@nocobase/server 2.2.0-beta.9 → 2.3.0-alpha.1

package/lib/app-supervisor/index.d.ts

@@ -49,6 +49,7 @@ export declare class AppSupervisor extends EventEmitter implements AsyncEmitter
     private commandAdapterName;
     private appDbCreator;
     private appConditions;
+    private appManifests;
     private appSsoIssuer?;
     appOptionsFactory: AppOptionsFactory;
     private environmentHeartbeatInterval;
@@ -117,6 +118,8 @@ export declare class AppSupervisor extends EventEmitter implements AsyncEmitter
     removeAppManifest(appName: string, namespace: string): Promise<void>;
     getAppManifestItems<T = unknown>(appName: string, namespace: string): Promise<T[]>;
     getAppManifests<T = unknown>(namespace: string, appNames: string[]): Promise<Record<string, T[]>>;
+    private getAppManifestKey;
+    private getOrCreateAppManifest;
     registerAppCondition(name: string, condition: AppCondition): void;
     unregisterAppCondition(name: string): void;
     getAppCondition(name: string): AppCondition;

package/lib/app-supervisor/index.js

@@ -70,6 +70,7 @@ const _AppSupervisor = class _AppSupervisor extends import_events.EventEmitter {
   commandAdapterName;
   appDbCreator = new import_condition_registry.ConditionalRegistry();
   appConditions = /* @__PURE__ */ new Map();
+  appManifests = /* @__PURE__ */ new Map();
   appSsoIssuer;
   appOptionsFactory = import_app_options_factory.appOptionsFactory;
   environmentHeartbeatInterval = 2 * 60 * 1e3;
@@ -284,6 +285,7 @@ const _AppSupervisor = class _AppSupervisor extends import_events.EventEmitter {
     await this.processAdapter.removeAllApps();
     await ((_b = (_a = this.discoveryAdapter).dispose) == null ? void 0 : _b.call(_a));
     await ((_d = (_c = this.commandAdapter) == null ? void 0 : _c.dispose) == null ? void 0 : _d.call(_c));
+    this.appManifests.clear();
     if (this.environmentHeartbeatTimer) {
       this.environmentHeartbeatTimer = null;
     }
@@ -436,28 +438,31 @@ const _AppSupervisor = class _AppSupervisor extends import_events.EventEmitter {
     return this.discoveryAdapter.listAppModels();
   }
   async setAppManifestItem(appName, namespace, itemKey, item) {
-    if (typeof this.discoveryAdapter.setAppManifestItem !== "function") {
-      return;
+    if (typeof this.discoveryAdapter.setAppManifestItem === "function") {
+      return this.discoveryAdapter.setAppManifestItem(appName, namespace, itemKey, item);
     }
-    return this.discoveryAdapter.setAppManifestItem(appName, namespace, itemKey, item);
+    const manifest = this.getOrCreateAppManifest(appName, namespace);
+    manifest.set(itemKey, item);
   }
   async removeAppManifestItem(appName, namespace, itemKey) {
-    if (typeof this.discoveryAdapter.removeAppManifestItem !== "function") {
-      return;
+    var _a;
+    if (typeof this.discoveryAdapter.removeAppManifestItem === "function") {
+      return this.discoveryAdapter.removeAppManifestItem(appName, namespace, itemKey);
     }
-    return this.discoveryAdapter.removeAppManifestItem(appName, namespace, itemKey);
+    (_a = this.appManifests.get(this.getAppManifestKey(appName, namespace))) == null ? void 0 : _a.delete(itemKey);
   }
   async removeAppManifest(appName, namespace) {
-    if (typeof this.discoveryAdapter.removeAppManifest !== "function") {
-      return;
+    if (typeof this.discoveryAdapter.removeAppManifest === "function") {
+      return this.discoveryAdapter.removeAppManifest(appName, namespace);
     }
-    return this.discoveryAdapter.removeAppManifest(appName, namespace);
+    this.appManifests.delete(this.getAppManifestKey(appName, namespace));
   }
   async getAppManifestItems(appName, namespace) {
-    if (typeof this.discoveryAdapter.getAppManifestItems !== "function") {
-      return [];
+    var _a;
+    if (typeof this.discoveryAdapter.getAppManifestItems === "function") {
+      return this.discoveryAdapter.getAppManifestItems(appName, namespace);
     }
-    return this.discoveryAdapter.getAppManifestItems(appName, namespace);
+    return Array.from(((_a = this.appManifests.get(this.getAppManifestKey(appName, namespace))) == null ? void 0 : _a.values()) || []);
   }
   async getAppManifests(namespace, appNames) {
     if (typeof this.discoveryAdapter.getAppManifests === "function") {
@@ -474,6 +479,19 @@ const _AppSupervisor = class _AppSupervisor extends import_events.EventEmitter {
     );
     return result;
   }
+  getAppManifestKey(appName, namespace) {
+    return `${namespace}:${appName}`;
+  }
+  getOrCreateAppManifest(appName, namespace) {
+    const key = this.getAppManifestKey(appName, namespace);
+    const manifest = this.appManifests.get(key);
+    if (manifest) {
+      return manifest;
+    }
+    const nextManifest = /* @__PURE__ */ new Map();
+    this.appManifests.set(key, nextManifest);
+    return nextManifest;
+  }
   registerAppCondition(name, condition) {
     this.appConditions.set(name, condition);
   }

