@nocobase/utils 2.1.0-alpha.2 → 2.1.0-alpha.21

package/README.md

@@ -1,17 +1,24 @@
 # NocoBase
 
 <video width="100%" controls>
-      <source src="https://static-docs.nocobase.com/NocoBase0510.mp4" type="video/mp4">
+  <source src="https://github.com/user-attachments/assets/4d11a87b-00e2-48f3-9bf7-389d21072d13" type="video/mp4">
 </video>
 
+<p align="center">
+<a href="https://trendshift.io/repositories/4112" target="_blank"><img src="https://trendshift.io/api/badge/repositories/4112" alt="nocobase%2Fnocobase | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
+<a href="https://www.producthunt.com/posts/nocobase?embed=true&utm_source=badge-top-post-topic-badge&utm_medium=badge&utm_souce=badge-nocobase" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/top-post-topic-badge.svg?post_id=456520&theme=light&period=weekly&topic_id=267" alt="NocoBase - Scalability&#0045;first&#0044;&#0032;open&#0045;source&#0032;no&#0045;code&#0032;platform | Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
+</p>
 
 ## What is NocoBase
 
-NocoBase is a scalability-first, open-source no-code development platform.  
-Instead of investing years of time and millions of dollars in research and development, deploy NocoBase in a few minutes and you'll have a private, controllable, and extremely scalable no-code development platform!
+NocoBase is the most extensible AI-powered no-code platform.   
+Total control. Infinite extensibility. AI collaboration.  
+Enable your team to adapt quickly and cut costs dramatically.  
+No years of development. No millions wasted.  
+Deploy NocoBase in minutes — and take control of everything.
 
 Homepage:  
-https://www.nocobase.com/
+https://www.nocobase.com/  
 
 Online Demo:  
 https://demo.nocobase.com/new
@@ -19,12 +26,74 @@ https://demo.nocobase.com/new
 Documents:  
 https://docs.nocobase.com/
 
-Commericial license & plugins:  
-https://www.nocobase.com/en/commercial
+Forum:  
+https://forum.nocobase.com/
 
-License agreement:   
-https://www.nocobase.com/en/agreement
+Use Cases:  
+https://www.nocobase.com/en/blog/tags/customer-stories
 
+## Release Notes
 
-## Contact Us:  
-hello@nocobase.com
+Our [blog](https://www.nocobase.com/en/blog/timeline) is regularly updated with release notes and provides a weekly summary.
+
+## Distinctive features
+
+### 1. Data model-driven, not form/table–driven
+
+Instead of being constrained by forms or tables, NocoBase adopts a data model–driven approach, separating data structure from user interface to unlock unlimited possibilities.
+
+- UI and data structure are fully decoupled
+- Multiple blocks and actions can be created for the same table or record in any quantity or form
+- Supports the main database, external databases, and third-party APIs as data sources
+
+![model](https://static-docs.nocobase.com/model.png)
+
+### 2. AI employees, integrated into your business systems
+Unlike standalone AI demos, NocoBase allows you to embed AI capabilities seamlessly into your interfaces, workflows, and data context, making AI truly useful in real business scenarios.
+
+- Define AI employees for roles such as translator, analyst, researcher, or assistant
+- Seamless AI–human collaboration in interfaces and workflows
+- Ensure AI usage is secure, transparent, and customizable for your business needs
+
+![AI-employee](https://static-docs.nocobase.com/ai-employee-home.png)
+
+### 3. What you see is what you get, incredibly easy to use
+
+While enabling the development of complex business systems, NocoBase keeps the experience simple and intuitive.
+
+- One-click switch between usage mode and configuration mode
+- Pages serve as a canvas to arrange blocks and actions, similar to Notion
+- Configuration mode is designed for ordinary users, not just programmers
+
+![wysiwyg](https://static-docs.nocobase.com/wysiwyg.gif)
+
+### 4. Everything is a plugin, designed for extension
+Adding more no-code features will never cover every business case. NocoBase is built for extension through its plugin-based microkernel architecture.
+
+- All functionalities are plugins, similar to WordPress
+- Plugins are ready to use upon installation
+- Pages, blocks, actions, APIs, and data sources can all be extended through custom plugins
+
+![plugins](https://static-docs.nocobase.com/plugins.png)
+
+## Installation
+
+NocoBase supports three installation methods:
+
+- <a target="_blank" href="https://docs.nocobase.com/welcome/getting-started/installation/docker-compose">Installing With Docker (👍Recommended)</a>
+
+  Suitable for no-code scenarios, no code to write. When upgrading, just download the latest image and reboot.
+
+- <a target="_blank" href="https://docs.nocobase.com/welcome/getting-started/installation/create-nocobase-app">Installing from create-nocobase-app CLI</a>
+
+  The business code of the project is completely independent and supports low-code development.
+
+- <a target="_blank" href="https://docs.nocobase.com/welcome/getting-started/installation/git-clone">Installing from Git source code</a>
+
+  If you want to experience the latest unreleased version, or want to participate in the contribution, you need to make changes and debug on the source code, it is recommended to choose this installation method, which requires a high level of development skills, and if the code has been updated, you can git pull the latest code.
+
+## How NocoBase works
+
+<video width="100%" controls>
+  <source src="https://github.com/user-attachments/assets/8d183b44-9bb5-4792-b08f-bc08fe8dfaaf" type="video/mp4">
+</video>

