promise<AppModel>;
     removeAppModel?(appName: string): Promise<void>;
+    setAppManifestItem?(appName: string, namespace: string, itemKey: string, item: AppManifestValue): Promise<void>;
+    removeAppManifestItem?(appName: string, namespace: string, itemKey: string): Promise<void>;
+    removeAppManifest?(appName: string, namespace: string): Promise<void>;
+    getAppManifestItems?<T = AppManifestValue>(appName: string, namespace: string): Promise<T[]>;
+    getAppManifests?<T = AppManifestValue>(namespace: string, appNames: string[]): Promise<Record<string, T[]>>;
     getAppNameByCName?(cname: string): Promise<string | null>;
     registerEnvironment?(environment: EnvironmentInfo): Promise<boolean>;
     unregisterEnvironment?(): Promise<void>;

package/lib/application.js

@@ -944,6 +944,7 @@ const _Application = class _Application extends import_koa.default {
       }
     });
     this._dataSourceManager.use(this._authManager.middleware(), { tag: "auth", before: "default" });
+    this._dataSourceManager.use(import_auth.csrfMiddleware, { tag: "csrf", after: "auth", before: "default" });
     this._dataSourceManager.use(import_validate_filter_params.default, { tag: "validate-filter-params", before: ["auth"] });
     this._dataSourceManager.use(import_middlewares.parseVariables, {
       group: "parseVariables",

package/lib/event-queue.d.ts

@@ -53,17 +53,18 @@ export interface EventQueueOptions {
 export declare class MemoryEventQueueAdapter implements IEventQueueAdapter {
     private options;
     private connected;
-    private emitter;
     private reading;
+    private scheduledChannels;
     protected events: Map<string, QueueEventOptions>;
     protected queues: Map<string, {
         id: string;
         content: any;
         options?: QueueMessageOptions;
     }[]>;
-    get processing(): Promise<Promise<void>[][]>;
+    get processing(): Promise<void[]>;
     private get storagePath();
     listen: (channel: string) => void;
+    private scheduleListen;
     constructor(options: {
         appName: string;
         logger: SystemLogger;

package/lib/event-queue.js

@@ -46,7 +46,6 @@ __export(event_queue_exports, {
 });
 module.exports = __toCommonJS(event_queue_exports);
 var import_crypto = require("crypto");
-var import_events = require("events");
 var import_path = __toESM(require("path"));
 var import_promises = __toESM(require("fs/promises"));
 var import_utils = require("@nocobase/utils");
@@ -56,15 +55,14 @@ const QUEUE_DEFAULT_ACK_TIMEOUT = 15e3;
 const _MemoryEventQueueAdapter = class _MemoryEventQueueAdapter {
   constructor(options) {
     this.options = options;
-    this.emitter.setMaxListeners(0);
   }
   connected = false;
-  emitter = new import_events.EventEmitter();
   reading = /* @__PURE__ */ new Map();
+  scheduledChannels = /* @__PURE__ */ new Set();
   events = /* @__PURE__ */ new Map();
   queues = /* @__PURE__ */ new Map();
   get processing() {
-    const processing = Array.from(this.reading.values());
+    const processing = Array.from(this.reading.values()).flat();
     if (processing.length > 0) {
       return Promise.all(processing);
     }
@@ -80,7 +78,6 @@ const _MemoryEventQueueAdapter = class _MemoryEventQueueAdapter {
     const { logger } = this.options;
     const event = this.events.get(channel);
     if (!event) {
-      logger.warn(`memory queue (${channel}) not found, skipping...`);
       return;
     }
     if (!event.idle()) {
@@ -99,10 +96,24 @@ const _MemoryEventQueueAdapter = class _MemoryEventQueueAdapter {
         if (index > -1) {
           reading.splice(index, 1);
         }
+        this.scheduleListen(channel);
       });
     });
     this.reading.set(channel, reading);
   }, "listen");
+  scheduleListen(channel) {
+    if (this.scheduledChannels.has(channel)) {
+      return;
+    }
+    this.scheduledChannels.add(channel);
+    setImmediate(() => {
+      this.scheduledChannels.delete(channel);
+      if (!this.events.has(channel)) {
+        return;
+      }
+      this.listen(channel);
+    });
+  }
   isConnected() {
     return this.connected;
   }
@@ -181,7 +192,6 @@ const _MemoryEventQueueAdapter = class _MemoryEventQueueAdapter {
     if (!this.queues.has(channel)) {
       this.queues.set(channel, []);
     }
-    this.emitter.on(channel, this.listen);
     if (this.connected) {
       this.consume(channel);
     }
@@ -191,12 +201,12 @@ const _MemoryEventQueueAdapter = class _MemoryEventQueueAdapter {
       return;
     }
     this.events.delete(channel);
-    this.emitter.off(channel, this.listen);
   }
   publish(channel, content, options = { timestamp: Date.now() }) {
+    const { logger } = this.options;
     const event = this.events.get(channel);
     if (!event) {
-      console.debug(`memory queue (${channel}) not subscribed, skip`);
+      logger.debug(`memory queue (${channel}) not subscribed, skip`);
       return;
     }
     if (!this.queues.get(channel)) {
@@ -205,11 +215,8 @@ const _MemoryEventQueueAdapter = class _MemoryEventQueueAdapter {
     const queue = this.queues.get(channel);
     const message = { id: (0, import_crypto.randomUUID)(), content, options };
     queue.push(message);
-    const { logger } = this.options;
     logger.debug(`memory queue (${channel}) published message`, content);
-    setImmediate(() => {
-      this.emitter.emit(channel, channel);
-    });
+    this.scheduleListen(channel);
   }
   async consume(channel, once = false) {
     while (this.connected && this.events.get(channel)) {

