@nocobase/server 2.4.0-alpha.3 → 2.4.0-alpha.5

package/lib/app-supervisor/index.js

@@ -389,6 +389,9 @@ const _AppSupervisor = class _AppSupervisor extends import_events.EventEmitter {
             if (!appOptions) {
               return;
             }
+            if (appModel.environments && !appModel.environments.includes(this.environmentName)) {
+              return;
+            }
             const newApp = this.registerApp({ appModel, mainApp: app2 });
             newApp.runCommand("start", "--quickstart");
           }

package/lib/gateway/index.js

@@ -66,7 +66,6 @@ var import_plugin_manager = require("../plugin-manager");
 var import_errors = require("./errors");
 var import_ipc_socket_client = require("./ipc-socket-client");
 var import_ipc_socket_server = require("./ipc-socket-server");
-var import_static_file_security = require("./static-file-security");
 var import_utils3 = require("./utils");
 var import_ws_server = require("./ws-server");
 var import_node_worker_threads = require("node:worker_threads");
@@ -608,27 +607,6 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
       this.responseErrorWithCode("APP_INITIALIZING", res, { appName: handleApp });
       return;
     }
-    if (pathname.startsWith(APP_PUBLIC_PATH + "storage/uploads/")) {
-      if (handleApp !== "main") {
-        const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);
-        if (isProxy) {
-          return;
-        }
-      }
-      const headers = (0, import_static_file_security.getStorageUploadSecurityHeaders)(`${pathname}${search || ""}`);
-      req.url = req.url.substring(APP_PUBLIC_PATH.length + "storage".length);
-      await compress(req, res);
-      return (0, import_serve_handler.default)(req, res, {
-        public: (0, import_utils.resolveStorageRoot)(),
-        directoryListing: false,
-        headers: [
-          {
-            source: "**/*",
-            headers: Object.entries(headers).map(([key, value]) => ({ key, value }))
-          }
-        ]
-      });
-    }
     if (pathname.startsWith(APP_PUBLIC_PATH + "dist/")) {
       if (handleApp !== "main") {
         const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);
@@ -665,7 +643,8 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
       });
     }
     const isFilesRequest = Boolean(getFileAccessRestPath(pathname, APP_PUBLIC_PATH));
-    if (!pathname.startsWith(import_node_process.default.env.API_BASE_PATH) && !isFilesRequest) {
+    const isLegacyUploadRequest = pathname.startsWith(APP_PUBLIC_PATH + "storage/uploads/");
+    if (!pathname.startsWith(import_node_process.default.env.API_BASE_PATH) && !isFilesRequest && !isLegacyUploadRequest) {
       if (this.isSettingsRequest(pathname)) {
         if (handleApp !== "main") {
           const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);

package/lib/gateway/static-file-security.js

@@ -74,6 +74,7 @@ function hasActiveContentExtension(pathname = "") {
 __name(hasActiveContentExtension, "hasActiveContentExtension");
 function getStorageUploadSecurityHeaders(pathname = "") {
   const headers = {
+    "Cache-Control": "private, no-store",
     "Content-Security-Policy": "sandbox",
     "X-Content-Type-Options": "nosniff"
   };

