@nocobase/server 2.3.0-alpha.1 → 2.3.0-beta.10

package/lib/acl/available-action.js

@@ -34,7 +34,7 @@ const availableActions = {
     displayName: '{{t("Add new")}}',
     type: "new-data",
     onNewRecord: true,
-    aliases: ["create", "firstOrCreate", "updateOrCreate"],
+    aliases: ["create"],
     allowConfigureFields: true
   },
   // import: {

package/lib/app-supervisor/index.d.ts

@@ -53,6 +53,7 @@ export declare class AppSupervisor extends EventEmitter implements AsyncEmitter
     private appSsoIssuer?;
     appOptionsFactory: AppOptionsFactory;
     private environmentHeartbeatInterval;
+    private environmentHeartbeatTimeout;
     private environmentHeartbeatTimer;
     private constructor();
     private resolveDiscoveryAdapterName;
@@ -163,11 +164,13 @@ export declare class AppSupervisor extends EventEmitter implements AsyncEmitter
     proxyWeb(appName: string, req: IncomingMessage, res: ServerResponse): Promise<boolean>;
     proxyWs(req: IncomingMessage, socket: any, head: Buffer): Promise<boolean>;
     registerEnvironment(mainApp: Application): Promise<void>;
+    private getEnvironmentInfo;
     unregisterEnvironment(): Promise<void>;
     private normalizeEnvInfo;
     listEnvironments(): Promise<EnvironmentInfo[]>;
     getEnvironment(environmentName: string): Promise<EnvironmentInfo>;
-    heartbeatEnvironment(): Promise<void>;
+    heartbeatEnvironment(mainApp: Application): Promise<void>;
+    private stopEnvironmentHeartbeat;
     dispatchCommand(command: ProcessCommand): Promise<void>;
     registerCommandHandler(mainApp: Application): void;
     sendSyncMessage(mainApp: Application, message: {