package/lib/app-supervisor/main-only-adapter.d.ts

@@ -16,18 +16,12 @@ export declare class MainOnlyAdapter implements AppDiscoveryAdapter, AppProcessA
     apps: Record<string, Application>;
     status: AppStatus;
     appErrors: Record<string, Error>;
-    private readonly appManifests;
     constructor(supervisor: AppSupervisor);
     getApp(appName: string, options?: GetAppOptions): Promise<Application<import("../application").DefaultState, import("../application").DefaultContext>>;
     bootstrapApp(appName: string): Promise<void>;
     addApp(app: Application): Application<import("../application").DefaultState, import("../application").DefaultContext>;
     getApps(): Application<import("../application").DefaultState, import("../application").DefaultContext>[];
     listAppModels(): Promise<any[]>;
-    setAppManifestItem(appName: string, namespace: string, itemKey: string, item: unknown): Promise<void>;
-    removeAppManifestItem(appName: string, namespace: string, itemKey: string): Promise<void>;
-    removeAppManifest(appName: string, namespace: string): Promise<void>;
-    getAppManifestItems<T = unknown>(appName: string, namespace: string): Promise<T[]>;
-    getAppManifests<T = unknown>(namespace: string, appNames: string[]): Promise<Record<string, T[]>>;
     hasApp(appName: string): boolean;
     startApp(appName: string): Promise<void>;
     stopApp(appName: string): Promise<void>;
@@ -44,6 +38,4 @@ export declare class MainOnlyAdapter implements AppDiscoveryAdapter, AppProcessA
     clearAppError(appName: string): void;
     setAppLastSeenAt(): void;
     getAppLastSeenAt(appName: string): any;
-    private getAppManifestKey;
-    private getOrCreateAppManifest;
 }

package/lib/app-supervisor/main-only-adapter.js

@@ -39,7 +39,6 @@ const _MainOnlyAdapter = class _MainOnlyAdapter {
   apps = {};
   status;
   appErrors = {};
-  appManifests = /* @__PURE__ */ new Map();
   async getApp(appName, options = {}) {
     if (appName !== "main") {
       this.supervisor.logger.warn(`only main app is supported`, { method: "getApp", appName });
@@ -82,31 +81,6 @@ const _MainOnlyAdapter = class _MainOnlyAdapter {
   async listAppModels() {
     return [];
   }
-  async setAppManifestItem(appName, namespace, itemKey, item) {
-    const manifest = this.getOrCreateAppManifest(appName, namespace);
-    manifest.set(itemKey, item);
-  }
-  async removeAppManifestItem(appName, namespace, itemKey) {
-    var _a;
-    (_a = this.appManifests.get(this.getAppManifestKey(appName, namespace))) == null ? void 0 : _a.delete(itemKey);
-  }
-  async removeAppManifest(appName, namespace) {
-    this.appManifests.delete(this.getAppManifestKey(appName, namespace));
-  }
-  async getAppManifestItems(appName, namespace) {
-    var _a;
-    return Array.from(((_a = this.appManifests.get(this.getAppManifestKey(appName, namespace))) == null ? void 0 : _a.values()) || []);
-  }
-  async getAppManifests(namespace, appNames) {
-    const result = {};
-    for (const appName of appNames) {
-      const data = await this.getAppManifestItems(appName, namespace);
-      if (data.length > 0) {
-        result[appName] = data;
-      }
-    }
-    return result;
-  }
   hasApp(appName) {
     if (appName !== "main") {
       return false;
@@ -188,19 +162,6 @@ const _MainOnlyAdapter = class _MainOnlyAdapter {
   getAppLastSeenAt(appName) {
     return null;
   }
-  getAppManifestKey(appName, namespace) {
-    return `${namespace}:${appName}`;
-  }
-  getOrCreateAppManifest(appName, namespace) {
-    const key = this.getAppManifestKey(appName, namespace);
-    const manifest = this.appManifests.get(key);
-    if (manifest) {
-      return manifest;
-    }
-    const nextManifest = /* @__PURE__ */ new Map();
-    this.appManifests.set(key, nextManifest);
-    return nextManifest;
-  }
 };
 __name(_MainOnlyAdapter, "MainOnlyAdapter");
 let MainOnlyAdapter = _MainOnlyAdapter;