package/lib/gateway/index.d.ts

@@ -80,6 +80,11 @@ export declare class Gateway extends EventEmitter {
     responseErrorWithCode(code: any, res: any, options: any): void;
     private getV2PublicPath;
     private getAppPublicPath;
+    private getPortalRootPublicPath;
+    private getPortalAppPublicPath;
+    private getPortalMatch;
+    private isPortalIndexRequest;
+    private getPortalDistRoot;
     private isV2Request;
     private isV2IndexRequest;
     private getV2RuntimeConfig;

package/lib/gateway/index.js

@@ -78,6 +78,17 @@ function normalizeBasePath(path = "") {
   return normalized || "/";
 }
 __name(normalizeBasePath, "normalizeBasePath");
+function getFilesPathPrefixes(appPublicPath = "/") {
+  const normalizedPublicPath = normalizeBasePath(appPublicPath);
+  const canonicalPrefix = `${normalizedPublicPath === "/" ? "" : normalizedPublicPath}/files/`;
+  return canonicalPrefix === "/files/" ? ["/files/"] : [canonicalPrefix, "/files/"];
+}
+__name(getFilesPathPrefixes, "getFilesPathPrefixes");
+function getFileAccessRestPath(pathname, appPublicPath = "/") {
+  const prefix = getFilesPathPrefixes(appPublicPath).find((prefix2) => pathname.startsWith(prefix2));
+  return prefix ? pathname.slice(prefix.length) : null;
+}
+__name(getFileAccessRestPath, "getFileAccessRestPath");
 function getSocketPath() {
   const socketPath = import_node_process.default.env.SOCKET_PATH;
   if (socketPath) {
@@ -177,19 +188,28 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
     this.selectorMiddlewares = new import_utils.Toposort();
     this.addAppSelectorMiddleware(
       async (ctx, next) => {
-        var _a, _b;
+        var _a, _b, _c;
         const { req } = ctx;
         const parsedUrl = (0, import_url.parse)(req.url);
         const appName = (_a = import_qs.default.parse(parsedUrl.query)) == null ? void 0 : _a.__appName;
         const apiBasePath = normalizeBasePath(import_node_process.default.env.API_BASE_PATH || "/api");
         const appPathPrefix = `${apiBasePath}/__app/`;
+        const appPublicPath = (0, import_utils3.resolvePublicPath)(import_node_process.default.env.APP_PUBLIC_PATH || "/");
+        const portalAppsPathPrefix = `${appPublicPath.replace(/\/$/, "")}/${import_utils3.PORTAL_CLIENT_PREFIX}/apps/`;
         if (req.headers["x-app"]) {
           ctx.resolvedAppName = req.headers["x-app"];
         }
         if (appName) {
           ctx.resolvedAppName = appName;
         }
-        if ((_b = parsedUrl.pathname) == null ? void 0 : _b.startsWith(appPathPrefix)) {
+        if ((_b = parsedUrl.pathname) == null ? void 0 : _b.startsWith(portalAppsPathPrefix)) {
+          const restPath = parsedUrl.pathname.slice(portalAppsPathPrefix.length);
+          const [pathAppName] = restPath.split("/");
+          if (pathAppName) {
+            ctx.resolvedAppName = (0, import_utils3.normalizePortalAppName)(pathAppName);
+          }
+        }
+        if ((_c = parsedUrl.pathname) == null ? void 0 : _c.startsWith(appPathPrefix)) {
           const restPath = parsedUrl.pathname.slice(appPathPrefix.length);
           const [pathAppName, ...segments] = restPath.split("/");
           if (pathAppName) {
@@ -202,6 +222,17 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
             req.url = rewrittenUrl;
           }
         }
+        const fileAccessRestPath = parsedUrl.pathname ? getFileAccessRestPath(parsedUrl.pathname, import_node_process.default.env.APP_PUBLIC_PATH || "/") : null;
+        if (fileAccessRestPath) {
+          const restPath = fileAccessRestPath;
+          const [pathAppName] = restPath.split("/");
+          if (pathAppName) {
+            try {
+              ctx.resolvedAppName = decodeURIComponent(pathAppName);
+            } catch (error) {
+            }
+          }
+        }
         await next();
       },
       {
@@ -270,6 +301,62 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
   getAppPublicPath() {
     return (0, import_utils3.resolvePublicPath)(import_node_process.default.env.APP_PUBLIC_PATH || "/");
   }
+  getPortalRootPublicPath() {
+    return `${this.getAppPublicPath().replace(/\/$/, "")}/${import_utils3.PORTAL_CLIENT_PREFIX}/`;
+  }
+  getPortalAppPublicPath(appName) {
+    if (appName === import_utils3.DEFAULT_PORTAL_APP_NAME) {
+      return this.getPortalRootPublicPath();
+    }
+    return `${this.getPortalRootPublicPath()}apps/${(0, import_utils3.normalizePortalAppName)(appName)}/`;
+  }
+  getPortalMatch(pathname) {
+    const portalRootPublicPath = this.getPortalRootPublicPath();
+    if (!pathname.startsWith(portalRootPublicPath)) {
+      return null;
+    }
+    let appName = import_utils3.DEFAULT_PORTAL_APP_NAME;
+    let publicRoot = portalRootPublicPath;
+    let restPath = pathname.slice(portalRootPublicPath.length).replace(/^\/+/, "");
+    const [firstSegment, secondSegment, ...remainingSegments] = restPath.split("/");
+    if (firstSegment === "apps") {
+      if (!secondSegment || !/^[A-Za-z0-9_-]+$/.test(secondSegment)) {
+        return null;
+      }
+      appName = (0, import_utils3.normalizePortalAppName)(secondSegment);
+      publicRoot = this.getPortalAppPublicPath(appName);
+      if (!pathname.startsWith(publicRoot)) {
+        return null;
+      }
+      restPath = remainingSegments.join("/").replace(/^\/+/, "");
+    }