package/lib/app-supervisor/index.js

@@ -74,6 +74,7 @@ const _AppSupervisor = class _AppSupervisor extends import_events.EventEmitter {
   appSsoIssuer;
   appOptionsFactory = import_app_options_factory.appOptionsFactory;
   environmentHeartbeatInterval = 2 * 60 * 1e3;
+  environmentHeartbeatTimeout = 5 * 60 * 1e3;
   environmentHeartbeatTimer = null;
   constructor() {
     super();
@@ -282,13 +283,11 @@ const _AppSupervisor = class _AppSupervisor extends import_events.EventEmitter {
   }
   async reset() {
     var _a, _b, _c, _d;
+    this.stopEnvironmentHeartbeat();
     await this.processAdapter.removeAllApps();
     await ((_b = (_a = this.discoveryAdapter).dispose) == null ? void 0 : _b.call(_a));
     await ((_d = (_c = this.commandAdapter) == null ? void 0 : _c.dispose) == null ? void 0 : _d.call(_c));
     this.appManifests.clear();
-    if (this.environmentHeartbeatTimer) {
-      this.environmentHeartbeatTimer = null;
-    }
     this.removeAllListeners();
     this.logger.close();
   }
@@ -389,6 +388,9 @@ const _AppSupervisor = class _AppSupervisor extends import_events.EventEmitter {
             if (!appOptions) {
               return;
             }
+            if (appModel.environments && !appModel.environments.includes(this.environmentName)) {
+              return;
+            }
             const newApp = this.registerApp({ appModel, mainApp: app2 });
             newApp.runCommand("start", "--quickstart");
           }
@@ -601,24 +603,25 @@ const _AppSupervisor = class _AppSupervisor extends import_events.EventEmitter {
     if (!this.environmentName || typeof this.discoveryAdapter.registerEnvironment !== "function") {
       return;
     }
-    const registered = await this.discoveryAdapter.registerEnvironment({
+    const registered = await this.discoveryAdapter.registerEnvironment(this.getEnvironmentInfo(mainApp));
+    if (registered) {
+      this.heartbeatEnvironment(mainApp);
+    }
+  }
+  getEnvironmentInfo(mainApp) {
+    return {
       name: this.environmentName,
       url: this.environmentUrl || "",
       proxyUrl: this.environmentProxyUrl || this.environmentUrl || "",
       appVersion: mainApp.getPackageVersion(),
       lastHeartbeatAt: Date.now()
-    });
-    if (registered) {
-      this.heartbeatEnvironment();
-    }
+    };
   }
   async unregisterEnvironment() {
+    this.stopEnvironmentHeartbeat();
     if (this.environmentName && typeof this.discoveryAdapter.unregisterEnvironment === "function") {
       await this.discoveryAdapter.unregisterEnvironment();
     }
-    if (this.environmentHeartbeatTimer) {
-      this.environmentHeartbeatTimer = null;
-    }
   }
   normalizeEnvInfo(environment) {
     if (typeof environment.available === "boolean") {
@@ -631,7 +634,7 @@ const _AppSupervisor = class _AppSupervisor extends import_events.EventEmitter {
         available: false
       };
     }
-    const available = Date.now() - lastHeartbeatAt <= this.environmentHeartbeatInterval;
+    const available = Date.now() - lastHeartbeatAt <= this.environmentHeartbeatTimeout;
     return {
       ...environment,
       available
@@ -654,17 +657,26 @@ const _AppSupervisor = class _AppSupervisor extends import_events.EventEmitter {
     }
     return this.normalizeEnvInfo(environment);
   }
-  async heartbeatEnvironment() {
+  async heartbeatEnvironment(mainApp) {
     if (typeof this.discoveryAdapter.heartbeatEnvironment !== "function") {
       return;
     }
     if (this.environmentHeartbeatTimer) {
       return;
     }
-    this.environmentHeartbeatTimer = setInterval(
-      () => this.discoveryAdapter.heartbeatEnvironment(),
-      this.environmentHeartbeatInterval
-    );
+    this.environmentHeartbeatTimer = setInterval(async () => {
+      try {
+        await this.discoveryAdapter.heartbeatEnvironment(this.getEnvironmentInfo(mainApp));
+      } catch (error) {
+        this.logger.error(error instanceof Error ? error.message : String(error), { method: "heartbeatEnvironment" });
+      }
+    }, this.environmentHeartbeatInterval);
+  }
+  stopEnvironmentHeartbeat() {
+    if (this.environmentHeartbeatTimer) {
+      clearInterval(this.environmentHeartbeatTimer);
+      this.environmentHeartbeatTimer = null;
+    }
   }
   async dispatchCommand(command) {
     var _a;

package/lib/app-supervisor/types.d.ts

@@ -132,7 +132,7 @@ export interface AppDiscoveryAdapter {
     unregisterEnvironment?(): Promise<void>;
     listEnvironments?(): Promise<EnvironmentInfo[]>;
     getEnvironment?(environmentName: string): Promise<EnvironmentInfo | null>;
-    heartbeatEnvironment?(): Promise<void>;
+    heartbeatEnvironment?(environment: EnvironmentInfo): Promise<void>;
     getBootstrapLock?(appName: string): Promise<BootstrapLock | null> | BootstrapLock | null;
     proxyWeb?(appName: string, req: IncomingMessage, res: ServerResponse): Promise<boolean>;
     proxyWs?(req: IncomingMessage, socket: any, head: Buffer): Promise<boolean>;

package/lib/event-queue.d.ts

@@ -53,17 +53,18 @@ export interface EventQueueOptions {
 export declare class MemoryEventQueueAdapter implements IEventQueueAdapter {
     private options;
     private connected;
-    private emitter;
     private reading;
+    private scheduledChannels;
     protected events: Map<string, QueueEventOptions>;
     protected queues: Map<string, {
         id: string;
         content: any;
         options?: QueueMessageOptions;
     }[]>;
-    get processing(): Promise<Promise<void>[][]>;
+    get processing(): Promise<void[]>;
     private get storagePath();
     listen: (channel: string) => void;
+    private scheduleListen;
     constructor(options: {
         appName: string;
         logger: SystemLogger;

