@nocobase/utils 2.3.0-alpha.1 → 2.3.0-beta.10

package/lib/client.d.ts

@@ -14,6 +14,7 @@ export * from './common';
 export * from './auth-cookie-name';
 export * from './date';
 export * from './forEach';
+export { generateFlowModelRdFromToken } from './flow-model-rd';
 export * from './getValuesByPath';
 export * from './handlebars';
 export * from './isValidFilter';
@@ -28,6 +29,7 @@ export * from './ses';
 export * from './i18n';
 export * from './isPortalInBody';
 export * from './parseHTML';
+export * from './sanitize-rich-text-html';
 export * from './uid';
 export * from './url';
 export * from './transformMultiColumnToSingleColumn';

package/lib/client.js

@@ -38,6 +38,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var client_exports = {};
 __export(client_exports, {
   dayjs: () => import_dayjs.dayjs,
+  generateFlowModelRdFromToken: () => import_flow_model_rd.generateFlowModelRdFromToken,
   getDayRangeByParams: () => import_dateRangeUtils.getDayRangeByParams,
   getOffsetRangeByParams: () => import_dateRangeUtils.getOffsetRangeByParams,
   lodash: () => import_lodash.default
@@ -51,6 +52,7 @@ __reExport(client_exports, require("./common"), module.exports);
 __reExport(client_exports, require("./auth-cookie-name"), module.exports);
 __reExport(client_exports, require("./date"), module.exports);
 __reExport(client_exports, require("./forEach"), module.exports);
+var import_flow_model_rd = require("./flow-model-rd");
 __reExport(client_exports, require("./getValuesByPath"), module.exports);
 __reExport(client_exports, require("./handlebars"), module.exports);
 __reExport(client_exports, require("./isValidFilter"), module.exports);
@@ -65,6 +67,7 @@ __reExport(client_exports, require("./ses"), module.exports);
 __reExport(client_exports, require("./i18n"), module.exports);
 __reExport(client_exports, require("./isPortalInBody"), module.exports);
 __reExport(client_exports, require("./parseHTML"), module.exports);
+__reExport(client_exports, require("./sanitize-rich-text-html"), module.exports);
 __reExport(client_exports, require("./uid"), module.exports);
 __reExport(client_exports, require("./url"), module.exports);
 __reExport(client_exports, require("./transformMultiColumnToSingleColumn"), module.exports);
@@ -75,6 +78,7 @@ __reExport(client_exports, require("./liquidjs"), module.exports);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   dayjs,
+  generateFlowModelRdFromToken,
   getDayRangeByParams,
   getOffsetRangeByParams,
   lodash,
@@ -97,6 +101,7 @@ __reExport(client_exports, require("./liquidjs"), module.exports);
   ...require("./i18n"),
   ...require("./isPortalInBody"),
   ...require("./parseHTML"),
+  ...require("./sanitize-rich-text-html"),
   ...require("./uid"),
   ...require("./url"),
   ...require("./transformMultiColumnToSingleColumn"),

package/lib/cors.js

@@ -71,11 +71,14 @@ function isSameOrigin(ctx, origin) {
 }
 __name(isSameOrigin, "isSameOrigin");
 function isTrustedOrigin(ctx, origin) {
-  var _a;
   if (isSameOrigin(ctx, origin)) {
     return true;
   }
-  return ((_a = getCorsWhitelist()) == null ? void 0 : _a.has(origin)) || false;
+  const whitelist = getCorsWhitelist();
+  if (!whitelist) {
+    return false;
+  }
+  return whitelist.has("*") || whitelist.has(origin);
 }
 __name(isTrustedOrigin, "isTrustedOrigin");
 // Annotate the CommonJS export names for ESM import in node:

