@nocobase/utils 2.2.0-beta.8 → 2.2.0

package/lib/auth-cookie-name.d.ts

@@ -0,0 +1,10 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export type AuthCookieType = 'authToken' | 'authenticator' | 'role' | 'csrfToken';
+export declare function getAuthCookieName(type: AuthCookieType, appName?: string): string;

package/lib/auth-cookie-name.js

@@ -0,0 +1,46 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var auth_cookie_name_exports = {};
+__export(auth_cookie_name_exports, {
+  getAuthCookieName: () => getAuthCookieName
+});
+module.exports = __toCommonJS(auth_cookie_name_exports);
+const cookieNamePrefixes = {
+  authToken: "nb_auth_token",
+  authenticator: "nb_authenticator",
+  role: "nb_role",
+  csrfToken: "nb_csrf_token"
+};
+function getAuthCookieName(type, appName) {
+  return `${cookieNamePrefixes[type]}_${appName || "main"}`;
+}
+__name(getAuthCookieName, "getAuthCookieName");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getAuthCookieName
+});

package/lib/auth-cookie.d.ts

@@ -0,0 +1,21 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export type { AuthCookieType } from './auth-cookie-name';
+export { getAuthCookieName } from './auth-cookie-name';
+export declare function getAuthCookieOptions(ctx: {
+    protocol?: string;
+    headers?: Record<string, string | string[] | undefined>;
+}, httpOnly?: boolean, maxAge?: number): {
+    maxAge?: number;
+    secureProxy?: boolean;
+    httpOnly: boolean;
+    sameSite: "lax";
+    secure: boolean;
+    path: string;
+};

package/lib/auth-cookie.js

@@ -0,0 +1,62 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var auth_cookie_exports = {};
+__export(auth_cookie_exports, {
+  getAuthCookieName: () => import_auth_cookie_name.getAuthCookieName,
+  getAuthCookieOptions: () => getAuthCookieOptions
+});
+module.exports = __toCommonJS(auth_cookie_exports);
+var import_auth_cookie_name = require("./auth-cookie-name");
+function getFirstHeaderValue(value) {
+  var _a;
+  const header = Array.isArray(value) ? value[0] : value;
+  return (_a = header == null ? void 0 : header.split(",")[0]) == null ? void 0 : _a.trim().toLowerCase();
+}
+__name(getFirstHeaderValue, "getFirstHeaderValue");
+function getAuthCookieOptions(ctx, httpOnly = true, maxAge) {
+  var _a, _b;
+  const forwardedProto = (_a = ctx.headers) == null ? void 0 : _a["x-forwarded-proto"];
+  const forwardedProtocol = getFirstHeaderValue(forwardedProto);
+  const protocol = forwardedProtocol || ctx.protocol;
+  const publicPath = ((_b = process.env.APP_PUBLIC_PATH) == null ? void 0 : _b.replace(/\/+$/g, "")) || "/";
+  const secure = protocol === "https";
+  return {
+    httpOnly,
+    sameSite: "lax",
+    secure: secure && !forwardedProtocol,
+    path: publicPath || "/",
+    ...secure && forwardedProtocol ? { secureProxy: true } : {},
+    ...maxAge ? { maxAge } : {}
+  };
+}
+__name(getAuthCookieOptions, "getAuthCookieOptions");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getAuthCookieName,
+  getAuthCookieOptions
+});

package/lib/client.d.ts

@@ -11,8 +11,10 @@ import { dayjs } from './dayjs';
 import { getDayRangeByParams, getOffsetRangeByParams } from './dateRangeUtils';
 export * from './collections-graph';
 export * from './common';
+export * from './auth-cookie-name';
 export * from './date';
 export * from './forEach';
+export { generateFlowModelRdFromToken } from './flow-model-rd';
 export * from './getValuesByPath';
 export * from './handlebars';
 export * from './isValidFilter';

package/lib/client.js

@@ -38,6 +38,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var client_exports = {};
 __export(client_exports, {
   dayjs: () => import_dayjs.dayjs,
+  generateFlowModelRdFromToken: () => import_flow_model_rd.generateFlowModelRdFromToken,
   getDayRangeByParams: () => import_dateRangeUtils.getDayRangeByParams,
   getOffsetRangeByParams: () => import_dateRangeUtils.getOffsetRangeByParams,
   lodash: () => import_lodash.default
@@ -48,8 +49,10 @@ var import_dayjs = require("./dayjs");
 var import_dateRangeUtils = require("./dateRangeUtils");
 __reExport(client_exports, require("./collections-graph"), module.exports);
 __reExport(client_exports, require("./common"), module.exports);
+__reExport(client_exports, require("./auth-cookie-name"), module.exports);
 __reExport(client_exports, require("./date"), module.exports);
 __reExport(client_exports, require("./forEach"), module.exports);
+var import_flow_model_rd = require("./flow-model-rd");
 __reExport(client_exports, require("./getValuesByPath"), module.exports);
 __reExport(client_exports, require("./handlebars"), module.exports);
 __reExport(client_exports, require("./isValidFilter"), module.exports);
@@ -74,11 +77,13 @@ __reExport(client_exports, require("./liquidjs"), module.exports);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   dayjs,
+  generateFlowModelRdFromToken,
   getDayRangeByParams,
   getOffsetRangeByParams,
   lodash,
   ...require("./collections-graph"),
   ...require("./common"),
+  ...require("./auth-cookie-name"),
   ...require("./date"),
   ...require("./forEach"),
   ...require("./getValuesByPath"),