package/lib/application.js

@@ -944,6 +944,7 @@ const _Application = class _Application extends import_koa.default {
       }
     });
     this._dataSourceManager.use(this._authManager.middleware(), { tag: "auth", before: "default" });
+    this._dataSourceManager.use(import_auth.csrfMiddleware, { tag: "csrf", after: "auth", before: "default" });
     this._dataSourceManager.use(import_validate_filter_params.default, { tag: "validate-filter-params", before: ["auth"] });
     this._dataSourceManager.use(import_middlewares.parseVariables, {
       group: "parseVariables",

package/lib/gateway/index.js

@@ -78,6 +78,17 @@ function normalizeBasePath(path = "") {
   return normalized || "/";
 }
 __name(normalizeBasePath, "normalizeBasePath");
+function getFilesPathPrefixes(appPublicPath = "/") {
+  const normalizedPublicPath = normalizeBasePath(appPublicPath);
+  const canonicalPrefix = `${normalizedPublicPath === "/" ? "" : normalizedPublicPath}/files/`;
+  return canonicalPrefix === "/files/" ? ["/files/"] : [canonicalPrefix, "/files/"];
+}
+__name(getFilesPathPrefixes, "getFilesPathPrefixes");
+function getFileAccessRestPath(pathname, appPublicPath = "/") {
+  const prefix = getFilesPathPrefixes(appPublicPath).find((prefix2) => pathname.startsWith(prefix2));
+  return prefix ? pathname.slice(prefix.length) : null;
+}
+__name(getFileAccessRestPath, "getFileAccessRestPath");
 function getSocketPath() {
   const socketPath = import_node_process.default.env.SOCKET_PATH;
   if (socketPath) {
@@ -202,6 +213,17 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
             req.url = rewrittenUrl;
           }
         }
+        const fileAccessRestPath = parsedUrl.pathname ? getFileAccessRestPath(parsedUrl.pathname, import_node_process.default.env.APP_PUBLIC_PATH || "/") : null;
+        if (fileAccessRestPath) {
+          const restPath = fileAccessRestPath;
+          const [pathAppName] = restPath.split("/");
+          if (pathAppName) {
+            try {
+              ctx.resolvedAppName = decodeURIComponent(pathAppName);
+            } catch (error) {
+            }
+          }
+        }
         await next();
       },
       {
@@ -337,7 +359,7 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
     return (0, import_utils3.injectRuntimeScript)(html, this.getV2RuntimeConfigScript());
   }
   async requestHandler(req, res) {
-    const { pathname } = (0, import_url.parse)(req.url);
+    const { pathname, search } = (0, import_url.parse)(req.url);
     const { PLUGIN_STATICS_PATH } = import_node_process.default.env;
     const APP_PUBLIC_PATH = this.getAppPublicPath();
     if (pathname.endsWith("/__umi/api/bundle-status")) {
@@ -345,6 +367,12 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
       res.end("ok");
       return;
     }
+    if (APP_PUBLIC_PATH !== "/" && pathname.startsWith("/files/")) {
+      res.statusCode = 302;
+      res.setHeader("Location", `${APP_PUBLIC_PATH.replace(/\/$/, "")}${pathname}${search || ""}`);
+      res.end();
+      return;
+    }
     const supervisor = import_app_supervisor.AppSupervisor.getInstance();
     let handleApp = "main";
     try {
@@ -361,7 +389,7 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
           return;
         }
       }
-      const headers = (0, import_static_file_security.getStorageUploadSecurityHeaders)(pathname);
+      const headers = (0, import_static_file_security.getStorageUploadSecurityHeaders)(`${pathname}${search || ""}`);
       for (const [key, value] of Object.entries(headers)) {
         res.setHeader(key, value);
       }
@@ -407,7 +435,8 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
         ]
       });
     }
-    if (!pathname.startsWith(import_node_process.default.env.API_BASE_PATH)) {
+    const isFilesRequest = Boolean(getFileAccessRestPath(pathname, APP_PUBLIC_PATH));
+    if (!pathname.startsWith(import_node_process.default.env.API_BASE_PATH) && !isFilesRequest) {
       if (this.isV2Request(pathname)) {
         if (handleApp !== "main") {
           const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);