package/lib/flow-model-rd.d.ts

@@ -0,0 +1,20 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+type JwtSessionPayload = {
+    userId?: unknown;
+    signInTime?: unknown;
+    jti?: unknown;
+};
+export declare function decodeJwtSessionPayload(token?: string | null): JwtSessionPayload | null;
+export declare function getFlowModelRdSessionId(payload?: JwtSessionPayload | null): string;
+export declare function getFlowModelRdSessionIdFromToken(token?: string | null): string;
+export declare function generateFlowModelRd(flowModelUid?: string | number | null, sessionId?: string | null): string;
+export declare function generateFlowModelRdFromToken(flowModelUid?: string | number | null, token?: string | null): string;
+export declare function resolveFlowModelUidFromRd(rd?: string | null, sessionId?: string | null): string;
+export {};

package/lib/flow-model-rd.js

@@ -0,0 +1,136 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var flow_model_rd_exports = {};
+__export(flow_model_rd_exports, {
+  decodeJwtSessionPayload: () => decodeJwtSessionPayload,
+  generateFlowModelRd: () => generateFlowModelRd,
+  generateFlowModelRdFromToken: () => generateFlowModelRdFromToken,
+  getFlowModelRdSessionId: () => getFlowModelRdSessionId,
+  getFlowModelRdSessionIdFromToken: () => getFlowModelRdSessionIdFromToken,
+  resolveFlowModelUidFromRd: () => resolveFlowModelUidFromRd
+});
+module.exports = __toCommonJS(flow_model_rd_exports);
+const rdCache = /* @__PURE__ */ new Map();
+function toBase64Url(input) {
+  if (typeof btoa === "function") {
+    return btoa(input).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+  }
+  return Buffer.from(input, "binary").toString("base64url");
+}
+__name(toBase64Url, "toBase64Url");
+function fromBase64Url(input) {
+  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
+  if (typeof atob === "function") {
+    return atob(padded);
+  }
+  return Buffer.from(padded, "base64").toString("binary");
+}
+__name(fromBase64Url, "fromBase64Url");
+function fastHash(input) {
+  let hash = 2166136261;
+  for (let index = 0; index < input.length; index += 1) {
+    hash ^= input.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(36);
+}
+__name(fastHash, "fastHash");
+function xorString(input, mask) {
+  if (!mask) return "";
+  let output = "";
+  for (let index = 0; index < input.length; index += 1) {
+    output += String.fromCharCode(input.charCodeAt(index) ^ mask.charCodeAt(index % mask.length));
+  }
+  return output;
+}
+__name(xorString, "xorString");
+function decodeJwtSessionPayload(token) {
+  if (!token || typeof token !== "string") return null;
+  const parts = token.split(".");
+  if (parts.length < 2) return null;
+  try {
+    return JSON.parse(fromBase64Url(parts[1]));
+  } catch {
+    return null;
+  }
+}
+__name(decodeJwtSessionPayload, "decodeJwtSessionPayload");
+function getFlowModelRdSessionId(payload) {
+  const userId = payload == null ? void 0 : payload.userId;
+  const sessionKey = (payload == null ? void 0 : payload.signInTime) || (payload == null ? void 0 : payload.jti);
+  if (typeof userId !== "string" && typeof userId !== "number" || typeof sessionKey !== "string" && typeof sessionKey !== "number") {
+    return "";
+  }
+  return `${userId}:${sessionKey}`;
+}
+__name(getFlowModelRdSessionId, "getFlowModelRdSessionId");
+function getFlowModelRdSessionIdFromToken(token) {
+  return getFlowModelRdSessionId(decodeJwtSessionPayload(token));
+}
+__name(getFlowModelRdSessionIdFromToken, "getFlowModelRdSessionIdFromToken");
+function generateFlowModelRd(flowModelUid, sessionId) {
+  if (typeof flowModelUid !== "string" && typeof flowModelUid !== "number" || !sessionId) return void 0;
+  const uid = String(flowModelUid);
+  const cacheKey = `${sessionId}
+${uid}`;
+  const cached = rdCache.get(cacheKey);
+  if (cached) return cached;
+  const cipher = toBase64Url(xorString(uid, fastHash(`mask:v1:${sessionId}`)));
+  const check = fastHash(`check:v1:${sessionId}:${uid}`);
+  const rd = `v1.${cipher}.${check}`;
+  rdCache.set(cacheKey, rd);
+  return rd;
+}
+__name(generateFlowModelRd, "generateFlowModelRd");
+function generateFlowModelRdFromToken(flowModelUid, token) {
+  return generateFlowModelRd(flowModelUid, getFlowModelRdSessionIdFromToken(token));
+}
+__name(generateFlowModelRdFromToken, "generateFlowModelRdFromToken");
+function resolveFlowModelUidFromRd(rd, sessionId) {
+  if (!rd || !sessionId || typeof rd !== "string") return void 0;
+  const parts = rd.split(".");
+  if (parts.length !== 3 || parts[0] !== "v1" || !parts[1] || !parts[2]) return void 0;
+  try {
+    const uid = xorString(fromBase64Url(parts[1]), fastHash(`mask:v1:${sessionId}`));
+    const check = fastHash(`check:v1:${sessionId}:${uid}`);
+    return check === parts[2] ? uid : void 0;
+  } catch {
+    return void 0;
+  }
+}
+__name(resolveFlowModelUidFromRd, "resolveFlowModelUidFromRd");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  decodeJwtSessionPayload,
+  generateFlowModelRd,
+  generateFlowModelRdFromToken,
+  getFlowModelRdSessionId,
+  getFlowModelRdSessionIdFromToken,
+  resolveFlowModelUidFromRd
+});