package/lib/cors.d.ts

@@ -0,0 +1,19 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export interface OriginContext {
+    protocol?: string;
+    headers?: Record<string, string | string[] | undefined>;
+    get(name: string): string;
+}
+export declare function getFirstHeaderValue(value: string | string[] | undefined): string;
+export declare function getCorsWhitelist(): Set<string>;
+export declare function getRequestOrigin(ctx: OriginContext): string;
+export declare function getOrigin(value: string): string;
+export declare function isSameOrigin(ctx: OriginContext, origin: string): boolean;
+export declare function isTrustedOrigin(ctx: OriginContext, origin: string): boolean;

package/lib/cors.js

@@ -0,0 +1,92 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var cors_exports = {};
+__export(cors_exports, {
+  getCorsWhitelist: () => getCorsWhitelist,
+  getFirstHeaderValue: () => getFirstHeaderValue,
+  getOrigin: () => getOrigin,
+  getRequestOrigin: () => getRequestOrigin,
+  isSameOrigin: () => isSameOrigin,
+  isTrustedOrigin: () => isTrustedOrigin
+});
+module.exports = __toCommonJS(cors_exports);
+function getFirstHeaderValue(value) {
+  var _a;
+  const header = Array.isArray(value) ? value[0] : value;
+  return (_a = header == null ? void 0 : header.split(",")[0]) == null ? void 0 : _a.trim();
+}
+__name(getFirstHeaderValue, "getFirstHeaderValue");
+function getCorsWhitelist() {
+  const whitelistString = process.env.CORS_ORIGIN_WHITELIST;
+  if (!whitelistString) {
+    return null;
+  }
+  return new Set(
+    whitelistString.split(",").map((item) => item.trim()).filter(Boolean)
+  );
+}
+__name(getCorsWhitelist, "getCorsWhitelist");
+function getRequestOrigin(ctx) {
+  var _a, _b, _c;
+  const protocol = (_b = getFirstHeaderValue((_a = ctx.headers) == null ? void 0 : _a["x-forwarded-proto"]) || ctx.protocol) == null ? void 0 : _b.toLowerCase();
+  const host = getFirstHeaderValue((_c = ctx.headers) == null ? void 0 : _c["x-forwarded-host"]) || ctx.get("host");
+  return host ? `${protocol}://${host}` : void 0;
+}
+__name(getRequestOrigin, "getRequestOrigin");
+function getOrigin(value) {
+  try {
+    return new URL(value).origin;
+  } catch {
+    return null;
+  }
+}
+__name(getOrigin, "getOrigin");
+function isSameOrigin(ctx, origin) {
+  return origin === getRequestOrigin(ctx);
+}
+__name(isSameOrigin, "isSameOrigin");
+function isTrustedOrigin(ctx, origin) {
+  if (isSameOrigin(ctx, origin)) {
+    return true;
+  }
+  const whitelist = getCorsWhitelist();
+  if (!whitelist) {
+    return false;
+  }
+  return whitelist.has("*") || whitelist.has(origin);
+}
+__name(isTrustedOrigin, "isTrustedOrigin");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getCorsWhitelist,
+  getFirstHeaderValue,
+  getOrigin,
+  getRequestOrigin,
+  isSameOrigin,
+  isTrustedOrigin
+});

package/lib/flow-model-rd.d.ts

@@ -0,0 +1,20 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+type JwtSessionPayload = {
+    userId?: unknown;
+    signInTime?: unknown;
+    jti?: unknown;
+};
+export declare function decodeJwtSessionPayload(token?: string | null): JwtSessionPayload | null;
+export declare function getFlowModelRdSessionId(payload?: JwtSessionPayload | null): string;
+export declare function getFlowModelRdSessionIdFromToken(token?: string | null): string;
+export declare function generateFlowModelRd(flowModelUid?: string | number | null, sessionId?: string | null): string;
+export declare function generateFlowModelRdFromToken(flowModelUid?: string | number | null, token?: string | null): string;
+export declare function resolveFlowModelUidFromRd(rd?: string | null, sessionId?: string | null): string;
+export {};