package/lib/event-queue.js

@@ -46,7 +46,6 @@ __export(event_queue_exports, {
 });
 module.exports = __toCommonJS(event_queue_exports);
 var import_crypto = require("crypto");
-var import_events = require("events");
 var import_path = __toESM(require("path"));
 var import_promises = __toESM(require("fs/promises"));
 var import_utils = require("@nocobase/utils");
@@ -56,15 +55,14 @@ const QUEUE_DEFAULT_ACK_TIMEOUT = 15e3;
 const _MemoryEventQueueAdapter = class _MemoryEventQueueAdapter {
   constructor(options) {
     this.options = options;
-    this.emitter.setMaxListeners(0);
   }
   connected = false;
-  emitter = new import_events.EventEmitter();
   reading = /* @__PURE__ */ new Map();
+  scheduledChannels = /* @__PURE__ */ new Set();
   events = /* @__PURE__ */ new Map();
   queues = /* @__PURE__ */ new Map();
   get processing() {
-    const processing = Array.from(this.reading.values());
+    const processing = Array.from(this.reading.values()).flat();
     if (processing.length > 0) {
       return Promise.all(processing);
     }
@@ -80,14 +78,15 @@ const _MemoryEventQueueAdapter = class _MemoryEventQueueAdapter {
     const { logger } = this.options;
     const event = this.events.get(channel);
     if (!event) {
-      logger.warn(`memory queue (${channel}) not found, skipping...`);
       return;
     }
     if (!event.idle()) {
       return;
     }
     const reading = this.reading.get(channel) || [];
-    const count = (event.concurrency || QUEUE_DEFAULT_CONCURRENCY) - reading.length;
+    const queue = this.queues.get(channel);
+    const concurrency = event.concurrency ?? QUEUE_DEFAULT_CONCURRENCY;
+    const count = concurrency <= 0 ? (queue == null ? void 0 : queue.length) || 0 : concurrency - reading.length;
     if (count <= 0) {
       return;
     }
@@ -99,10 +98,24 @@ const _MemoryEventQueueAdapter = class _MemoryEventQueueAdapter {
         if (index > -1) {
           reading.splice(index, 1);
         }
+        this.scheduleListen(channel);
       });
     });
     this.reading.set(channel, reading);
   }, "listen");
+  scheduleListen(channel) {
+    if (this.scheduledChannels.has(channel)) {
+      return;
+    }
+    this.scheduledChannels.add(channel);
+    setImmediate(() => {
+      this.scheduledChannels.delete(channel);
+      if (!this.events.has(channel)) {
+        return;
+      }
+      this.listen(channel);
+    });
+  }
   isConnected() {
     return this.connected;
   }
@@ -181,7 +194,6 @@ const _MemoryEventQueueAdapter = class _MemoryEventQueueAdapter {
     if (!this.queues.has(channel)) {
       this.queues.set(channel, []);
     }
-    this.emitter.on(channel, this.listen);
     if (this.connected) {
       this.consume(channel);
     }
@@ -191,12 +203,12 @@ const _MemoryEventQueueAdapter = class _MemoryEventQueueAdapter {
       return;
     }
     this.events.delete(channel);
-    this.emitter.off(channel, this.listen);
   }
   publish(channel, content, options = { timestamp: Date.now() }) {
+    const { logger } = this.options;
     const event = this.events.get(channel);
     if (!event) {
-      console.debug(`memory queue (${channel}) not subscribed, skip`);
+      logger.debug(`memory queue (${channel}) not subscribed, skip`);
       return;
     }
     if (!this.queues.get(channel)) {
@@ -205,11 +217,8 @@ const _MemoryEventQueueAdapter = class _MemoryEventQueueAdapter {
     const queue = this.queues.get(channel);
     const message = { id: (0, import_crypto.randomUUID)(), content, options };
     queue.push(message);
-    const { logger } = this.options;
     logger.debug(`memory queue (${channel}) published message`, content);
-    setImmediate(() => {
-      this.emitter.emit(channel, channel);
-    });
+    this.scheduleListen(channel);
   }
   async consume(channel, once = false) {
     while (this.connected && this.events.get(channel)) {