package/lib/index.d.ts

@@ -44,4 +44,6 @@ export * from './variable-usage';
 export * from './wrap-middleware';
 export * from './run-sql';
 export * from './liquidjs';
+export * from './server-request';
+export * from './storage-path';
 export { lodash };

package/lib/index.js

@@ -80,6 +80,8 @@ __reExport(src_exports, require("./variable-usage"), module.exports);
 __reExport(src_exports, require("./wrap-middleware"), module.exports);
 __reExport(src_exports, require("./run-sql"), module.exports);
 __reExport(src_exports, require("./liquidjs"), module.exports);
+__reExport(src_exports, require("./server-request"), module.exports);
+__reExport(src_exports, require("./storage-path"), module.exports);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   Schema,
@@ -119,5 +121,7 @@ __reExport(src_exports, require("./liquidjs"), module.exports);
   ...require("./variable-usage"),
   ...require("./wrap-middleware"),
   ...require("./run-sql"),
-  ...require("./liquidjs")
+  ...require("./liquidjs"),
+  ...require("./server-request"),
+  ...require("./storage-path")
 });

package/lib/server-request.d.ts

@@ -0,0 +1,36 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import { AxiosRequestConfig, AxiosResponse } from 'axios';
+/**
+ * Match a hostname against a domain pattern.
+ * `*.example.com` matches exactly one subdomain level (e.g. `foo.example.com`)
+ * but not `example.com` itself or deeper levels like `a.b.example.com`.
+ */
+export declare function matchesDomainPattern(hostname: string, pattern: string): boolean;
+/**
+ * Validate a URL against the SERVER_REQUEST_WHITELIST environment variable.
+ *
+ * Throws an error if:
+ *   - The URL scheme is not http or https.
+ *   - SERVER_REQUEST_WHITELIST is set and the host does not match any entry.
+ *
+ * Silently returns for relative URLs (no scheme) so that internal API calls
+ * that use a relative path are not affected.
+ *
+ * Prefer using {@link serverRequest} over calling this directly.
+ */
+export declare function checkUrlAgainstWhitelist(url?: string): void;
+/**
+ * Drop-in replacement for `axios.request()` with built-in SSRF protection.
+ *
+ * Validates `config.url` against {@link checkUrlAgainstWhitelist} before
+ * forwarding to axios. Use this instead of calling axios directly for all
+ * server-initiated outbound HTTP requests.
+ */
+export declare function serverRequest<T = any>(config: AxiosRequestConfig): Promise<AxiosResponse<T>>;