package/lib/flow-model-rd.js

@@ -0,0 +1,136 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var flow_model_rd_exports = {};
+__export(flow_model_rd_exports, {
+  decodeJwtSessionPayload: () => decodeJwtSessionPayload,
+  generateFlowModelRd: () => generateFlowModelRd,
+  generateFlowModelRdFromToken: () => generateFlowModelRdFromToken,
+  getFlowModelRdSessionId: () => getFlowModelRdSessionId,
+  getFlowModelRdSessionIdFromToken: () => getFlowModelRdSessionIdFromToken,
+  resolveFlowModelUidFromRd: () => resolveFlowModelUidFromRd
+});
+module.exports = __toCommonJS(flow_model_rd_exports);
+const rdCache = /* @__PURE__ */ new Map();
+function toBase64Url(input) {
+  if (typeof btoa === "function") {
+    return btoa(input).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+  }
+  return Buffer.from(input, "binary").toString("base64url");
+}
+__name(toBase64Url, "toBase64Url");
+function fromBase64Url(input) {
+  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
+  if (typeof atob === "function") {
+    return atob(padded);
+  }
+  return Buffer.from(padded, "base64").toString("binary");
+}
+__name(fromBase64Url, "fromBase64Url");
+function fastHash(input) {
+  let hash = 2166136261;
+  for (let index = 0; index < input.length; index += 1) {
+    hash ^= input.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(36);
+}
+__name(fastHash, "fastHash");
+function xorString(input, mask) {
+  if (!mask) return "";
+  let output = "";
+  for (let index = 0; index < input.length; index += 1) {
+    output += String.fromCharCode(input.charCodeAt(index) ^ mask.charCodeAt(index % mask.length));
+  }
+  return output;
+}
+__name(xorString, "xorString");
+function decodeJwtSessionPayload(token) {
+  if (!token || typeof token !== "string") return null;
+  const parts = token.split(".");
+  if (parts.length < 2) return null;
+  try {
+    return JSON.parse(fromBase64Url(parts[1]));
+  } catch {
+    return null;
+  }
+}
+__name(decodeJwtSessionPayload, "decodeJwtSessionPayload");
+function getFlowModelRdSessionId(payload) {
+  const userId = payload == null ? void 0 : payload.userId;
+  const sessionKey = (payload == null ? void 0 : payload.signInTime) || (payload == null ? void 0 : payload.jti);
+  if (typeof userId !== "string" && typeof userId !== "number" || typeof sessionKey !== "string" && typeof sessionKey !== "number") {
+    return "";
+  }
+  return `${userId}:${sessionKey}`;
+}
+__name(getFlowModelRdSessionId, "getFlowModelRdSessionId");
+function getFlowModelRdSessionIdFromToken(token) {
+  return getFlowModelRdSessionId(decodeJwtSessionPayload(token));
+}
+__name(getFlowModelRdSessionIdFromToken, "getFlowModelRdSessionIdFromToken");
+function generateFlowModelRd(flowModelUid, sessionId) {
+  if (typeof flowModelUid !== "string" && typeof flowModelUid !== "number" || !sessionId) return void 0;
+  const uid = String(flowModelUid);
+  const cacheKey = `${sessionId}
+${uid}`;
+  const cached = rdCache.get(cacheKey);
+  if (cached) return cached;
+  const cipher = toBase64Url(xorString(uid, fastHash(`mask:v1:${sessionId}`)));
+  const check = fastHash(`check:v1:${sessionId}:${uid}`);
+  const rd = `v1.${cipher}.${check}`;
+  rdCache.set(cacheKey, rd);
+  return rd;
+}
+__name(generateFlowModelRd, "generateFlowModelRd");
+function generateFlowModelRdFromToken(flowModelUid, token) {
+  return generateFlowModelRd(flowModelUid, getFlowModelRdSessionIdFromToken(token));
+}
+__name(generateFlowModelRdFromToken, "generateFlowModelRdFromToken");
+function resolveFlowModelUidFromRd(rd, sessionId) {
+  if (!rd || !sessionId || typeof rd !== "string") return void 0;
+  const parts = rd.split(".");
+  if (parts.length !== 3 || parts[0] !== "v1" || !parts[1] || !parts[2]) return void 0;
+  try {
+    const uid = xorString(fromBase64Url(parts[1]), fastHash(`mask:v1:${sessionId}`));
+    const check = fastHash(`check:v1:${sessionId}:${uid}`);
+    return check === parts[2] ? uid : void 0;
+  } catch {
+    return void 0;
+  }
+}
+__name(resolveFlowModelUidFromRd, "resolveFlowModelUidFromRd");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  decodeJwtSessionPayload,
+  generateFlowModelRd,
+  generateFlowModelRdFromToken,
+  getFlowModelRdSessionId,
+  getFlowModelRdSessionIdFromToken,
+  resolveFlowModelUidFromRd
+});

package/lib/index.d.ts

@@ -9,14 +9,17 @@
 import lodash from 'lodash';
 export { Schema } from '@formily/json-schema';
 export * from './assign';
+export * from './auth-cookie';
 export * from './collections-graph';
 export * from './common';
+export * from './cors';
 export * from './crypto';
 export * from './date';
 export * from './dateRangeUtils';
 export * from './dayjs';
 export { dayjs } from './dayjs';
 export * from './forEach';
+export * from './flow-model-rd';
 export * from './fs-exists';
 export * from './handlebars';
 export * from './i18n';