+    const [portalName] = restPath.split("/");
+    if (!portalName || !/^[A-Za-z0-9_-]+$/.test(portalName)) {
+      return null;
+    }
+    return {
+      appName,
+      portalName,
+      publicPath: `${publicRoot}${portalName}/`
+    };
+  }
+  isPortalIndexRequest(pathname, portalPublicPath) {
+    if (pathname === portalPublicPath || pathname === portalPublicPath.slice(0, -1) || pathname === `${portalPublicPath}index.html`) {
+      return true;
+    }
+    return !(0, import_path.extname)(pathname);
+  }
+  getPortalDistRoot(portalMatch) {
+    const scopedRoot = (0, import_utils.storagePathJoin)("portals", portalMatch.appName, portalMatch.portalName, "dist");
+    if (portalMatch.appName !== import_utils3.DEFAULT_PORTAL_APP_NAME) {
+      return scopedRoot;
+    }
+    const legacyRoot = (0, import_utils.storagePathJoin)("portals", portalMatch.portalName, "dist");
+    if (!import_fs.default.existsSync((0, import_path.resolve)(scopedRoot, "index.html")) && import_fs.default.existsSync((0, import_path.resolve)(legacyRoot, "index.html"))) {
+      return legacyRoot;
+    }
+    return scopedRoot;
+  }
   isV2Request(pathname) {
     const v2PublicPath = this.getV2PublicPath();
     return pathname === v2PublicPath.slice(0, -1) || pathname.startsWith(v2PublicPath);
@@ -337,7 +424,7 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
     return (0, import_utils3.injectRuntimeScript)(html, this.getV2RuntimeConfigScript());
   }
   async requestHandler(req, res) {
-    const { pathname } = (0, import_url.parse)(req.url);
+    const { pathname, search } = (0, import_url.parse)(req.url);
     const { PLUGIN_STATICS_PATH } = import_node_process.default.env;
     const APP_PUBLIC_PATH = this.getAppPublicPath();
     if (pathname.endsWith("/__umi/api/bundle-status")) {
@@ -345,6 +432,12 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
       res.end("ok");
       return;
     }
+    if (APP_PUBLIC_PATH !== "/" && pathname.startsWith("/files/")) {
+      res.statusCode = 302;
+      res.setHeader("Location", `${APP_PUBLIC_PATH.replace(/\/$/, "")}${pathname}${search || ""}`);
+      res.end();
+      return;
+    }
     const supervisor = import_app_supervisor.AppSupervisor.getInstance();
     let handleApp = "main";
     try {
@@ -361,15 +454,18 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
           return;
         }
       }
-      const headers = (0, import_static_file_security.getStorageUploadSecurityHeaders)(pathname);
-      for (const [key, value] of Object.entries(headers)) {
-        res.setHeader(key, value);
-      }
+      const headers = (0, import_static_file_security.getStorageUploadSecurityHeaders)(`${pathname}${search || ""}`);
       req.url = req.url.substring(APP_PUBLIC_PATH.length + "storage".length);
       await compress(req, res);
       return (0, import_serve_handler.default)(req, res, {
         public: (0, import_utils.resolveStorageRoot)(),
-        directoryListing: false
+        directoryListing: false,
+        headers: [
+          {
+            source: "**/*",
+            headers: Object.entries(headers).map(([key, value]) => ({ key, value }))
+          }
+        ]
       });
     }
     if (pathname.startsWith(APP_PUBLIC_PATH + "dist/")) {
@@ -407,7 +503,47 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
         ]
       });
     }
-    if (!pathname.startsWith(import_node_process.default.env.API_BASE_PATH)) {
+    const isFilesRequest = Boolean(getFileAccessRestPath(pathname, APP_PUBLIC_PATH));
+    if (!pathname.startsWith(import_node_process.default.env.API_BASE_PATH) && !isFilesRequest) {
+      const portalMatch = this.getPortalMatch(pathname);
+      if (portalMatch) {
+        if (handleApp !== "main" && handleApp !== portalMatch.appName) {
+          const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);
+          if (isProxy) {
+            return;
+          }
+        }
+        if (!pathname.startsWith(portalMatch.publicPath)) {
+          res.statusCode = 302;
+          res.setHeader("Location", `${portalMatch.publicPath}${search || ""}`);
+          res.end();
+          return;
+        }
+        const portalDistRoot = this.getPortalDistRoot(portalMatch);
+        const portalIndex = (0, import_path.resolve)(portalDistRoot, "index.html");
+        if (!import_fs.default.existsSync(portalIndex)) {
+          res.statusCode = 404;
+          res.end();
+          return;
+        }
+        if (this.isPortalIndexRequest(pathname, portalMatch.publicPath)) {
+          res.setHeader("Content-Type", "text/html; charset=utf-8");
+          res.end(import_fs.default.readFileSync(portalIndex, "utf-8"));
+          return;
+        }
+        req.url = req.url.substring(portalMatch.publicPath.length - 1);
+        await compress(req, res);
+        return (0, import_serve_handler.default)(req, res, {
+          public: portalDistRoot,
+          directoryListing: false
+        });
+      }
+      const portalRootPublicPath = this.getPortalRootPublicPath();
+      if (pathname === portalRootPublicPath.slice(0, -1) || pathname.startsWith(portalRootPublicPath)) {
+        res.statusCode = 404;
+        res.end();
+        return;
+      }
       if (this.isV2Request(pathname)) {
         if (handleApp !== "main") {
           const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);