package/lib/index.d.ts

@@ -19,6 +19,7 @@ export * from './dateRangeUtils';
 export * from './dayjs';
 export { dayjs } from './dayjs';
 export * from './forEach';
+export * from './flow-model-rd';
 export * from './fs-exists';
 export * from './handlebars';
 export * from './i18n';
@@ -45,6 +46,7 @@ export * from './url';
 export * from './variable-usage';
 export * from './wrap-middleware';
 export * from './run-sql';
+export * from './sanitize-rich-text-html';
 export * from './liquidjs';
 export * from './server-request';
 export * from './storage-path';

package/lib/index.js

@@ -55,6 +55,7 @@ __reExport(src_exports, require("./dateRangeUtils"), module.exports);
 __reExport(src_exports, require("./dayjs"), module.exports);
 var import_dayjs = require("./dayjs");
 __reExport(src_exports, require("./forEach"), module.exports);
+__reExport(src_exports, require("./flow-model-rd"), module.exports);
 __reExport(src_exports, require("./fs-exists"), module.exports);
 __reExport(src_exports, require("./handlebars"), module.exports);
 __reExport(src_exports, require("./i18n"), module.exports);
@@ -81,6 +82,7 @@ __reExport(src_exports, require("./url"), module.exports);
 __reExport(src_exports, require("./variable-usage"), module.exports);
 __reExport(src_exports, require("./wrap-middleware"), module.exports);
 __reExport(src_exports, require("./run-sql"), module.exports);
+__reExport(src_exports, require("./sanitize-rich-text-html"), module.exports);
 __reExport(src_exports, require("./liquidjs"), module.exports);
 __reExport(src_exports, require("./server-request"), module.exports);
 __reExport(src_exports, require("./storage-path"), module.exports);
@@ -99,6 +101,7 @@ __reExport(src_exports, require("./storage-path"), module.exports);
   ...require("./dateRangeUtils"),
   ...require("./dayjs"),
   ...require("./forEach"),
+  ...require("./flow-model-rd"),
   ...require("./fs-exists"),
   ...require("./handlebars"),
   ...require("./i18n"),
@@ -125,6 +128,7 @@ __reExport(src_exports, require("./storage-path"), module.exports);
   ...require("./variable-usage"),
   ...require("./wrap-middleware"),
   ...require("./run-sql"),
+  ...require("./sanitize-rich-text-html"),
   ...require("./liquidjs"),
   ...require("./server-request"),
   ...require("./storage-path")

package/lib/sanitize-rich-text-html.d.ts

@@ -0,0 +1,9 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export declare function sanitizeRichTextHtml(value: string): any;