package/lib/helper.js

@@ -57,10 +57,24 @@ var import_crypto = require("crypto");
 var import_fs = __toESM(require("fs"));
 var import_i18next = __toESM(require("i18next"));
 var import_koa_bodyparser = __toESM(require("koa-bodyparser"));
+var import_koa_send = __toESM(require("koa-send"));
 var import_perf_hooks = require("perf_hooks");
 var import_data_wrapping = require("./middlewares/data-wrapping");
 var import_extract_client_ip = require("./middlewares/extract-client-ip");
+var import_static_file_security = require("./gateway/static-file-security");
 var import_i18n = require("./middlewares/i18n");
+function resolveAppPublicPath(value = "/") {
+  const normalized = String(value || "/").trim() || "/";
+  const withLeadingSlash = normalized.startsWith("/") ? normalized : `/${normalized}`;
+  return withLeadingSlash.endsWith("/") ? withLeadingSlash : `${withLeadingSlash}/`;
+}
+__name(resolveAppPublicPath, "resolveAppPublicPath");
+function resolveApiBasePath(value = "/api") {
+  const normalized = String(value || "/api").trim() || "/api";
+  const withLeadingSlash = normalized.startsWith("/") ? normalized : `/${normalized}`;
+  return withLeadingSlash.replace(/\/+$/g, "") || "/";
+}
+__name(resolveApiBasePath, "resolveApiBasePath");
 function createI18n(options) {
   const instance = import_i18next.default.createInstance();
   instance.init({
@@ -138,7 +152,7 @@ function registerMiddlewares(app, options) {
   }
   app.use(/* @__PURE__ */ __name(async function getBearerToken(ctx, next) {
     ctx.getBearerToken = () => {
-      var _a2;
+      var _a2, _b;
       const authorization = ctx.get("Authorization");
       if (authorization) {
         ctx.state.pendingAuthTokenSource = "authorization";
@@ -148,7 +162,7 @@ function registerMiddlewares(app, options) {
         ctx.state.pendingAuthTokenSource = "query";
         return ctx.query.token;
       }
-      const canUseAuthCookie = Boolean((_a2 = ctx.state) == null ? void 0 : _a2.fileAccess) && ["GET", "HEAD"].includes(ctx.method);
+      const canUseAuthCookie = Boolean(((_a2 = ctx.state) == null ? void 0 : _a2.fileAccess) || ((_b = ctx.state) == null ? void 0 : _b.legacyFileAccess)) && ["GET", "HEAD"].includes(ctx.method);
       const cookieToken = canUseAuthCookie ? ctx.cookies.get((0, import_utils.getAuthCookieName)("authToken", app.name)) : void 0;
       ctx.state.pendingAuthTokenSource = cookieToken ? "cookie" : void 0;
       return cookieToken;
@@ -159,6 +173,47 @@ function registerMiddlewares(app, options) {
   if (options.dataWrapping !== false) {
     app.use((0, import_data_wrapping.dataWrapping)(), { tag: "dataWrapping", after: "cors" });
   }
+  app.use(
+    /* @__PURE__ */ __name(async function legacyFileAccess(ctx, next) {
+      const publicPath = resolveAppPublicPath(process.env.APP_PUBLIC_PATH);
+      const uploadsPrefix = `${publicPath}storage/uploads/`;
+      const authCheckPath = `${resolveApiBasePath(process.env.API_BASE_PATH)}/auth:checkLegacyFileAccess`;
+      const isUploadRequest = ctx.path.startsWith(uploadsPrefix);
+      const isAuthCheckRequest = ctx.path === authCheckPath || ctx.path === "/auth:checkLegacyFileAccess";
+      if (!isUploadRequest && !isAuthCheckRequest) {
+        return next();
+      }
+      if (!["GET", "HEAD"].includes(ctx.method)) {
+        return ctx.throw(405);
+      }
+      ctx.state.legacyFileAccess = true;
+      ctx.state.legacyLocalStoragePublicAccess = process.env.LEGACY_LOCAL_STORAGE_PUBLIC_ACCESS === "true";
+      if (ctx.state.legacyLocalStoragePublicAccess) {
+        ctx.skipAuthCheck = true;
+      }
+      if (isAuthCheckRequest) {
+        return next();
+      }
+      const originalPath = ctx.path;
+      ctx.path = authCheckPath;
+      try {
+        await next();
+      } finally {
+        ctx.path = originalPath;
+      }
+      const relativePath = `uploads/${originalPath.slice(uploadsPrefix.length)}`;
+      const headers = (0, import_static_file_security.getStorageUploadSecurityHeaders)(`${originalPath}${ctx.search || ""}`);
+      if (!headers["Content-Disposition"]) {
+        headers["Content-Disposition"] = "inline";
+      }
+      for (const [name, value] of Object.entries(headers)) {
+        ctx.set(name, value);
+      }
+      ctx.status = 200;
+      await (0, import_koa_send.default)(ctx, relativePath, { root: (0, import_utils.resolveStorageRoot)() });
+    }, "legacyFileAccess"),
+    { tag: "legacyFileAccess", before: "dataSource", after: "dataWrapping" }
+  );
   app.use(app.dataSourceManager.middleware(), { tag: "dataSource", after: "dataWrapping" });
   app.use((0, import_extract_client_ip.extractClientIp)(), { tag: "extractClientIp", before: "cors" });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/server",
-  "version": "2.4.0-alpha.3",
+  "version": "2.4.0-alpha.5",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -10,21 +10,21 @@
     "@koa/cors": "^5.0.0",
     "@koa/multer": "^3.1.0",
     "@koa/router": "^13.1.0",
-    "@nocobase/acl": "2.4.0-alpha.3",
-    "@nocobase/actions": "2.4.0-alpha.3",
-    "@nocobase/ai": "2.4.0-alpha.3",
-    "@nocobase/auth": "2.4.0-alpha.3",
-    "@nocobase/cache": "2.4.0-alpha.3",
-    "@nocobase/data-source-manager": "2.4.0-alpha.3",
-    "@nocobase/database": "2.4.0-alpha.3",
-    "@nocobase/evaluators": "2.4.0-alpha.3",
-    "@nocobase/lock-manager": "2.4.0-alpha.3",
-    "@nocobase/logger": "2.4.0-alpha.3",
-    "@nocobase/resourcer": "2.4.0-alpha.3",
-    "@nocobase/sdk": "2.4.0-alpha.3",
-    "@nocobase/snowflake-id": "2.4.0-alpha.3",
-    "@nocobase/telemetry": "2.4.0-alpha.3",
-    "@nocobase/utils": "2.4.0-alpha.3",
+    "@nocobase/acl": "2.4.0-alpha.5",
+    "@nocobase/actions": "2.4.0-alpha.5",
+    "@nocobase/ai": "2.4.0-alpha.5",
+    "@nocobase/auth": "2.4.0-alpha.5",
+    "@nocobase/cache": "2.4.0-alpha.5",
+    "@nocobase/data-source-manager": "2.4.0-alpha.5",
+    "@nocobase/database": "2.4.0-alpha.5",
+    "@nocobase/evaluators": "2.4.0-alpha.5",
+    "@nocobase/lock-manager": "2.4.0-alpha.5",
+    "@nocobase/logger": "2.4.0-alpha.5",
+    "@nocobase/resourcer": "2.4.0-alpha.5",
+    "@nocobase/sdk": "2.4.0-alpha.5",
+    "@nocobase/snowflake-id": "2.4.0-alpha.5",
+    "@nocobase/telemetry": "2.4.0-alpha.5",
+    "@nocobase/utils": "2.4.0-alpha.5",
     "@types/decompress": "4.2.7",
     "@types/ini": "^1.3.31",
     "@types/koa-send": "^4.1.3",
@@ -61,5 +61,5 @@
     "@types/serve-handler": "^6.1.1",
     "@types/ws": "^8.5.5"
   },
-  "gitHead": "746e2e042c12df2cb03877361ea9f2a8797a1921"
+  "gitHead": "ce4b0948641b13d2964c44905cb30bebe877a657"
 }