package/lib/gateway/static-file-security.js

@@ -42,11 +42,31 @@ __export(static_file_security_exports, {
 });
 module.exports = __toCommonJS(static_file_security_exports);
 var import_node_path = __toESM(require("node:path"));
-const ACTIVE_CONTENT_EXTENSIONS = /* @__PURE__ */ new Set([".htm", ".html", ".pdf", ".svg", ".svgz", ".xhtml"]);
+const ACTIVE_CONTENT_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".htm",
+  ".html",
+  ".pdf",
+  ".svg",
+  ".svgz",
+  ".xht",
+  ".xhtml",
+  ".xml",
+  ".xsl",
+  ".xslt"
+]);
 function stripQueryAndHash(pathname = "") {
   return pathname.split("?")[0].split("#")[0];
 }
 __name(stripQueryAndHash, "stripQueryAndHash");
+function shouldDownload(pathname = "") {
+  var _a;
+  const query = (_a = pathname.split("?")[1]) == null ? void 0 : _a.split("#")[0];
+  if (!query) {
+    return false;
+  }
+  return new URLSearchParams(query).get("download") === "1";
+}
+__name(shouldDownload, "shouldDownload");
 function hasActiveContentExtension(pathname = "") {
   const ext = import_node_path.default.extname(stripQueryAndHash(pathname)).toLowerCase();
   return ACTIVE_CONTENT_EXTENSIONS.has(ext);
@@ -54,9 +74,10 @@ function hasActiveContentExtension(pathname = "") {
 __name(hasActiveContentExtension, "hasActiveContentExtension");
 function getStorageUploadSecurityHeaders(pathname = "") {
   const headers = {
+    "Content-Security-Policy": "sandbox",
     "X-Content-Type-Options": "nosniff"
   };
-  if (hasActiveContentExtension(pathname)) {
+  if (hasActiveContentExtension(pathname) || shouldDownload(pathname)) {
     headers["Content-Disposition"] = "attachment";
   }
   return headers;