package/lib/gateway/errors.js

@@ -54,6 +54,11 @@ function getAppName(app) {
 }
 __name(getAppName, "getAppName");
 const errors = {
+  APP_ENVIRONMENT_UNAVAILABLE: {
+    status: 503,
+    message: /* @__PURE__ */ __name(({ appName }) => `deployment environment for application ${appName} is unavailable`, "message"),
+    maintaining: true
+  },
   APP_NOT_FOUND: {
     status: 404,
     message: /* @__PURE__ */ __name(({ appName }) => `application ${appName} not found`, "message"),

package/lib/gateway/index.js

@@ -66,7 +66,6 @@ var import_plugin_manager = require("../plugin-manager");
 var import_errors = require("./errors");
 var import_ipc_socket_client = require("./ipc-socket-client");
 var import_ipc_socket_server = require("./ipc-socket-server");
-var import_static_file_security = require("./static-file-security");
 var import_utils3 = require("./utils");
 var import_ws_server = require("./ws-server");
 var import_node_worker_threads = require("node:worker_threads");
@@ -122,7 +121,17 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
     const internalUrl = req.url;
     req.url = this.getOriginalRequestUrl(req);
     try {
-      return await supervisor.proxyWeb(appName, req, res);
+      const proxied = await supervisor.proxyWeb(appName, req, res);
+      const adapter = supervisor.getDiscoveryAdapter();
+      if (!proxied && import_node_process.default.env.APP_MODE === "supervisor" && typeof adapter.proxyWeb === "function") {
+        let code = "APP_ENVIRONMENT_UNAVAILABLE";
+        if (typeof adapter.getAppModel === "function" && !await supervisor.getAppModel(appName)) {
+          code = "APP_NOT_FOUND";
+        }
+        this.responseErrorWithCode(code, res, { appName });
+        return true;
+      }
+      return proxied;
     } finally {
       req.url = internalUrl;
     }
@@ -382,24 +391,6 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
       this.responseErrorWithCode("APP_INITIALIZING", res, { appName: handleApp });
       return;
     }
-    if (pathname.startsWith(APP_PUBLIC_PATH + "storage/uploads/")) {
-      if (handleApp !== "main") {
-        const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);
-        if (isProxy) {
-          return;
-        }
-      }
-      const headers = (0, import_static_file_security.getStorageUploadSecurityHeaders)(`${pathname}${search || ""}`);
-      for (const [key, value] of Object.entries(headers)) {
-        res.setHeader(key, value);
-      }
-      req.url = req.url.substring(APP_PUBLIC_PATH.length + "storage".length);
-      await compress(req, res);
-      return (0, import_serve_handler.default)(req, res, {
-        public: (0, import_utils.resolveStorageRoot)(),
-        directoryListing: false
-      });
-    }
     if (pathname.startsWith(APP_PUBLIC_PATH + "dist/")) {
       if (handleApp !== "main") {
         const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);
@@ -436,7 +427,8 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
       });
     }
     const isFilesRequest = Boolean(getFileAccessRestPath(pathname, APP_PUBLIC_PATH));
-    if (!pathname.startsWith(import_node_process.default.env.API_BASE_PATH) && !isFilesRequest) {
+    const isLegacyUploadRequest = pathname.startsWith(APP_PUBLIC_PATH + "storage/uploads/");
+    if (!pathname.startsWith(import_node_process.default.env.API_BASE_PATH) && !isFilesRequest && !isLegacyUploadRequest) {
       if (this.isV2Request(pathname)) {
         if (handleApp !== "main") {
           const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);