package/lib/server-request.js

@@ -0,0 +1,128 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var server_request_exports = {};
+__export(server_request_exports, {
+  checkUrlAgainstWhitelist: () => checkUrlAgainstWhitelist,
+  matchesDomainPattern: () => matchesDomainPattern,
+  serverRequest: () => serverRequest
+});
+module.exports = __toCommonJS(server_request_exports);
+var import_ipaddr = __toESM(require("ipaddr.js"));
+var import_axios = __toESM(require("axios"));
+const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+function matchesIpEntry(hostname, entry) {
+  try {
+    let addr = import_ipaddr.default.parse(hostname);
+    if (addr.kind() === "ipv6" && addr.isIPv4MappedAddress()) {
+      addr = addr.toIPv4Address();
+    }
+    if (entry.includes("/")) {
+      const cidr = import_ipaddr.default.parseCIDR(entry);
+      if (addr.kind() !== cidr[0].kind()) return false;
+      if (addr.kind() === "ipv4") {
+        return addr.match(cidr);
+      }
+      return addr.match(cidr);
+    }
+    let entryAddr = import_ipaddr.default.parse(entry);
+    if (entryAddr.kind() === "ipv6" && entryAddr.isIPv4MappedAddress()) {
+      entryAddr = entryAddr.toIPv4Address();
+    }
+    return addr.toString() === entryAddr.toString();
+  } catch {
+    return false;
+  }
+}
+__name(matchesIpEntry, "matchesIpEntry");
+function matchesDomainPattern(hostname, pattern) {
+  const h = hostname.toLowerCase();
+  const p = pattern.toLowerCase();
+  if (p.startsWith("*.")) {
+    const suffix = p.slice(1);
+    if (!h.endsWith(suffix) || h.length <= suffix.length) return false;
+    const prefix = h.slice(0, h.length - suffix.length);
+    return !prefix.includes(".");
+  }
+  return h === p;
+}
+__name(matchesDomainPattern, "matchesDomainPattern");
+function matchesEntry(hostname, entry) {
+  const e = entry.trim();
+  if (!e) return false;
+  return import_ipaddr.default.isValid(hostname) ? matchesIpEntry(hostname, e) : matchesDomainPattern(hostname, e);
+}
+__name(matchesEntry, "matchesEntry");
+function checkUrlAgainstWhitelist(url) {
+  if (!url) return;
+  if (!url.includes("://")) return;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return;
+  }
+  if (!ALLOWED_PROTOCOLS.has(parsed.protocol)) {
+    throw new Error(
+      `URL scheme "${parsed.protocol.replace(":", "")}" is not allowed. Only http and https are permitted.`
+    );
+  }
+  const whitelist = process.env.SERVER_REQUEST_WHITELIST;
+  if (!whitelist || !whitelist.trim()) return;
+  const entries = whitelist.split(",").map((e) => e.trim()).filter(Boolean);
+  if (entries.length === 0) return;
+  const { hostname } = parsed;
+  const host = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  for (const entry of entries) {
+    if (matchesEntry(host, entry)) return;
+  }
+  throw new Error(
+    `Outbound request to "${host}" is blocked. Add it to SERVER_REQUEST_WHITELIST to allow this request.`
+  );
+}
+__name(checkUrlAgainstWhitelist, "checkUrlAgainstWhitelist");
+async function serverRequest(config) {
+  checkUrlAgainstWhitelist(config.url);
+  return import_axios.default.request(config);
+}
+__name(serverRequest, "serverRequest");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  checkUrlAgainstWhitelist,
+  matchesDomainPattern,
+  serverRequest
+});

package/lib/storage-path.d.ts

@@ -0,0 +1,25 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+/**
+ * Absolute path to the application storage root (same rules as CLI `resolveStorageRoot` in `cli-v1/src/util.js`).
+ */
+export declare function resolveStorageRoot(): string;
+/**
+ * Join path segments under the application storage root.
+ * Resolution matches CLI `resolveStorageRoot()` / `initEnv`: use `STORAGE_PATH` when set
+ * (absolute or relative to cwd), otherwise `<cwd>/storage`.
+ *
+ * @example storagePathJoin('tmp')
+ * @example storagePathJoin('cache', 'apps', appName)
+ */
+export declare function storagePathJoin(...segments: string[]): string;
+/**
+ * Resolve plugin storage path: `PLUGIN_STORAGE_PATH` first, else `<STORAGE_PATH>/plugins`.
+ */
+export declare function resolvePluginStoragePath(): string;