package/lib/gateway/utils.d.ts

@@ -10,9 +10,15 @@
 import { IncomingMessage } from 'http';
 import { IncomingRequest } from '.';
 export declare const MODERN_CLIENT_DIST_DIR = "v";
+export declare const PORTAL_CLIENT_PREFIX = "x";
+export declare const DEFAULT_PORTAL_APP_NAME = "main";
+export declare const DEFAULT_PORTAL_NAME = "admin";
 export declare function resolvePublicPath(appPublicPath?: string): string;
 export declare function normalizeModernClientPrefix(value?: string): string;
 export declare function resolveV2PublicPath(appPublicPath?: string): string;
+export declare function normalizePortalName(value?: string): string;
+export declare function normalizePortalAppName(value?: string): string;
+export declare function resolvePortalPublicPath(portalName: string, appPublicPath?: string): string;
 export declare function rewriteV2AssetPublicPath(html: string, assetPublicPath: string): string;
 export declare function injectRuntimeScript(html: string, runtimeScript: string): string;
 export declare function getHost(req: IncomingMessage | IncomingRequest): any;

package/lib/gateway/utils.js

@@ -27,17 +27,26 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var utils_exports = {};
 __export(utils_exports, {
+  DEFAULT_PORTAL_APP_NAME: () => DEFAULT_PORTAL_APP_NAME,
+  DEFAULT_PORTAL_NAME: () => DEFAULT_PORTAL_NAME,
   MODERN_CLIENT_DIST_DIR: () => MODERN_CLIENT_DIST_DIR,
+  PORTAL_CLIENT_PREFIX: () => PORTAL_CLIENT_PREFIX,
   getHost: () => getHost,
   getHostname: () => getHostname,
   injectRuntimeScript: () => injectRuntimeScript,
   normalizeModernClientPrefix: () => normalizeModernClientPrefix,
+  normalizePortalAppName: () => normalizePortalAppName,
+  normalizePortalName: () => normalizePortalName,
+  resolvePortalPublicPath: () => resolvePortalPublicPath,
   resolvePublicPath: () => resolvePublicPath,
   resolveV2PublicPath: () => resolveV2PublicPath,
   rewriteV2AssetPublicPath: () => rewriteV2AssetPublicPath
 });
 module.exports = __toCommonJS(utils_exports);
 const MODERN_CLIENT_DIST_DIR = "v";
+const PORTAL_CLIENT_PREFIX = "x";
+const DEFAULT_PORTAL_APP_NAME = "main";
+const DEFAULT_PORTAL_NAME = "admin";
 function resolvePublicPath(appPublicPath = "/") {
   const normalized = String(appPublicPath || "/").trim() || "/";
   const withLeadingSlash = normalized.startsWith("/") ? normalized : `/${normalized}`;
@@ -55,6 +64,21 @@ function resolveV2PublicPath(appPublicPath = "/") {
   return `${publicPath.replace(/\/$/, "")}/${prefix}/`;
 }
 __name(resolveV2PublicPath, "resolveV2PublicPath");
+function normalizePortalName(value) {
+  const segment = String(value || "").trim().replace(/^\/+|\/+$/g, "");
+  return segment || DEFAULT_PORTAL_NAME;
+}
+__name(normalizePortalName, "normalizePortalName");
+function normalizePortalAppName(value) {
+  const segment = String(value || "").trim().replace(/^\/+|\/+$/g, "");
+  return segment || DEFAULT_PORTAL_APP_NAME;
+}
+__name(normalizePortalAppName, "normalizePortalAppName");
+function resolvePortalPublicPath(portalName, appPublicPath = "/") {
+  const publicPath = resolvePublicPath(appPublicPath);
+  return `${publicPath.replace(/\/$/, "")}/${PORTAL_CLIENT_PREFIX}/${normalizePortalName(portalName)}/`;
+}
+__name(resolvePortalPublicPath, "resolvePortalPublicPath");
 function ensureTrailingSlash(value) {
   return value.endsWith("/") ? value : `${value}/`;
 }
@@ -117,11 +141,17 @@ function getHostname(req) {
 __name(getHostname, "getHostname");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  DEFAULT_PORTAL_APP_NAME,
+  DEFAULT_PORTAL_NAME,
   MODERN_CLIENT_DIST_DIR,
+  PORTAL_CLIENT_PREFIX,
   getHost,
   getHostname,
   injectRuntimeScript,
   normalizeModernClientPrefix,
+  normalizePortalAppName,
+  normalizePortalName,
+  resolvePortalPublicPath,
   resolvePublicPath,
   resolveV2PublicPath,
   rewriteV2AssetPublicPath

package/lib/helper.d.ts

@@ -11,6 +11,7 @@ import { Command } from 'commander';
 import Application, { ApplicationOptions } from './application';
 export declare function createI18n(options: ApplicationOptions): import("i18next").i18n;
 export declare function createResourcer(options: ApplicationOptions): Resourcer;
+export declare function resolveCorsOrigin(ctx: any): any;
 export declare function registerMiddlewares(app: Application, options: ApplicationOptions): void;
 export declare const createAppProxy: (app: Application) => Application<import("./application").DefaultState, import("./application").DefaultContext>;
 export declare const getCommandFullName: (command: Command) => string;