package/lib/index.js

@@ -45,14 +45,17 @@ module.exports = __toCommonJS(src_exports);
 var import_lodash = __toESM(require("lodash"));
 var import_json_schema = require("@formily/json-schema");
 __reExport(src_exports, require("./assign"), module.exports);
+__reExport(src_exports, require("./auth-cookie"), module.exports);
 __reExport(src_exports, require("./collections-graph"), module.exports);
 __reExport(src_exports, require("./common"), module.exports);
+__reExport(src_exports, require("./cors"), module.exports);
 __reExport(src_exports, require("./crypto"), module.exports);
 __reExport(src_exports, require("./date"), module.exports);
 __reExport(src_exports, require("./dateRangeUtils"), module.exports);
 __reExport(src_exports, require("./dayjs"), module.exports);
 var import_dayjs = require("./dayjs");
 __reExport(src_exports, require("./forEach"), module.exports);
+__reExport(src_exports, require("./flow-model-rd"), module.exports);
 __reExport(src_exports, require("./fs-exists"), module.exports);
 __reExport(src_exports, require("./handlebars"), module.exports);
 __reExport(src_exports, require("./i18n"), module.exports);
@@ -88,13 +91,16 @@ __reExport(src_exports, require("./storage-path"), module.exports);
   dayjs,
   lodash,
   ...require("./assign"),
+  ...require("./auth-cookie"),
   ...require("./collections-graph"),
   ...require("./common"),
+  ...require("./cors"),
   ...require("./crypto"),
   ...require("./date"),
   ...require("./dateRangeUtils"),
   ...require("./dayjs"),
   ...require("./forEach"),
+  ...require("./flow-model-rd"),
   ...require("./fs-exists"),
   ...require("./handlebars"),
   ...require("./i18n"),

package/lib/server-request.d.ts

@@ -30,7 +30,8 @@ export declare function checkUrlAgainstWhitelist(url?: string): void;
  * Drop-in replacement for `axios.request()` with built-in SSRF protection.
  *
  * Validates `config.url` against {@link checkUrlAgainstWhitelist} before
- * forwarding to axios. Use this instead of calling axios directly for all
+ * forwarding to axios. Every redirect destination is validated before the
+ * next request is sent. Use this instead of calling axios directly for all
  * server-initiated outbound HTTP requests.
  */
 export declare function serverRequest<T = any>(config: AxiosRequestConfig): Promise<AxiosResponse<T>>;