package/lib/sanitize-rich-text-html.js

@@ -0,0 +1,145 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var sanitize_rich_text_html_exports = {};
+__export(sanitize_rich_text_html_exports, {
+  sanitizeRichTextHtml: () => sanitizeRichTextHtml
+});
+module.exports = __toCommonJS(sanitize_rich_text_html_exports);
+var import_sanitize_html = __toESM(require("sanitize-html"));
+const imageDataUrlPattern = /^data:image\/(?:gif|jpe?g|png|webp);base64,[a-z\d+/=\s]+$/i;
+const dimensionPattern = /^(?:\d{1,4}(?:\.\d+)?(?:px)?|(?:100|[1-9]?\d)(?:\.\d+)?%)$/;
+const imageStyleDimensionPattern = /^(?:\d{1,4}(?:\.\d+)?px|(?:100|[1-9]?\d)(?:\.\d+)?%)$/;
+function sanitizeLinkAttributes(attribs) {
+  const nextAttributes = { ...attribs };
+  if (nextAttributes.target && !["_blank", "_self"].includes(nextAttributes.target)) {
+    delete nextAttributes.target;
+  }
+  if (nextAttributes.target === "_blank") {
+    nextAttributes.rel = "noopener noreferrer";
+  } else {
+    delete nextAttributes.rel;
+  }
+  return nextAttributes;
+}
+__name(sanitizeLinkAttributes, "sanitizeLinkAttributes");
+function sanitizeImageAttributes(attribs) {
+  var _a;
+  const nextAttributes = { ...attribs };
+  if (((_a = nextAttributes.src) == null ? void 0 : _a.trim().toLowerCase().startsWith("data:")) && !imageDataUrlPattern.test(nextAttributes.src)) {
+    delete nextAttributes.src;
+  }
+  for (const dimension of ["width", "height"]) {
+    if (nextAttributes[dimension] && !dimensionPattern.test(nextAttributes[dimension])) {
+      delete nextAttributes[dimension];
+    }
+  }
+  return nextAttributes;
+}
+__name(sanitizeImageAttributes, "sanitizeImageAttributes");
+const richTextSanitizeOptions = {
+  allowedTags: [
+    "a",
+    "b",
+    "blockquote",
+    "br",
+    "em",
+    "h1",
+    "h2",
+    "h3",
+    "h4",
+    "h5",
+    "h6",
+    "i",
+    "img",
+    "li",
+    "ol",
+    "p",
+    "s",
+    "span",
+    "strike",
+    "strong",
+    "u",
+    "ul"
+  ],
+  allowedAttributes: {
+    a: ["href", "target", "rel"],
+    img: ["src", "alt", "title", "width", "height", "style"],
+    span: ["style"]
+  },
+  allowedClasses: {
+    blockquote: [/^ql-indent-[1-9]$/],
+    h1: [/^ql-indent-[1-9]$/],
+    h2: [/^ql-indent-[1-9]$/],
+    h3: [/^ql-indent-[1-9]$/],
+    h4: [/^ql-indent-[1-9]$/],
+    h5: [/^ql-indent-[1-9]$/],
+    h6: [/^ql-indent-[1-9]$/],
+    li: [/^ql-indent-[1-9]$/],
+    p: [/^ql-indent-[1-9]$/]
+  },
+  allowedStyles: {
+    img: {
+      height: [imageStyleDimensionPattern],
+      width: [imageStyleDimensionPattern]
+    },
+    span: {
+      "font-size": [/^(?:12|14|16|18|20|24|32|48)px$/]
+    }
+  },
+  allowedSchemes: ["http", "https", "mailto", "tel"],
+  allowedSchemesByTag: {
+    img: ["http", "https", "data"]
+  },
+  allowProtocolRelative: false,
+  transformTags: {
+    a(tagName, attribs) {
+      return { tagName, attribs: sanitizeLinkAttributes(attribs) };
+    },
+    img(tagName, attribs) {
+      return { tagName, attribs: sanitizeImageAttributes(attribs) };
+    }
+  }
+};
+function sanitizeRichTextHtml(value) {
+  return (0, import_sanitize_html.default)(value, richTextSanitizeOptions);
+}
+__name(sanitizeRichTextHtml, "sanitizeRichTextHtml");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  sanitizeRichTextHtml
+});