package/lib/helper.js

@@ -45,6 +45,7 @@ __export(helper_exports, {
   getBodyLimit: () => getBodyLimit,
   getCommandFullName: () => getCommandFullName,
   registerMiddlewares: () => registerMiddlewares,
+  resolveCorsOrigin: () => resolveCorsOrigin,
   tsxRerunning: () => tsxRerunning
 });
 module.exports = __toCommonJS(helper_exports);
@@ -76,23 +77,25 @@ function createResourcer(options) {
   return new import_resourcer.Resourcer({ ...options.resourcer });
 }
 __name(createResourcer, "createResourcer");
+function isWhitelistedCorsOrigin(ctx) {
+  const origin = ctx.get("origin");
+  if (!origin) {
+    return false;
+  }
+  return (0, import_utils.isTrustedOrigin)(ctx, origin);
+}
+__name(isWhitelistedCorsOrigin, "isWhitelistedCorsOrigin");
 function resolveCorsOrigin(ctx) {
   const origin = ctx.get("origin");
   const disallowNoOrigin = process.env.CORS_DISALLOW_NO_ORIGIN === "true";
-  const whitelistString = process.env.CORS_ORIGIN_WHITELIST;
+  const whitelist = (0, import_utils.getCorsWhitelist)();
   if (!origin && disallowNoOrigin) {
     return false;
   }
-  if (!whitelistString) {
+  if (isWhitelistedCorsOrigin(ctx)) {
     return origin;
   }
-  const whitelist = new Set(
-    whitelistString.split(",").map((item) => item.trim()).filter(Boolean)
-  );
-  if (whitelist.has(origin)) {
-    return origin;
-  }
-  return false;
+  return whitelist ? false : origin;
 }
 __name(resolveCorsOrigin, "resolveCorsOrigin");
 function registerMiddlewares(app, options) {
@@ -108,6 +111,7 @@ function registerMiddlewares(app, options) {
   app.use((0, import_logger.requestLogger)(app.name, app.requestLogger, (_a = options.logger) == null ? void 0 : _a.request), { tag: "logger" });
   app.use(
     (0, import_cors.default)({
+      credentials: isWhitelistedCorsOrigin,
       exposeHeaders: ["content-disposition"],
       origin: resolveCorsOrigin,
       ...options.cors
@@ -134,8 +138,18 @@ function registerMiddlewares(app, options) {
   }
   app.use(/* @__PURE__ */ __name(async function getBearerToken(ctx, next) {
     ctx.getBearerToken = () => {
-      const token = ctx.get("Authorization").replace(/^Bearer\s+/gi, "");
-      return token || ctx.query.token;
+      const authorization = ctx.get("Authorization");
+      if (authorization) {
+        ctx.state.pendingAuthTokenSource = "authorization";
+        return authorization.replace(/^Bearer\s+/gi, "");
+      }
+      if (ctx.query.token) {
+        ctx.state.pendingAuthTokenSource = "query";
+        return ctx.query.token;
+      }
+      const cookieToken = ctx.cookies.get((0, import_utils.getAuthCookieName)("authToken", app.name));
+      ctx.state.pendingAuthTokenSource = cookieToken ? "cookie" : void 0;
+      return cookieToken;
     };
     await next();
   }, "getBearerToken"));
@@ -309,5 +323,6 @@ __name(createContextVariablesScope, "createContextVariablesScope");
   getBodyLimit,
   getCommandFullName,
   registerMiddlewares,
+  resolveCorsOrigin,
   tsxRerunning
 });

package/lib/index.d.ts

@@ -13,6 +13,7 @@ export * from './gateway/ws-server';
 export { Application as default } from './application';
 export * from './audit-manager';
 export * from './gateway';
+export * from './gateway/static-file-security';
 export * as middlewares from './middlewares';
 export * from './migration';
 export * from './plugin';

package/lib/index.js

@@ -55,6 +55,7 @@ __reExport(src_exports, require("./gateway/ws-server"), module.exports);
 var import_application = require("./application");
 __reExport(src_exports, require("./audit-manager"), module.exports);
 __reExport(src_exports, require("./gateway"), module.exports);
+__reExport(src_exports, require("./gateway/static-file-security"), module.exports);
 var middlewares = __toESM(require("./middlewares"));
 __reExport(src_exports, require("./migration"), module.exports);
 __reExport(src_exports, require("./plugin"), module.exports);
@@ -85,6 +86,7 @@ var import_helper = require("./helper");
   ...require("./gateway/ws-server"),
   ...require("./audit-manager"),
   ...require("./gateway"),
+  ...require("./gateway/static-file-security"),
   ...require("./migration"),
   ...require("./plugin"),
   ...require("./plugin-manager"),