package/lib/gateway/static-file-security.js

@@ -42,7 +42,18 @@ __export(static_file_security_exports, {
 });
 module.exports = __toCommonJS(static_file_security_exports);
 var import_node_path = __toESM(require("node:path"));
-const ACTIVE_CONTENT_EXTENSIONS = /* @__PURE__ */ new Set([".htm", ".html", ".pdf", ".svg", ".svgz", ".xhtml"]);
+const ACTIVE_CONTENT_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".htm",
+  ".html",
+  ".pdf",
+  ".svg",
+  ".svgz",
+  ".xht",
+  ".xhtml",
+  ".xml",
+  ".xsl",
+  ".xslt"
+]);
 function stripQueryAndHash(pathname = "") {
   return pathname.split("?")[0].split("#")[0];
 }
@@ -63,6 +74,8 @@ function hasActiveContentExtension(pathname = "") {
 __name(hasActiveContentExtension, "hasActiveContentExtension");
 function getStorageUploadSecurityHeaders(pathname = "") {
   const headers = {
+    "Cache-Control": "private, no-store",
+    "Content-Security-Policy": "sandbox",
     "X-Content-Type-Options": "nosniff"
   };
   if (hasActiveContentExtension(pathname) || shouldDownload(pathname)) {

package/lib/helper.d.ts

@@ -11,6 +11,7 @@ import { Command } from 'commander';
 import Application, { ApplicationOptions } from './application';
 export declare function createI18n(options: ApplicationOptions): import("i18next").i18n;
 export declare function createResourcer(options: ApplicationOptions): Resourcer;
+export declare function resolveCorsOrigin(ctx: any): any;
 export declare function registerMiddlewares(app: Application, options: ApplicationOptions): void;
 export declare const createAppProxy: (app: Application) => Application<import("./application").DefaultState, import("./application").DefaultContext>;
 export declare const getCommandFullName: (command: Command) => string;