package/lib/server-request.d.ts

@@ -18,6 +18,7 @@ export declare function matchesDomainPattern(hostname: string, pattern: string):
  *
  * Throws an error if:
  *   - The URL scheme is not http or https.
+ *   - SERVER_REQUEST_DISALLOW_IP is true and the host is a literal IP address.
  *   - SERVER_REQUEST_WHITELIST is set and the host does not match any entry.
  *
  * Silently returns for relative URLs (no scheme) so that internal API calls
@@ -30,7 +31,8 @@ export declare function checkUrlAgainstWhitelist(url?: string): void;
  * Drop-in replacement for `axios.request()` with built-in SSRF protection.
  *
  * Validates `config.url` against {@link checkUrlAgainstWhitelist} before
- * forwarding to axios. Use this instead of calling axios directly for all
+ * forwarding to axios. Every redirect destination is validated before the
+ * next request is sent. Use this instead of calling axios directly for all
  * server-initiated outbound HTTP requests.
  */
 export declare function serverRequest<T = any>(config: AxiosRequestConfig): Promise<AxiosResponse<T>>;

package/lib/server-request.js

@@ -189,13 +189,19 @@ function checkUrlAgainstWhitelist(url) {
     );
   }
   const host = getNormalizedHost(parsed);
+  if (process.env.SERVER_REQUEST_DISALLOW_IP === "true" && import_ipaddr.default.isValid(host)) {
+    throw new Error(`Outbound request to "${host}" is blocked because SERVER_REQUEST_DISALLOW_IP is enabled.`);
+  }
   const whitelist = process.env.SERVER_REQUEST_WHITELIST;
   if (!whitelist || !whitelist.trim()) {
     warnIfSsrfRiskTarget(host);
     return;
   }
   const entries = whitelist.split(",").map((e) => e.trim()).filter(Boolean);
-  if (entries.length === 0) return;
+  if (entries.length === 0) {
+    warnIfSsrfRiskTarget(host);
+    return;
+  }
   for (const entry of entries) {
     if (matchesEntry(host, entry)) return;
   }
@@ -207,7 +213,18 @@ __name(checkUrlAgainstWhitelist, "checkUrlAgainstWhitelist");
 async function serverRequest(config) {
   checkUrlAgainstWhitelist(config.url);
   await warnIfResolvedSsrfRiskTarget(config.url);
-  return import_axios.default.request(config);
+  return import_axios.default.request({
+    ...config,
+    // Axios request interceptors do not run again for redirects. In Node.js,
+    // beforeRedirect runs after Location is resolved and before the next hop
+    // is sent, so every redirect destination must be checked here.
+    beforeRedirect: /* @__PURE__ */ __name((options) => {
+      if (typeof options.href !== "string") {
+        throw new Error("Unable to validate redirect destination.");
+      }
+      checkUrlAgainstWhitelist(options.href);
+    }, "beforeRedirect")
+  });
 }
 __name(serverRequest, "serverRequest");
 // Annotate the CommonJS export names for ESM import in node:

package/lib/variable-usage.d.ts

@@ -9,6 +9,14 @@
 export type JSONValue = string | {
     [key: string]: JSONValue;
 } | JSONValue[];
+export type VariableUsageExtractionResult = {
+    unsupportedDynamicPath: boolean;
+    usage: Record<string, string[]>;
+};
+/**
+ * 提取模板中的 ctx 使用情况。该函数只做静态扫描，不执行表达式。
+ */
+export declare function extractVariableUsage(template: JSONValue): VariableUsageExtractionResult;
 /**
  * 提取模板中使用到的 ctx 顶层变量名集合。
  * - 支持点语法与顶层括号变量：ctx.user / ctx["user"]

