@nocobase/utils 2.2.0-beta.9 → 3.0.0-alpha.1

package/lib/auth-cookie-name.d.ts

@@ -0,0 +1,10 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export type AuthCookieType = 'authToken' | 'authenticator' | 'role' | 'csrfToken';
+export declare function getAuthCookieName(type: AuthCookieType, appName?: string): string;

package/lib/auth-cookie-name.js

@@ -0,0 +1,46 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var auth_cookie_name_exports = {};
+__export(auth_cookie_name_exports, {
+  getAuthCookieName: () => getAuthCookieName
+});
+module.exports = __toCommonJS(auth_cookie_name_exports);
+const cookieNamePrefixes = {
+  authToken: "nb_auth_token",
+  authenticator: "nb_authenticator",
+  role: "nb_role",
+  csrfToken: "nb_csrf_token"
+};
+function getAuthCookieName(type, appName) {
+  return `${cookieNamePrefixes[type]}_${appName || "main"}`;
+}
+__name(getAuthCookieName, "getAuthCookieName");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getAuthCookieName
+});

package/lib/auth-cookie.d.ts

@@ -0,0 +1,21 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export type { AuthCookieType } from './auth-cookie-name';
+export { getAuthCookieName } from './auth-cookie-name';
+export declare function getAuthCookieOptions(ctx: {
+    protocol?: string;
+    headers?: Record<string, string | string[] | undefined>;
+}, httpOnly?: boolean, maxAge?: number): {
+    maxAge?: number;
+    secureProxy?: boolean;
+    httpOnly: boolean;
+    sameSite: "lax";
+    secure: boolean;
+    path: string;
+};

package/lib/auth-cookie.js

@@ -0,0 +1,62 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var auth_cookie_exports = {};
+__export(auth_cookie_exports, {
+  getAuthCookieName: () => import_auth_cookie_name.getAuthCookieName,
+  getAuthCookieOptions: () => getAuthCookieOptions
+});
+module.exports = __toCommonJS(auth_cookie_exports);
+var import_auth_cookie_name = require("./auth-cookie-name");
+function getFirstHeaderValue(value) {
+  var _a;
+  const header = Array.isArray(value) ? value[0] : value;
+  return (_a = header == null ? void 0 : header.split(",")[0]) == null ? void 0 : _a.trim().toLowerCase();
+}
+__name(getFirstHeaderValue, "getFirstHeaderValue");
+function getAuthCookieOptions(ctx, httpOnly = true, maxAge) {
+  var _a, _b;
+  const forwardedProto = (_a = ctx.headers) == null ? void 0 : _a["x-forwarded-proto"];
+  const forwardedProtocol = getFirstHeaderValue(forwardedProto);
+  const protocol = forwardedProtocol || ctx.protocol;
+  const publicPath = ((_b = process.env.APP_PUBLIC_PATH) == null ? void 0 : _b.replace(/\/+$/g, "")) || "/";
+  const secure = protocol === "https";
+  return {
+    httpOnly,
+    sameSite: "lax",
+    secure: secure && !forwardedProtocol,
+    path: publicPath || "/",
+    ...secure && forwardedProtocol ? { secureProxy: true } : {},
+    ...maxAge ? { maxAge } : {}
+  };
+}
+__name(getAuthCookieOptions, "getAuthCookieOptions");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getAuthCookieName,
+  getAuthCookieOptions
+});

package/lib/client.d.ts

@@ -11,6 +11,7 @@ import { dayjs } from './dayjs';
 import { getDayRangeByParams, getOffsetRangeByParams } from './dateRangeUtils';
 export * from './collections-graph';
 export * from './common';
+export * from './auth-cookie-name';
 export * from './date';
 export * from './forEach';
 export * from './getValuesByPath';