package/lib/gateway/static-file-security.js

@@ -47,6 +47,15 @@ function stripQueryAndHash(pathname = "") {
   return pathname.split("?")[0].split("#")[0];
 }
 __name(stripQueryAndHash, "stripQueryAndHash");
+function shouldDownload(pathname = "") {
+  var _a;
+  const query = (_a = pathname.split("?")[1]) == null ? void 0 : _a.split("#")[0];
+  if (!query) {
+    return false;
+  }
+  return new URLSearchParams(query).get("download") === "1";
+}
+__name(shouldDownload, "shouldDownload");
 function hasActiveContentExtension(pathname = "") {
   const ext = import_node_path.default.extname(stripQueryAndHash(pathname)).toLowerCase();
   return ACTIVE_CONTENT_EXTENSIONS.has(ext);
@@ -56,7 +65,7 @@ function getStorageUploadSecurityHeaders(pathname = "") {
   const headers = {
     "X-Content-Type-Options": "nosniff"
   };
-  if (hasActiveContentExtension(pathname)) {
+  if (hasActiveContentExtension(pathname) || shouldDownload(pathname)) {
     headers["Content-Disposition"] = "attachment";
   }
   return headers;

package/lib/helper.js

@@ -76,23 +76,28 @@ function createResourcer(options) {
   return new import_resourcer.Resourcer({ ...options.resourcer });
 }
 __name(createResourcer, "createResourcer");
+function isWhitelistedCorsOrigin(ctx) {
+  const origin = ctx.get("origin");
+  const whitelist = (0, import_utils.getCorsWhitelist)();
+  if (!origin) {
+    return false;
+  }
+  if (!whitelist) {
+    return (0, import_utils.isTrustedOrigin)(ctx, origin);
+  }
+  return whitelist.has(origin);
+}
+__name(isWhitelistedCorsOrigin, "isWhitelistedCorsOrigin");
 function resolveCorsOrigin(ctx) {
   const origin = ctx.get("origin");
   const disallowNoOrigin = process.env.CORS_DISALLOW_NO_ORIGIN === "true";
-  const whitelistString = process.env.CORS_ORIGIN_WHITELIST;
   if (!origin && disallowNoOrigin) {
     return false;
   }
-  if (!whitelistString) {
+  if (isWhitelistedCorsOrigin(ctx)) {
     return origin;
   }
-  const whitelist = new Set(
-    whitelistString.split(",").map((item) => item.trim()).filter(Boolean)
-  );
-  if (whitelist.has(origin)) {
-    return origin;
-  }
-  return false;
+  return (0, import_utils.getCorsWhitelist)() ? false : origin;
 }
 __name(resolveCorsOrigin, "resolveCorsOrigin");
 function registerMiddlewares(app, options) {
@@ -108,6 +113,7 @@ function registerMiddlewares(app, options) {
   app.use((0, import_logger.requestLogger)(app.name, app.requestLogger, (_a = options.logger) == null ? void 0 : _a.request), { tag: "logger" });
   app.use(
     (0, import_cors.default)({
+      credentials: isWhitelistedCorsOrigin,
       exposeHeaders: ["content-disposition"],
       origin: resolveCorsOrigin,
       ...options.cors
@@ -134,8 +140,18 @@ function registerMiddlewares(app, options) {
   }
   app.use(/* @__PURE__ */ __name(async function getBearerToken(ctx, next) {
     ctx.getBearerToken = () => {
-      const token = ctx.get("Authorization").replace(/^Bearer\s+/gi, "");
-      return token || ctx.query.token;
+      const authorization = ctx.get("Authorization");
+      if (authorization) {
+        ctx.state.pendingAuthTokenSource = "authorization";
+        return authorization.replace(/^Bearer\s+/gi, "");
+      }
+      if (ctx.query.token) {
+        ctx.state.pendingAuthTokenSource = "query";
+        return ctx.query.token;
+      }
+      const cookieToken = ctx.cookies.get((0, import_utils.getAuthCookieName)("authToken", app.name));
+      ctx.state.pendingAuthTokenSource = cookieToken ? "cookie" : void 0;
+      return cookieToken;
     };
     await next();
   }, "getBearerToken"));