package/lib/helper.js

@@ -45,6 +45,7 @@ __export(helper_exports, {
   getBodyLimit: () => getBodyLimit,
   getCommandFullName: () => getCommandFullName,
   registerMiddlewares: () => registerMiddlewares,
+  resolveCorsOrigin: () => resolveCorsOrigin,
   tsxRerunning: () => tsxRerunning
 });
 module.exports = __toCommonJS(helper_exports);
@@ -56,10 +57,24 @@ var import_crypto = require("crypto");
 var import_fs = __toESM(require("fs"));
 var import_i18next = __toESM(require("i18next"));
 var import_koa_bodyparser = __toESM(require("koa-bodyparser"));
+var import_koa_send = __toESM(require("koa-send"));
 var import_perf_hooks = require("perf_hooks");
 var import_data_wrapping = require("./middlewares/data-wrapping");
 var import_extract_client_ip = require("./middlewares/extract-client-ip");
+var import_static_file_security = require("./gateway/static-file-security");
 var import_i18n = require("./middlewares/i18n");
+function resolveAppPublicPath(value = "/") {
+  const normalized = String(value || "/").trim() || "/";
+  const withLeadingSlash = normalized.startsWith("/") ? normalized : `/${normalized}`;
+  return withLeadingSlash.endsWith("/") ? withLeadingSlash : `${withLeadingSlash}/`;
+}
+__name(resolveAppPublicPath, "resolveAppPublicPath");
+function resolveApiBasePath(value = "/api") {
+  const normalized = String(value || "/api").trim() || "/api";
+  const withLeadingSlash = normalized.startsWith("/") ? normalized : `/${normalized}`;
+  return withLeadingSlash.replace(/\/+$/g, "") || "/";
+}
+__name(resolveApiBasePath, "resolveApiBasePath");
 function createI18n(options) {
   const instance = import_i18next.default.createInstance();
   instance.init({
@@ -78,26 +93,23 @@ function createResourcer(options) {
 __name(createResourcer, "createResourcer");
 function isWhitelistedCorsOrigin(ctx) {
   const origin = ctx.get("origin");
-  const whitelist = (0, import_utils.getCorsWhitelist)();
   if (!origin) {
     return false;
   }
-  if (!whitelist) {
-    return (0, import_utils.isTrustedOrigin)(ctx, origin);
-  }
-  return whitelist.has(origin);
+  return (0, import_utils.isTrustedOrigin)(ctx, origin);
 }
 __name(isWhitelistedCorsOrigin, "isWhitelistedCorsOrigin");
 function resolveCorsOrigin(ctx) {
   const origin = ctx.get("origin");
   const disallowNoOrigin = process.env.CORS_DISALLOW_NO_ORIGIN === "true";
+  const whitelist = (0, import_utils.getCorsWhitelist)();
   if (!origin && disallowNoOrigin) {
     return false;
   }
   if (isWhitelistedCorsOrigin(ctx)) {
     return origin;
   }
-  return (0, import_utils.getCorsWhitelist)() ? false : origin;
+  return whitelist ? false : origin;
 }
 __name(resolveCorsOrigin, "resolveCorsOrigin");
 function registerMiddlewares(app, options) {
@@ -114,7 +126,7 @@ function registerMiddlewares(app, options) {
   app.use(
     (0, import_cors.default)({
       credentials: isWhitelistedCorsOrigin,
-      exposeHeaders: ["content-disposition"],
+      exposeHeaders: ["content-disposition", "x-new-token"],
       origin: resolveCorsOrigin,
       ...options.cors
     }),
@@ -140,6 +152,7 @@ function registerMiddlewares(app, options) {
   }
   app.use(/* @__PURE__ */ __name(async function getBearerToken(ctx, next) {
     ctx.getBearerToken = () => {
+      var _a2, _b;
       const authorization = ctx.get("Authorization");
       if (authorization) {
         ctx.state.pendingAuthTokenSource = "authorization";
@@ -149,7 +162,8 @@ function registerMiddlewares(app, options) {
         ctx.state.pendingAuthTokenSource = "query";
         return ctx.query.token;
       }
-      const cookieToken = ctx.cookies.get((0, import_utils.getAuthCookieName)("authToken", app.name));
+      const canUseAuthCookie = Boolean(((_a2 = ctx.state) == null ? void 0 : _a2.fileAccess) || ((_b = ctx.state) == null ? void 0 : _b.legacyFileAccess)) && ["GET", "HEAD"].includes(ctx.method);
+      const cookieToken = canUseAuthCookie ? ctx.cookies.get((0, import_utils.getAuthCookieName)("authToken", app.name)) : void 0;
       ctx.state.pendingAuthTokenSource = cookieToken ? "cookie" : void 0;
       return cookieToken;
     };
@@ -159,6 +173,47 @@ function registerMiddlewares(app, options) {
   if (options.dataWrapping !== false) {
     app.use((0, import_data_wrapping.dataWrapping)(), { tag: "dataWrapping", after: "cors" });
   }
+  app.use(
+    /* @__PURE__ */ __name(async function legacyFileAccess(ctx, next) {
+      const publicPath = resolveAppPublicPath(process.env.APP_PUBLIC_PATH);
+      const uploadsPrefix = `${publicPath}storage/uploads/`;
+      const authCheckPath = `${resolveApiBasePath(process.env.API_BASE_PATH)}/auth:checkLegacyFileAccess`;
+      const isUploadRequest = ctx.path.startsWith(uploadsPrefix);
+      const isAuthCheckRequest = ctx.path === authCheckPath || ctx.path === "/auth:checkLegacyFileAccess";
+      if (!isUploadRequest && !isAuthCheckRequest) {
+        return next();
+      }
+      if (!["GET", "HEAD"].includes(ctx.method)) {
+        return ctx.throw(405);
+      }
+      ctx.state.legacyFileAccess = true;
+      ctx.state.legacyLocalStoragePublicAccess = process.env.LEGACY_LOCAL_STORAGE_PUBLIC_ACCESS === "true";
+      if (ctx.state.legacyLocalStoragePublicAccess) {
+        ctx.skipAuthCheck = true;
+      }
+      if (isAuthCheckRequest) {
+        return next();
+      }
+      const originalPath = ctx.path;
+      ctx.path = authCheckPath;
+      try {
+        await next();
+      } finally {
+        ctx.path = originalPath;
+      }
+      const relativePath = `uploads/${originalPath.slice(uploadsPrefix.length)}`;
+      const headers = (0, import_static_file_security.getStorageUploadSecurityHeaders)(`${originalPath}${ctx.search || ""}`);
+      if (!headers["Content-Disposition"]) {
+        headers["Content-Disposition"] = "inline";
+      }
+      for (const [name, value] of Object.entries(headers)) {
+        ctx.set(name, value);
+      }
+      ctx.status = 200;
+      await (0, import_koa_send.default)(ctx, relativePath, { root: (0, import_utils.resolveStorageRoot)() });
+    }, "legacyFileAccess"),
+    { tag: "legacyFileAccess", before: "dataSource", after: "dataWrapping" }
+  );
   app.use(app.dataSourceManager.middleware(), { tag: "dataSource", after: "dataWrapping" });
   app.use((0, import_extract_client_ip.extractClientIp)(), { tag: "extractClientIp", before: "cors" });
 }
@@ -325,5 +380,6 @@ __name(createContextVariablesScope, "createContextVariablesScope");
   getBodyLimit,
   getCommandFullName,
   registerMiddlewares,
+  resolveCorsOrigin,
   tsxRerunning
 });