package/lib/client.js

@@ -48,6 +48,7 @@ var import_dayjs = require("./dayjs");
 var import_dateRangeUtils = require("./dateRangeUtils");
 __reExport(client_exports, require("./collections-graph"), module.exports);
 __reExport(client_exports, require("./common"), module.exports);
+__reExport(client_exports, require("./auth-cookie-name"), module.exports);
 __reExport(client_exports, require("./date"), module.exports);
 __reExport(client_exports, require("./forEach"), module.exports);
 __reExport(client_exports, require("./getValuesByPath"), module.exports);
@@ -79,6 +80,7 @@ __reExport(client_exports, require("./liquidjs"), module.exports);
   lodash,
   ...require("./collections-graph"),
   ...require("./common"),
+  ...require("./auth-cookie-name"),
   ...require("./date"),
   ...require("./forEach"),
   ...require("./getValuesByPath"),

package/lib/cors.d.ts

@@ -0,0 +1,19 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export interface OriginContext {
+    protocol?: string;
+    headers?: Record<string, string | string[] | undefined>;
+    get(name: string): string;
+}
+export declare function getFirstHeaderValue(value: string | string[] | undefined): string;
+export declare function getCorsWhitelist(): Set<string>;
+export declare function getRequestOrigin(ctx: OriginContext): string;
+export declare function getOrigin(value: string): string;
+export declare function isSameOrigin(ctx: OriginContext, origin: string): boolean;
+export declare function isTrustedOrigin(ctx: OriginContext, origin: string): boolean;

package/lib/cors.js

@@ -0,0 +1,92 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var cors_exports = {};
+__export(cors_exports, {
+  getCorsWhitelist: () => getCorsWhitelist,
+  getFirstHeaderValue: () => getFirstHeaderValue,
+  getOrigin: () => getOrigin,
+  getRequestOrigin: () => getRequestOrigin,
+  isSameOrigin: () => isSameOrigin,
+  isTrustedOrigin: () => isTrustedOrigin
+});
+module.exports = __toCommonJS(cors_exports);
+function getFirstHeaderValue(value) {
+  var _a;
+  const header = Array.isArray(value) ? value[0] : value;
+  return (_a = header == null ? void 0 : header.split(",")[0]) == null ? void 0 : _a.trim();
+}
+__name(getFirstHeaderValue, "getFirstHeaderValue");
+function getCorsWhitelist() {
+  const whitelistString = process.env.CORS_ORIGIN_WHITELIST;
+  if (!whitelistString) {
+    return null;
+  }
+  return new Set(
+    whitelistString.split(",").map((item) => item.trim()).filter(Boolean)
+  );
+}
+__name(getCorsWhitelist, "getCorsWhitelist");
+function getRequestOrigin(ctx) {
+  var _a, _b, _c;
+  const protocol = (_b = getFirstHeaderValue((_a = ctx.headers) == null ? void 0 : _a["x-forwarded-proto"]) || ctx.protocol) == null ? void 0 : _b.toLowerCase();
+  const host = getFirstHeaderValue((_c = ctx.headers) == null ? void 0 : _c["x-forwarded-host"]) || ctx.get("host");
+  return host ? `${protocol}://${host}` : void 0;
+}
+__name(getRequestOrigin, "getRequestOrigin");
+function getOrigin(value) {
+  try {
+    return new URL(value).origin;
+  } catch {
+    return null;
+  }
+}
+__name(getOrigin, "getOrigin");
+function isSameOrigin(ctx, origin) {
+  return origin === getRequestOrigin(ctx);
+}
+__name(isSameOrigin, "isSameOrigin");
+function isTrustedOrigin(ctx, origin) {
+  if (isSameOrigin(ctx, origin)) {
+    return true;
+  }
+  const whitelist = getCorsWhitelist();
+  if (!whitelist) {
+    return false;
+  }
+  return whitelist.has("*") || whitelist.has(origin);
+}
+__name(isTrustedOrigin, "isTrustedOrigin");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getCorsWhitelist,
+  getFirstHeaderValue,
+  getOrigin,
+  getRequestOrigin,
+  isSameOrigin,
+  isTrustedOrigin
+});

package/lib/index.d.ts

@@ -9,8 +9,10 @@
 import lodash from 'lodash';
 export { Schema } from '@formily/json-schema';
 export * from './assign';
+export * from './auth-cookie';
 export * from './collections-graph';
 export * from './common';
+export * from './cors';
 export * from './crypto';
 export * from './date';
 export * from './dateRangeUtils';