package/lib/plugin-manager/findPackageNames.js

@@ -62,6 +62,7 @@ async function trim(packageNames) {
 }
 __name(trim, "trim");
 const excludes = [
+  "external-db-data-source",
   "@nocobase/plugin-audit-logs",
   "@nocobase/plugin-backup-restore",
   "@nocobase/plugin-charts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/server",
-  "version": "2.2.0-beta.9",
+  "version": "2.3.0-alpha.1",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -10,21 +10,21 @@
     "@koa/cors": "^5.0.0",
     "@koa/multer": "^3.1.0",
     "@koa/router": "^13.1.0",
-    "@nocobase/acl": "2.2.0-beta.9",
-    "@nocobase/actions": "2.2.0-beta.9",
-    "@nocobase/ai": "2.2.0-beta.9",
-    "@nocobase/auth": "2.2.0-beta.9",
-    "@nocobase/cache": "2.2.0-beta.9",
-    "@nocobase/data-source-manager": "2.2.0-beta.9",
-    "@nocobase/database": "2.2.0-beta.9",
-    "@nocobase/evaluators": "2.2.0-beta.9",
-    "@nocobase/lock-manager": "2.2.0-beta.9",
-    "@nocobase/logger": "2.2.0-beta.9",
-    "@nocobase/resourcer": "2.2.0-beta.9",
-    "@nocobase/sdk": "2.2.0-beta.9",
-    "@nocobase/snowflake-id": "2.2.0-beta.9",
-    "@nocobase/telemetry": "2.2.0-beta.9",
-    "@nocobase/utils": "2.2.0-beta.9",
+    "@nocobase/acl": "2.3.0-alpha.1",
+    "@nocobase/actions": "2.3.0-alpha.1",
+    "@nocobase/ai": "2.3.0-alpha.1",
+    "@nocobase/auth": "2.3.0-alpha.1",
+    "@nocobase/cache": "2.3.0-alpha.1",
+    "@nocobase/data-source-manager": "2.3.0-alpha.1",
+    "@nocobase/database": "2.3.0-alpha.1",
+    "@nocobase/evaluators": "2.3.0-alpha.1",
+    "@nocobase/lock-manager": "2.3.0-alpha.1",
+    "@nocobase/logger": "2.3.0-alpha.1",
+    "@nocobase/resourcer": "2.3.0-alpha.1",
+    "@nocobase/sdk": "2.3.0-alpha.1",
+    "@nocobase/snowflake-id": "2.3.0-alpha.1",
+    "@nocobase/telemetry": "2.3.0-alpha.1",
+    "@nocobase/utils": "2.3.0-alpha.1",
     "@types/decompress": "4.2.7",
     "@types/ini": "^1.3.31",
     "@types/koa-send": "^4.1.3",
@@ -61,5 +61,5 @@
     "@types/serve-handler": "^6.1.1",
     "@types/ws": "^8.5.5"
   },
-  "gitHead": "60e3d7abbaa0c7cead76f71a4f3d5eedb6b8acdb"
+  "gitHead": "2377df8ceb12549149017f7f14a61207bf6e49a2"
 }