package/lib/index.d.ts

@@ -13,6 +13,7 @@ export * from './gateway/ws-server';
 export { Application as default } from './application';
 export * from './audit-manager';
 export * from './gateway';
+export * from './gateway/static-file-security';
 export * as middlewares from './middlewares';
 export * from './migration';
 export * from './plugin';

package/lib/index.js

@@ -55,6 +55,7 @@ __reExport(src_exports, require("./gateway/ws-server"), module.exports);
 var import_application = require("./application");
 __reExport(src_exports, require("./audit-manager"), module.exports);
 __reExport(src_exports, require("./gateway"), module.exports);
+__reExport(src_exports, require("./gateway/static-file-security"), module.exports);
 var middlewares = __toESM(require("./middlewares"));
 __reExport(src_exports, require("./migration"), module.exports);
 __reExport(src_exports, require("./plugin"), module.exports);
@@ -85,6 +86,7 @@ var import_helper = require("./helper");
   ...require("./gateway/ws-server"),
   ...require("./audit-manager"),
   ...require("./gateway"),
+  ...require("./gateway/static-file-security"),
   ...require("./migration"),
   ...require("./plugin"),
   ...require("./plugin-manager"),

package/lib/swagger/app.d.ts

@@ -12,7 +12,23 @@ declare const _default: {
             readonly tags: readonly ["app"];
             readonly summary: "Get the current application language";
             readonly description: "Return the current locale used by the server.";
-            readonly parameters: readonly [];
+            readonly parameters: readonly [{
+                readonly name: "locale";
+                readonly in: "query";
+                readonly required: false;
+                readonly schema: {
+                    readonly type: "string";
+                };
+                readonly description: "Requested application locale. The server validates it against enabled languages.";
+            }, {
+                readonly name: "ns";
+                readonly in: "query";
+                readonly required: false;
+                readonly schema: {
+                    readonly type: "string";
+                };
+                readonly description: "Comma-separated resource namespaces to return. Omit it to preserve the full legacy payload.";
+            }];
             readonly responses: {
                 readonly 200: {
                     readonly description: "OK";