package/lib/index.js

@@ -45,8 +45,10 @@ module.exports = __toCommonJS(src_exports);
 var import_lodash = __toESM(require("lodash"));
 var import_json_schema = require("@formily/json-schema");
 __reExport(src_exports, require("./assign"), module.exports);
+__reExport(src_exports, require("./auth-cookie"), module.exports);
 __reExport(src_exports, require("./collections-graph"), module.exports);
 __reExport(src_exports, require("./common"), module.exports);
+__reExport(src_exports, require("./cors"), module.exports);
 __reExport(src_exports, require("./crypto"), module.exports);
 __reExport(src_exports, require("./date"), module.exports);
 __reExport(src_exports, require("./dateRangeUtils"), module.exports);
@@ -88,8 +90,10 @@ __reExport(src_exports, require("./storage-path"), module.exports);
   dayjs,
   lodash,
   ...require("./assign"),
+  ...require("./auth-cookie"),
   ...require("./collections-graph"),
   ...require("./common"),
+  ...require("./cors"),
   ...require("./crypto"),
   ...require("./date"),
   ...require("./dateRangeUtils"),

package/lib/server-request.d.ts

@@ -30,7 +30,8 @@ export declare function checkUrlAgainstWhitelist(url?: string): void;
  * Drop-in replacement for `axios.request()` with built-in SSRF protection.
  *
  * Validates `config.url` against {@link checkUrlAgainstWhitelist} before
- * forwarding to axios. Use this instead of calling axios directly for all
+ * forwarding to axios. Every redirect destination is validated before the
+ * next request is sent. Use this instead of calling axios directly for all
  * server-initiated outbound HTTP requests.
  */
 export declare function serverRequest<T = any>(config: AxiosRequestConfig): Promise<AxiosResponse<T>>;

package/lib/server-request.js

@@ -207,7 +207,18 @@ __name(checkUrlAgainstWhitelist, "checkUrlAgainstWhitelist");
 async function serverRequest(config) {
   checkUrlAgainstWhitelist(config.url);
   await warnIfResolvedSsrfRiskTarget(config.url);
-  return import_axios.default.request(config);
+  return import_axios.default.request({
+    ...config,
+    // Axios request interceptors do not run again for redirects. In Node.js,
+    // beforeRedirect runs after Location is resolved and before the next hop
+    // is sent, so every redirect destination must be checked here.
+    beforeRedirect: /* @__PURE__ */ __name((options) => {
+      if (typeof options.href !== "string") {
+        throw new Error("Unable to validate redirect destination.");
+      }
+      checkUrlAgainstWhitelist(options.href);
+    }, "beforeRedirect")
+  });
 }
 __name(serverRequest, "serverRequest");
 // Annotate the CommonJS export names for ESM import in node:

package/lib/storage-path.js

@@ -43,12 +43,19 @@ __export(storage_path_exports, {
 });
 module.exports = __toCommonJS(storage_path_exports);
 var import_path = __toESM(require("path"));
+function resolveDefaultStorageRoot() {
+  if (import_path.default.basename(process.cwd()) === "source") {
+    return import_path.default.resolve(process.cwd(), "..", "storage");
+  }
+  return import_path.default.resolve(process.cwd(), "storage");
+}
+__name(resolveDefaultStorageRoot, "resolveDefaultStorageRoot");
 function resolveStorageRoot() {
   const raw = process.env.STORAGE_PATH;
   if (raw) {
     return import_path.default.isAbsolute(raw) ? raw : import_path.default.resolve(process.cwd(), raw);
   }
-  return import_path.default.resolve(process.cwd(), "storage");
+  return resolveDefaultStorageRoot();
 }
 __name(resolveStorageRoot, "resolveStorageRoot");
 function storagePathJoin(...segments) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/utils",
-  "version": "2.2.0-beta.9",
+  "version": "3.0.0-alpha.1",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -21,5 +21,5 @@
     "object-path": "^0.11.8",
     "ses": "^1.14.0"
   },
-  "gitHead": "60e3d7abbaa0c7cead76f71a4f3d5eedb6b8acdb"
+  "gitHead": "22d8be8ece179cfa5c8a4ebb2c896c92bd418e03"
 }