package/lib/plugin-manager/deps.js

@@ -47,7 +47,7 @@ const deps = {
   koa: "3.x",
   "@koa/cors": "5.x",
   "@koa/router": "13.x",
-  multer: "1.x",
+  multer: "2.x",
   "@koa/multer": "3.x",
   "koa-bodyparser": "4.x",
   "koa-static": "5.x",

package/lib/plugin-manager/findPackageNames.js

@@ -62,6 +62,7 @@ async function trim(packageNames) {
 }
 __name(trim, "trim");
 const excludes = [
+  "external-db-data-source",
   "@nocobase/plugin-audit-logs",
   "@nocobase/plugin-backup-restore",
   "@nocobase/plugin-charts",

package/lib/plugin-manager/options/resource.js

@@ -302,12 +302,19 @@ var resource_default = {
       if (!keys.length) {
         ctx.throw(400, "plugin name invalid");
       }
+      for (const key of keys) {
+        try {
+          (0, import_utils2.assertSafePluginPackageName)(key);
+        } catch (error) {
+          ctx.throw(400, "plugin name invalid");
+        }
+      }
       const awaitResponse = coerceAwaitResponse(awaitResponseRaw);
       const argv = ["pm", "enable", ...keys];
       if (awaitResponse) {
         await app.runAsCLI(argv, { from: "user", throwError: true });
       } else {
-        void app.runAsCLI(argv, { from: "user" }).catch((err) => {
+        app.runAsCLI(argv, { from: "user" }).catch((err) => {
           app.log.error(err);
         });
       }
@@ -326,7 +333,7 @@ var resource_default = {
       if (awaitResponse) {
         await app.runAsCLI(argv, { from: "user", throwError: true });
       } else {
-        void app.runAsCLI(argv, { from: "user" }).catch((err) => {
+        app.runAsCLI(argv, { from: "user" }).catch((err) => {
           app.log.error(err);
         });
       }
@@ -344,7 +351,7 @@ var resource_default = {
       await next();
     },
     async list(ctx, next) {
-      const { mode } = ctx.action.params;
+      const { mode, v2 } = ctx.action.params;
       if (mode === "summary") {
         ctx.body = await (0, import_utils2.pmListSummary)(ctx.app);
         return next();
@@ -352,7 +359,18 @@ var resource_default = {
       const locale = ctx.getCurrentLocale();
       const pm = ctx.app.pm;
       const plugin = pm.get("nocobase");
-      ctx.body = await plugin.getAllPlugins(locale);
+      const plugins = await plugin.getAllPlugins(locale);
+      ctx.body = plugins.filter((item) => {
+        var _a;
+        if (process.env.NOCOBASE_SHOW_DEPRECATED_PLUGINS === "true") {
+          return true;
+        }
+        if (!v2) {
+          return true;
+        }
+        const nocobaseConfig = ((_a = item == null ? void 0 : item.packageJson) == null ? void 0 : _a.nocobase) || {};
+        return nocobaseConfig.internal !== true && nocobaseConfig.deprecated !== true;
+      });
       await next();
     },
     async listEnabled(ctx, next) {

package/lib/plugin-manager/plugin-manager.js

@@ -233,6 +233,7 @@ const _PluginManager = class _PluginManager {
     }
   }
   static async parseName(nameOrPkg) {
+    (0, import_utils2.assertSafePluginPackageName)(nameOrPkg);
     if (this.parsedNames[nameOrPkg]) {
       return this.parsedNames[nameOrPkg];
     }

package/lib/plugin.js

@@ -276,7 +276,7 @@ const _Plugin = class _Plugin {
       "fr-FR": "fr/"
     };
     if (packageName.startsWith("@nocobase/plugin-")) {
-      packageJson.homepage = `https://v2.docs.nocobase.com/${langMap[locale] || ""}plugins/${packageName}`;
+      packageJson.homepage = `https://docs.nocobase.com/${langMap[locale] || ""}plugins/${packageName}`;
     }
     const results = {
       ...this.options,

package/lib/swagger/app.d.ts

@@ -12,7 +12,23 @@ declare const _default: {
             readonly tags: readonly ["app"];
             readonly summary: "Get the current application language";
             readonly description: "Return the current locale used by the server.";
-            readonly parameters: readonly [];
+            readonly parameters: readonly [{
+                readonly name: "locale";
+                readonly in: "query";
+                readonly required: false;
+                readonly schema: {
+                    readonly type: "string";
+                };
+                readonly description: "Requested application locale. The server validates it against enabled languages.";
+            }, {
+                readonly name: "ns";
+                readonly in: "query";
+                readonly required: false;
+                readonly schema: {
+                    readonly type: "string";
+                };
+                readonly description: "Comma-separated resource namespaces to return. Omit it to preserve the full legacy payload.";
+            }];
             readonly responses: {
                 readonly 200: {
                     readonly description: "OK";