package/lib/server-request.js

@@ -44,7 +44,12 @@ __export(server_request_exports, {
 module.exports = __toCommonJS(server_request_exports);
 var import_ipaddr = __toESM(require("ipaddr.js"));
 var import_axios = __toESM(require("axios"));
+var import_promises = require("dns/promises");
 const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+const SSRF_RISK_IP_RANGES = /* @__PURE__ */ new Set(["loopback", "private", "linkLocal", "uniqueLocal", "unspecified"]);
+const SSRF_RISK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "metadata.google.internal"]);
+const DNS_LOOKUP_WARNING_TIMEOUT = 1e3;
+const warnedSsrfRiskTargets = /* @__PURE__ */ new Set();
 function matchesIpEntry(hostname, entry) {
   try {
     let addr = import_ipaddr.default.parse(hostname);
@@ -87,6 +92,88 @@ function matchesEntry(hostname, entry) {
   return import_ipaddr.default.isValid(hostname) ? matchesIpEntry(hostname, e) : matchesDomainPattern(hostname, e);
 }
 __name(matchesEntry, "matchesEntry");
+function getNormalizedHost(url) {
+  const { hostname } = url;
+  return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+__name(getNormalizedHost, "getNormalizedHost");
+function getSsrfRiskReason(hostname) {
+  const host = hostname.toLowerCase();
+  if (SSRF_RISK_HOSTNAMES.has(host)) {
+    return "known local or metadata hostname";
+  }
+  if (!import_ipaddr.default.isValid(host)) {
+    return;
+  }
+  try {
+    let addr = import_ipaddr.default.parse(host);
+    if (addr.kind() === "ipv6" && addr.isIPv4MappedAddress()) {
+      addr = addr.toIPv4Address();
+    }
+    const range = addr.range();
+    return SSRF_RISK_IP_RANGES.has(range) ? range : void 0;
+  } catch {
+    return;
+  }
+}
+__name(getSsrfRiskReason, "getSsrfRiskReason");
+function warnSsrfRiskTarget(host, reason, key = `${host}:${reason}`) {
+  if (warnedSsrfRiskTargets.has(key)) return;
+  warnedSsrfRiskTargets.add(key);
+  console.warn(
+    [
+      `Outbound request to "${host}" targets a potential SSRF risk target (${reason}) and is allowed because SERVER_REQUEST_WHITELIST is not configured.`,
+      "Configure SERVER_REQUEST_WHITELIST to explicitly allow required outbound targets.",
+      "A future version may block private, loopback, link-local, and metadata targets by default."
+    ].join(" ")
+  );
+}
+__name(warnSsrfRiskTarget, "warnSsrfRiskTarget");
+function warnIfSsrfRiskTarget(host) {
+  const reason = getSsrfRiskReason(host);
+  if (!reason) return;
+  warnSsrfRiskTarget(host, reason);
+}
+__name(warnIfSsrfRiskTarget, "warnIfSsrfRiskTarget");
+function hasServerRequestWhitelist() {
+  const whitelist = process.env.SERVER_REQUEST_WHITELIST;
+  return Boolean(whitelist && whitelist.trim());
+}
+__name(hasServerRequestWhitelist, "hasServerRequestWhitelist");
+async function resolveHostAddresses(host) {
+  try {
+    return await Promise.race([
+      (0, import_promises.lookup)(host, { all: true, verbatim: true }),
+      new Promise((resolve) => {
+        setTimeout(() => resolve([]), DNS_LOOKUP_WARNING_TIMEOUT);
+      })
+    ]);
+  } catch {
+    return [];
+  }
+}
+__name(resolveHostAddresses, "resolveHostAddresses");
+async function warnIfResolvedSsrfRiskTarget(url) {
+  if (!url || !url.includes("://") || hasServerRequestWhitelist()) return;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return;
+  }
+  if (!ALLOWED_PROTOCOLS.has(parsed.protocol)) return;
+  const host = getNormalizedHost(parsed);
+  if (getSsrfRiskReason(host) || import_ipaddr.default.isValid(host)) return;
+  const addresses = await resolveHostAddresses(host);
+  for (const address of addresses) {
+    const reason = getSsrfRiskReason(address.address);
+    if (reason) {
+      warnSsrfRiskTarget(host, `resolves to ${address.address} (${reason})`, `${host}:resolved-risk`);
+      return;
+    }
+  }
+}
+__name(warnIfResolvedSsrfRiskTarget, "warnIfResolvedSsrfRiskTarget");
 function checkUrlAgainstWhitelist(url) {
   if (!url) return;
   if (!url.includes("://")) return;
@@ -101,12 +188,14 @@ function checkUrlAgainstWhitelist(url) {
       `URL scheme "${parsed.protocol.replace(":", "")}" is not allowed. Only http and https are permitted.`
     );
   }
+  const host = getNormalizedHost(parsed);
   const whitelist = process.env.SERVER_REQUEST_WHITELIST;
-  if (!whitelist || !whitelist.trim()) return;
+  if (!whitelist || !whitelist.trim()) {
+    warnIfSsrfRiskTarget(host);
+    return;
+  }
   const entries = whitelist.split(",").map((e) => e.trim()).filter(Boolean);
   if (entries.length === 0) return;
-  const { hostname } = parsed;
-  const host = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
   for (const entry of entries) {
     if (matchesEntry(host, entry)) return;
   }
@@ -117,7 +206,19 @@ function checkUrlAgainstWhitelist(url) {
 __name(checkUrlAgainstWhitelist, "checkUrlAgainstWhitelist");
 async function serverRequest(config) {
   checkUrlAgainstWhitelist(config.url);
-  return import_axios.default.request(config);
+  await warnIfResolvedSsrfRiskTarget(config.url);
+  return import_axios.default.request({
+    ...config,
+    // Axios request interceptors do not run again for redirects. In Node.js,
+    // beforeRedirect runs after Location is resolved and before the next hop
+    // is sent, so every redirect destination must be checked here.
+    beforeRedirect: /* @__PURE__ */ __name((options) => {
+      if (typeof options.href !== "string") {
+        throw new Error("Unable to validate redirect destination.");
+      }
+      checkUrlAgainstWhitelist(options.href);
+    }, "beforeRedirect")
+  });
 }
 __name(serverRequest, "serverRequest");
 // Annotate the CommonJS export names for ESM import in node:

package/lib/variable-usage.d.ts

@@ -9,6 +9,14 @@
 export type JSONValue = string | {
     [key: string]: JSONValue;
 } | JSONValue[];
+export type VariableUsageExtractionResult = {
+    unsupportedDynamicPath: boolean;
+    usage: Record<string, string[]>;
+};
+/**
+ * 提取模板中的 ctx 使用情况。该函数只做静态扫描，不执行表达式。
+ */
+export declare function extractVariableUsage(template: JSONValue): VariableUsageExtractionResult;
 /**
  * 提取模板中使用到的 ctx 顶层变量名集合。
  * - 支持点语法与顶层括号变量：ctx.user / ctx["user"]