package/lib/swagger/app.js

@@ -35,7 +35,22 @@ var app_default = {
       tags: ["app"],
       summary: "Get the current application language",
       description: "Return the current locale used by the server.",
-      parameters: [],
+      parameters: [
+        {
+          name: "locale",
+          in: "query",
+          required: false,
+          schema: { type: "string" },
+          description: "Requested application locale. The server validates it against enabled languages."
+        },
+        {
+          name: "ns",
+          in: "query",
+          required: false,
+          schema: { type: "string" },
+          description: "Comma-separated resource namespaces to return. Omit it to preserve the full legacy payload."
+        }
+      ],
       responses: {
         200: {
           description: "OK",

package/lib/swagger/index.d.ts

@@ -694,7 +694,23 @@ declare const _default: {
                 readonly tags: readonly ["app"];
                 readonly summary: "Get the current application language";
                 readonly description: "Return the current locale used by the server.";
-                readonly parameters: readonly [];
+                readonly parameters: readonly [{
+                    readonly name: "locale";
+                    readonly in: "query";
+                    readonly required: false;
+                    readonly schema: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Requested application locale. The server validates it against enabled languages.";
+                }, {
+                    readonly name: "ns";
+                    readonly in: "query";
+                    readonly required: false;
+                    readonly schema: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Comma-separated resource namespaces to return. Omit it to preserve the full legacy payload.";
+                }];
                 readonly responses: {
                     readonly 200: {
                         readonly description: "OK";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/server",
-  "version": "2.3.0-alpha.1",
+  "version": "2.3.0-beta.10",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -10,21 +10,21 @@
     "@koa/cors": "^5.0.0",
     "@koa/multer": "^3.1.0",
     "@koa/router": "^13.1.0",
-    "@nocobase/acl": "2.3.0-alpha.1",
-    "@nocobase/actions": "2.3.0-alpha.1",
-    "@nocobase/ai": "2.3.0-alpha.1",
-    "@nocobase/auth": "2.3.0-alpha.1",
-    "@nocobase/cache": "2.3.0-alpha.1",
-    "@nocobase/data-source-manager": "2.3.0-alpha.1",
-    "@nocobase/database": "2.3.0-alpha.1",
-    "@nocobase/evaluators": "2.3.0-alpha.1",
-    "@nocobase/lock-manager": "2.3.0-alpha.1",
-    "@nocobase/logger": "2.3.0-alpha.1",
-    "@nocobase/resourcer": "2.3.0-alpha.1",
-    "@nocobase/sdk": "2.3.0-alpha.1",
-    "@nocobase/snowflake-id": "2.3.0-alpha.1",
-    "@nocobase/telemetry": "2.3.0-alpha.1",
-    "@nocobase/utils": "2.3.0-alpha.1",
+    "@nocobase/acl": "2.3.0-beta.10",
+    "@nocobase/actions": "2.3.0-beta.10",
+    "@nocobase/ai": "2.3.0-beta.10",
+    "@nocobase/auth": "2.3.0-beta.10",
+    "@nocobase/cache": "2.3.0-beta.10",
+    "@nocobase/data-source-manager": "2.3.0-beta.10",
+    "@nocobase/database": "2.3.0-beta.10",
+    "@nocobase/evaluators": "2.3.0-beta.10",
+    "@nocobase/lock-manager": "2.3.0-beta.10",
+    "@nocobase/logger": "2.3.0-beta.10",
+    "@nocobase/resourcer": "2.3.0-beta.10",
+    "@nocobase/sdk": "2.3.0-beta.10",
+    "@nocobase/snowflake-id": "2.3.0-beta.10",
+    "@nocobase/telemetry": "2.3.0-beta.10",
+    "@nocobase/utils": "2.3.0-beta.10",
     "@types/decompress": "4.2.7",
     "@types/ini": "^1.3.31",
     "@types/koa-send": "^4.1.3",
@@ -61,5 +61,5 @@
     "@types/serve-handler": "^6.1.1",
     "@types/ws": "^8.5.5"
   },
-  "gitHead": "2377df8ceb12549149017f7f14a61207bf6e49a2"
+  "gitHead": "7aa3dce6cf3201752882f7012c72997898015d89"
 }