package/lib/swagger/app.js

@@ -35,7 +35,22 @@ var app_default = {
       tags: ["app"],
       summary: "Get the current application language",
       description: "Return the current locale used by the server.",
-      parameters: [],
+      parameters: [
+        {
+          name: "locale",
+          in: "query",
+          required: false,
+          schema: { type: "string" },
+          description: "Requested application locale. The server validates it against enabled languages."
+        },
+        {
+          name: "ns",
+          in: "query",
+          required: false,
+          schema: { type: "string" },
+          description: "Comma-separated resource namespaces to return. Omit it to preserve the full legacy payload."
+        }
+      ],
       responses: {
         200: {
           description: "OK",

package/lib/swagger/index.d.ts

@@ -694,7 +694,23 @@ declare const _default: {
                 readonly tags: readonly ["app"];
                 readonly summary: "Get the current application language";
                 readonly description: "Return the current locale used by the server.";
-                readonly parameters: readonly [];
+                readonly parameters: readonly [{
+                    readonly name: "locale";
+                    readonly in: "query";
+                    readonly required: false;
+                    readonly schema: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Requested application locale. The server validates it against enabled languages.";
+                }, {
+                    readonly name: "ns";
+                    readonly in: "query";
+                    readonly required: false;
+                    readonly schema: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Comma-separated resource namespaces to return. Omit it to preserve the full legacy payload.";
+                }];
                 readonly responses: {
                     readonly 200: {
                         readonly description: "OK";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/server",
-  "version": "2.2.0-alpha.1",
+  "version": "2.2.0-alpha.10",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -10,21 +10,21 @@
     "@koa/cors": "^5.0.0",
     "@koa/multer": "^3.1.0",
     "@koa/router": "^13.1.0",
-    "@nocobase/acl": "2.2.0-alpha.1",
-    "@nocobase/actions": "2.2.0-alpha.1",
-    "@nocobase/ai": "2.2.0-alpha.1",
-    "@nocobase/auth": "2.2.0-alpha.1",
-    "@nocobase/cache": "2.2.0-alpha.1",
-    "@nocobase/data-source-manager": "2.2.0-alpha.1",
-    "@nocobase/database": "2.2.0-alpha.1",
-    "@nocobase/evaluators": "2.2.0-alpha.1",
-    "@nocobase/lock-manager": "2.2.0-alpha.1",
-    "@nocobase/logger": "2.2.0-alpha.1",
-    "@nocobase/resourcer": "2.2.0-alpha.1",
-    "@nocobase/sdk": "2.2.0-alpha.1",
-    "@nocobase/snowflake-id": "2.2.0-alpha.1",
-    "@nocobase/telemetry": "2.2.0-alpha.1",
-    "@nocobase/utils": "2.2.0-alpha.1",
+    "@nocobase/acl": "2.2.0-alpha.10",
+    "@nocobase/actions": "2.2.0-alpha.10",
+    "@nocobase/ai": "2.2.0-alpha.10",
+    "@nocobase/auth": "2.2.0-alpha.10",
+    "@nocobase/cache": "2.2.0-alpha.10",
+    "@nocobase/data-source-manager": "2.2.0-alpha.10",
+    "@nocobase/database": "2.2.0-alpha.10",
+    "@nocobase/evaluators": "2.2.0-alpha.10",
+    "@nocobase/lock-manager": "2.2.0-alpha.10",
+    "@nocobase/logger": "2.2.0-alpha.10",
+    "@nocobase/resourcer": "2.2.0-alpha.10",
+    "@nocobase/sdk": "2.2.0-alpha.10",
+    "@nocobase/snowflake-id": "2.2.0-alpha.10",
+    "@nocobase/telemetry": "2.2.0-alpha.10",
+    "@nocobase/utils": "2.2.0-alpha.10",
     "@types/decompress": "4.2.7",
     "@types/ini": "^1.3.31",
     "@types/koa-send": "^4.1.3",
@@ -47,7 +47,7 @@
     "koa-send": "^5.0.1",
     "koa-static": "^5.0.0",
     "lodash": "^4.17.21",
-    "multer": "^1.4.5-lts.2",
+    "multer": "^2.1.1",
     "nanoid": "^3.3.11",
     "p-queue": "^6.6.2",
     "redis": "^5.10.0",
@@ -61,5 +61,5 @@
     "@types/serve-handler": "^6.1.1",
     "@types/ws": "^8.5.5"
   },
-  "gitHead": "303663aba6c6eefa27e6a6435b4c0352074ec40f"
+  "gitHead": "b5a3f131bb0a4a2fbfd96852896bccadc933d834"
 }