package/lib/variable-usage.js

@@ -28,111 +28,289 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var variable_usage_exports = {};
 __export(variable_usage_exports, {
   extractUsedVariableNames: () => extractUsedVariableNames,
-  extractUsedVariablePaths: () => extractUsedVariablePaths
+  extractUsedVariablePaths: () => extractUsedVariablePaths,
+  extractVariableUsage: () => extractVariableUsage
 });
 module.exports = __toCommonJS(variable_usage_exports);
-function extractUsedVariableNames(template) {
-  const result = /* @__PURE__ */ new Set();
-  const visit = /* @__PURE__ */ __name((src) => {
-    if (typeof src === "string") {
-      const regex = /\{\{\s*([^}]+?)\s*\}\}/g;
-      let m;
-      while ((m = regex.exec(src)) !== null) {
-        const expr = m[1];
-        const pathRegex = /ctx\.([a-zA-Z_$][a-zA-Z0-9_$]*)/g;
-        let pm;
-        while ((pm = pathRegex.exec(expr)) !== null) {
-          result.add(pm[1]);
-        }
-        const bracketVarRegex = /ctx\[\s*(["'])\s*([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\1\s*\]/g;
-        let bm;
-        while ((bm = bracketVarRegex.exec(expr)) !== null) {
-          result.add(bm[2]);
-        }
+function isObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+__name(isObject, "isObject");
+function isIdentifierStart(char) {
+  return !!char && /[a-zA-Z_$]/.test(char);
+}
+__name(isIdentifierStart, "isIdentifierStart");
+function isIdentifierPart(char) {
+  return !!char && /[a-zA-Z0-9_$]/.test(char);
+}
+__name(isIdentifierPart, "isIdentifierPart");
+function skipSpaces(input, index) {
+  let next = index;
+  while (/\s/.test(input[next] || "")) next += 1;
+  return next;
+}
+__name(skipSpaces, "skipSpaces");
+function skipPostfix(input, index) {
+  let next = skipSpaces(input, index);
+  while (input[next] === "!") {
+    next = skipSpaces(input, next + 1);
+  }
+  return next;
+}
+__name(skipPostfix, "skipPostfix");
+function previousNonSpaceIndex(input, index) {
+  let next = index;
+  while (next >= 0 && /\s/.test(input[next] || "")) next -= 1;
+  return next;
+}
+__name(previousNonSpaceIndex, "previousNonSpaceIndex");
+function isGroupedCtxReference(input, start) {
+  const openParenIndex = previousNonSpaceIndex(input, start - 1);
+  if (input[openParenIndex] !== "(") return false;
+  const beforeOpenParenIndex = previousNonSpaceIndex(input, openParenIndex - 1);
+  if (beforeOpenParenIndex < 0) return true;
+  const beforeOpenParen = input[beforeOpenParenIndex];
+  return !isIdentifierPart(beforeOpenParen) && beforeOpenParen !== ")" && beforeOpenParen !== "]";
+}
+__name(isGroupedCtxReference, "isGroupedCtxReference");
+function hasGroupedContinuation(input, index) {
+  const closeParenIndex = skipSpaces(input, index);
+  if (input[closeParenIndex] !== ")") return false;
+  const continuationIndex = skipSpaces(input, closeParenIndex + 1);
+  return input[continuationIndex] === "." || input[continuationIndex] === "[" || input.startsWith("?.", continuationIndex);
+}
+__name(hasGroupedContinuation, "hasGroupedContinuation");
+function readIdentifier(input, index) {
+  if (!isIdentifierStart(input[index])) return null;
+  let next = index + 1;
+  while (isIdentifierPart(input[next])) next += 1;
+  return { value: input.slice(index, next), next };
+}
+__name(readIdentifier, "readIdentifier");
+function readNumber(input, index) {
+  const match = input.slice(index).match(/^\d+/);
+  return match ? { value: match[0], next: index + match[0].length } : null;
+}
+__name(readNumber, "readNumber");
+function readQuotedProperty(input, index) {
+  const quote = input[index];
+  if (quote !== '"' && quote !== "'") return null;
+  let next = index + 1;
+  let value = "";
+  while (next < input.length) {
+    const char = input[next];
+    if (char === "\\") {
+      value += input.slice(next, next + 2);
+      next += 2;
+      continue;
+    }
+    if (char === quote) {
+      return { value, next: next + 1 };
+    }
+    value += char;
+    next += 1;
+  }
+  return null;
+}
+__name(readQuotedProperty, "readQuotedProperty");
+function readBracketAccess(input, index) {
+  let next = skipSpaces(input, index + 1);
+  const quoted = readQuotedProperty(input, next);
+  if (quoted) {
+    next = skipSpaces(input, quoted.next);
+    if (input[next] !== "]") return { dynamic: true };
+    return { dynamic: false, kind: "property", next: next + 1, value: quoted.value };
+  }
+  const number = readNumber(input, next);
+  if (number) {
+    next = skipSpaces(input, number.next);
+    if (input[next] !== "]") return { dynamic: true };