package/lib/storage-path.js

@@ -0,0 +1,71 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var storage_path_exports = {};
+__export(storage_path_exports, {
+  resolvePluginStoragePath: () => resolvePluginStoragePath,
+  resolveStorageRoot: () => resolveStorageRoot,
+  storagePathJoin: () => storagePathJoin
+});
+module.exports = __toCommonJS(storage_path_exports);
+var import_path = __toESM(require("path"));
+function resolveStorageRoot() {
+  const raw = process.env.STORAGE_PATH;
+  if (raw) {
+    return import_path.default.isAbsolute(raw) ? raw : import_path.default.resolve(process.cwd(), raw);
+  }
+  return import_path.default.resolve(process.cwd(), "storage");
+}
+__name(resolveStorageRoot, "resolveStorageRoot");
+function storagePathJoin(...segments) {
+  return import_path.default.join(resolveStorageRoot(), ...segments);
+}
+__name(storagePathJoin, "storagePathJoin");
+function resolvePluginStoragePath() {
+  if (process.env.PLUGIN_STORAGE_PATH) {
+    const p = process.env.PLUGIN_STORAGE_PATH;
+    return import_path.default.isAbsolute(p) ? p : import_path.default.resolve(process.cwd(), p);
+  }
+  return storagePathJoin("plugins");
+}
+__name(resolvePluginStoragePath, "resolvePluginStoragePath");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  resolvePluginStoragePath,
+  resolveStorageRoot,
+  storagePathJoin
+});

package/package.json

@@ -1,23 +1,25 @@
 {
   "name": "@nocobase/utils",
-  "version": "2.1.0-alpha.2",
+  "version": "2.1.0-alpha.21",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
-  "license": "AGPL-3.0",
+  "license": "Apache-2.0",
   "dependencies": {
     "@budibase/handlebars-helpers": "0.14.0",
     "@hapi/topo": "^6.0.0",
     "@rc-component/mini-decimal": "^1.1.0",
+    "axios": "^1.7.0",
     "dayjs": "^1.11.9",
     "deepmerge": "^4.2.2",
     "flat-to-nested": "^1.1.1",
     "fs-extra": "^11.1.1",
     "graphlib": "^2.1.8",
     "handlebars": "^4.7.8",
+    "ipaddr.js": "^1.9.1",
     "liquidjs": "^10.23.0",
     "multer": "^1.4.5-lts.2",
     "object-path": "^0.11.8",
     "ses": "^1.14.0"
   },
-  "gitHead": "01afd1b928c72c072947533fb12a61b06e45c985"
+  "gitHead": "b4c2b469f321ecaec7863a8ae371a02fe6a35aa2"
 }

package/plugin-symlink.js

@@ -1,6 +1,15 @@
-const { resolve } = require('path');
+const path = require('path');
+const { resolve } = path;
 const fs = require('fs-extra');
 
+function resolvePluginStoragePath() {
+  if (process.env.PLUGIN_STORAGE_PATH) {
+    const p = process.env.PLUGIN_STORAGE_PATH;
+    return path.isAbsolute(p) ? p : path.resolve(process.cwd(), p);
+  }
+  return path.join(process.env.STORAGE_PATH || path.resolve(process.cwd(), 'storage'), 'plugins');
+}
+
 /**
  * Recursively get plugin names from a directory
  * @param {string} target - Target directory to scan
@@ -136,7 +145,7 @@ async function createPluginSymLink(pluginName, sourcePath, nodeModulesPath, plug
  * @returns {Promise<void>}
  */
 async function createStoragePluginSymLink(pluginName) {
-  const storagePluginsPath = resolve(process.cwd(), 'storage/plugins');
+  const storagePluginsPath = resolvePluginStoragePath();
   const nodeModulesPath = process.env.NODE_MODULES_PATH;
   await createPluginSymLink(pluginName, storagePluginsPath, nodeModulesPath, 'storage');
 }
@@ -146,7 +155,7 @@ async function createStoragePluginSymLink(pluginName) {
  * @returns {Promise<void>}
  */
 async function createStoragePluginsSymlink() {
-  const storagePluginsPath = resolve(process.cwd(), 'storage/plugins');
+  const storagePluginsPath = resolvePluginStoragePath();
   if (!(await fs.pathExists(storagePluginsPath))) {
     return;
   }
@@ -178,6 +187,7 @@ async function createDevPluginsSymlink() {
   await Promise.all(pluginNames.map((pluginName) => createDevPluginSymLink(pluginName)));
 }
 
+exports.resolvePluginStoragePath = resolvePluginStoragePath;
 exports.createStoragePluginSymLink = createStoragePluginSymLink;
 exports.createStoragePluginsSymlink = createStoragePluginsSymlink;
 exports.createDevPluginSymLink = createDevPluginSymLink;