+    return { dynamic: false, kind: "index", next: next + 1, value: number.value };
+  }
+  return { dynamic: true };
+}
+__name(readBracketAccess, "readBracketAccess");
+function appendPathSegment(segments, kind, value) {
+  if (kind === "property") {
+    segments.push(value);
+    return;
+  }
+  if (segments.length) {
+    segments[segments.length - 1] = `${segments[segments.length - 1]}[${value}]`;
+    return;
+  }
+  segments.push(`[${value}]`);
+}
+__name(appendPathSegment, "appendPathSegment");
+function readAccess(input, index) {
+  const next = skipPostfix(input, index);
+  if (input[next] === "[") {
+    return readBracketAccess(input, next);
+  }
+  if (input.startsWith("?.", next)) {
+    const propertyStart = skipSpaces(input, next + 2);
+    if (input[propertyStart] === "[") {
+      return readBracketAccess(input, propertyStart);
+    }
+    const identifier = readIdentifier(input, propertyStart) || readNumber(input, propertyStart);
+    return identifier ? { dynamic: false, kind: "property", next: identifier.next, value: identifier.value } : null;
+  }
+  if (input[next] === ".") {
+    const propertyStart = skipSpaces(input, next + 1);
+    const identifier = readIdentifier(input, propertyStart) || readNumber(input, propertyStart);
+    return identifier ? { dynamic: false, kind: "property", next: identifier.next, value: identifier.value } : null;
+  }
+  return null;
+}
+__name(readAccess, "readAccess");
+function parseDotOnlyCtxReference(expr) {
+  const trimmed = expr.trim();
+  const segment = "(?:[a-zA-Z_$][a-zA-Z0-9_$-]*|\\d+)";
+  const match = trimmed.match(new RegExp(`^ctx\\.([a-zA-Z_$][a-zA-Z0-9_$]*)(?:\\.(${segment}(?:\\.${segment})*))?$`));
+  if (!match) return null;
+  return {
+    methodCall: false,
+    path: match[2] || void 0,
+    unsupportedDynamicPath: false,
+    varName: match[1]
+  };
+}
+__name(parseDotOnlyCtxReference, "parseDotOnlyCtxReference");
+function parseCtxReference(input, start) {
+  if (input.slice(start, start + 3) !== "ctx") return null;
+  if (isIdentifierPart(input[start - 1]) || isIdentifierPart(input[start + 3])) return null;
+  if (isGroupedCtxReference(input, start)) {
+    return {
+      next: start + 3,
+      reference: {
+        methodCall: false,
+        unsupportedDynamicPath: true,
+        varName: ""
       }
-    } else if (Array.isArray(src)) {
-      src.forEach(visit);
-    } else if (src && typeof src === "object") {
-      Object.values(src).forEach(visit);
+    };
+  }
+  const rootAccess = readAccess(input, start + 3);
+  if (!rootAccess) return null;
+  if (rootAccess.dynamic) {
+    return {
+      next: start + 3,
+      reference: {
+        methodCall: false,
+        unsupportedDynamicPath: true,
+        varName: ""
+      }
+    };
+  }
+  if (rootAccess.kind !== "property") {
+    return null;
+  }
+  const segments = [];
+  let next = rootAccess.next;
+  let methodCall = false;
+  let unsupportedDynamicPath = false;
+  while (next < input.length) {
+    const accessStart = skipPostfix(input, next);
+    if ((input[accessStart] === "(" || input.startsWith("?.(", accessStart)) && !segments.length) {
+      methodCall = true;
+      next = accessStart;
+      break;
     }
-  }, "visit");
-  visit(template);
-  return result;
+    const access = readAccess(input, next);
+    if (!access) {
+      next = accessStart;
+      if (input[accessStart] === "[" || input[accessStart] === "." || input.startsWith("?.", accessStart)) {
+        unsupportedDynamicPath = true;
+      }
+      break;
+    }
+    if (access.dynamic) {
+      unsupportedDynamicPath = true;
+      next = accessStart;
+      break;
+    }
+    appendPathSegment(segments, access.kind, access.value);
+    next = access.next;
+  }
+  const path = segments.join(".");
+  return {
+    next: Math.max(next, rootAccess.next),
+    reference: {
+      methodCall,
+      path: path || void 0,
+      unsupportedDynamicPath: unsupportedDynamicPath || hasGroupedContinuation(input, next),
+      varName: rootAccess.value
+    }
+  };
 }
-__name(extractUsedVariableNames, "extractUsedVariableNames");
-function extractUsedVariablePaths(template) {
+__name(parseCtxReference, "parseCtxReference");
+function collectCtxReferences(expr) {
+  const dotOnly = parseDotOnlyCtxReference(expr);
+  if (dotOnly) return [dotOnly];
+  const references = [];
+  for (let index = 0; index < expr.length; index += 1) {
+    if (expr.slice(index, index + 3) !== "ctx") continue;
+    const parsed = parseCtxReference(expr, index);
+    if (!parsed) continue;
+    references.push(parsed.reference);
+    index = Math.max(index, parsed.next - 1);
+  }
+  return references;
+}
+__name(collectCtxReferences, "collectCtxReferences");
+function addUsagePath(usage, varName, path, methodCall) {
+  usage[varName] = usage[varName] || [];
+  if (path) {
+    usage[varName].push(path);
+  } else if (methodCall && !usage[varName].includes("")) {
+    usage[varName].push("");
+  }
+}
+__name(addUsagePath, "addUsagePath");
+function extractVariableUsage(template) {
   const usage = {};
+  let unsupportedDynamicPath = false;
+  const visitExpression = /* @__PURE__ */ __name((expr) => {
+    for (const reference of collectCtxReferences(expr)) {
+      if (reference.unsupportedDynamicPath) {
+        unsupportedDynamicPath = true;
+        continue;
+      }
+      if (!reference.varName) continue;
+      addUsagePath(usage, reference.varName, reference.path, reference.methodCall);
+    }
+  }, "visitExpression");
   const visit = /* @__PURE__ */ __name((src) => {
     if (typeof src === "string") {
       const regex = /\{\{\s*([^}]+?)\s*\}\}/g;
-      let m;
-      while ((m = regex.exec(src)) !== null) {
-        const expr = m[1];
-        const pathRegex = /ctx\.([a-zA-Z_$][a-zA-Z0-9_$]*)([^\s)]*)/g;
-        let pm;
-        while ((pm = pathRegex.exec(expr)) !== null) {
-          const varName = pm[1];
-          const after = pm[2] || "";
-          usage[varName] = usage[varName] || [];
-          if (after.startsWith(".")) {
-            usage[varName].push(after.slice(1));
-          } else if (after.startsWith("[")) {
-            const mm = after.match(/^\[\s*(["'])\s*([^'"\]]+)\s*\1\s*\](.*)$/);
-            if (mm) {
-              const first = mm[2];
-              const rest = mm[3] || "";
-              usage[varName].push(`${first}${rest}`);
-            } else {
-              const mn = after.match(/^\[(\d+)\](.*)$/);
-              if (mn) {
-                const idx = mn[1];
-                const rest = mn[2] || "";
-                usage[varName].push(`[${idx}]${rest}`);
-              }
-            }
-          } else if (after.startsWith("(")) {
-            if (!usage[varName].length) usage[varName].push("");
-          }
-        }
-        const bracketVarRegex = /ctx\[\s*(["'])\s*([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\1\s*\]([^\s)]*)/g;
-        let bm;
-        while ((bm = bracketVarRegex.exec(expr)) !== null) {
-          const varName = bm[2];
-          const after = bm[3] || "";
-          usage[varName] = usage[varName] || [];
-          if (after.startsWith(".")) {
-            usage[varName].push(after.slice(1));
-          } else if (after.startsWith("[")) {
-            const mm = after.match(/^\[\s*(["'])\s*([^'"\]]+)\s*\1\s*\](.*)$/);
-            if (mm) {
-              const first = mm[2];
-              const rest = mm[3] || "";
-              usage[varName].push(`${first}${rest}`);
-            } else {
-              const mn = after.match(/^\[(\d+)\](.*)$/);
-              if (mn) {
-                const idx = mn[1];
-                const rest = mn[2] || "";
-                usage[varName].push(`[${idx}]${rest}`);
-              }
-            }
-          } else if (after.startsWith("(")) {
-            if (!usage[varName].length) usage[varName].push("");
-          }
-        }
+      let match;
+      while ((match = regex.exec(src)) !== null) {
+        visitExpression(match[1]);
       }
-    } else if (Array.isArray(src)) {
+      return;
+    }
+    if (Array.isArray(src)) {
       src.forEach(visit);
-    } else if (src && typeof src === "object") {
+      return;
+    }
+    if (isObject(src)) {
       Object.values(src).forEach(visit);
     }
   }, "visit");
   visit(template);
-  return usage;
+  return { unsupportedDynamicPath, usage };
+}
+__name(extractVariableUsage, "extractVariableUsage");
+function extractUsedVariableNames(template) {
+  return new Set(Object.keys(extractVariableUsage(template).usage));
+}
+__name(extractUsedVariableNames, "extractUsedVariableNames");
+function extractUsedVariablePaths(template) {
+  return extractVariableUsage(template).usage;
 }
 __name(extractUsedVariablePaths, "extractUsedVariablePaths");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   extractUsedVariableNames,
-  extractUsedVariablePaths
+  extractUsedVariablePaths,
+  extractVariableUsage
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/utils",
-  "version": "2.2.0-beta.8",
+  "version": "2.2.0",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -21,5 +21,5 @@
     "object-path": "^0.11.8",
     "ses": "^1.14.0"
   },
-  "gitHead": "fa2502c1e9faf6d74b3f51b42dbc6546638d46af"
+  "gitHead": "d5052cae37177054c236f1bf7bba3aed6ef029d0"
 }