package/lib/variable-usage.js

@@ -28,111 +28,289 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var variable_usage_exports = {};
 __export(variable_usage_exports, {
   extractUsedVariableNames: () => extractUsedVariableNames,
-  extractUsedVariablePaths: () => extractUsedVariablePaths
+  extractUsedVariablePaths: () => extractUsedVariablePaths,
+  extractVariableUsage: () => extractVariableUsage
 });
 module.exports = __toCommonJS(variable_usage_exports);
-function extractUsedVariableNames(template) {
-  const result = /* @__PURE__ */ new Set();
-  const visit = /* @__PURE__ */ __name((src) => {
-    if (typeof src === "string") {
-      const regex = /\{\{\s*([^}]+?)\s*\}\}/g;
-      let m;
-      while ((m = regex.exec(src)) !== null) {
-        const expr = m[1];
-        const pathRegex = /ctx\.([a-zA-Z_$][a-zA-Z0-9_$]*)/g;
-        let pm;
-        while ((pm = pathRegex.exec(expr)) !== null) {
-          result.add(pm[1]);
-        }
-        const bracketVarRegex = /ctx\[\s*(["'])\s*([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\1\s*\]/g;
-        let bm;
-        while ((bm = bracketVarRegex.exec(expr)) !== null) {
-          result.add(bm[2]);
-        }
+function isObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+__name(isObject, "isObject");
+function isIdentifierStart(char) {
+  return !!char && /[a-zA-Z_$]/.test(char);
+}
+__name(isIdentifierStart, "isIdentifierStart");
+function isIdentifierPart(char) {
+  return !!char && /[a-zA-Z0-9_$]/.test(char);
+}
+__name(isIdentifierPart, "isIdentifierPart");
+function skipSpaces(input, index) {
+  let next = index;
+  while (/\s/.test(input[next] || "")) next += 1;
+  return next;
+}
+__name(skipSpaces, "skipSpaces");
+function skipPostfix(input, index) {
+  let next = skipSpaces(input, index);
+  while (input[next] === "!") {
+    next = skipSpaces(input, next + 1);
+  }
+  return next;
+}
+__name(skipPostfix, "skipPostfix");
+function previousNonSpaceIndex(input, index) {
+  let next = index;
+  while (next >= 0 && /\s/.test(input[next] || "")) next -= 1;
+  return next;
+}
+__name(previousNonSpaceIndex, "previousNonSpaceIndex");
+function isGroupedCtxReference(input, start) {
+  const openParenIndex = previousNonSpaceIndex(input, start - 1);
+  if (input[openParenIndex] !== "(") return false;
+  const beforeOpenParenIndex = previousNonSpaceIndex(input, openParenIndex - 1);
+  if (beforeOpenParenIndex < 0) return true;
+  const beforeOpenParen = input[beforeOpenParenIndex];
+  return !isIdentifierPart(beforeOpenParen) && beforeOpenParen !== ")" && beforeOpenParen !== "]";
+}
+__name(isGroupedCtxReference, "isGroupedCtxReference");
+function hasGroupedContinuation(input, index) {
+  const closeParenIndex = skipSpaces(input, index);
+  if (input[closeParenIndex] !== ")") return false;
+  const continuationIndex = skipSpaces(input, closeParenIndex + 1);
+  return input[continuationIndex] === "." || input[continuationIndex] === "[" || input.startsWith("?.", continuationIndex);
+}
+__name(hasGroupedContinuation, "hasGroupedContinuation");
+function readIdentifier(input, index) {
+  if (!isIdentifierStart(input[index])) return null;
+  let next = index + 1;
+  while (isIdentifierPart(input[next])) next += 1;
+  return { value: input.slice(index, next), next };
+}
+__name(readIdentifier, "readIdentifier");
+function readNumber(input, index) {
+  const match = input.slice(index).match(/^\d+/);
+  return match ? { value: match[0], next: index + match[0].length } : null;
+}
+__name(readNumber, "readNumber");
+function readQuotedProperty(input, index) {
+  const quote = input[index];
+  if (quote !== '"' && quote !== "'") return null;
+  let next = index + 1;
+  let value = "";
+  while (next < input.length) {
+    const char = input[next];
+    if (char === "\\") {
+      value += input.slice(next, next + 2);
+      next += 2;
+      continue;
+    }
+    if (char === quote) {
+      return { value, next: next + 1 };
+    }
+    value += char;
+    next += 1;
+  }
+  return null;
+}
+__name(readQuotedProperty, "readQuotedProperty");
+function readBracketAccess(input, index) {
+  let next = skipSpaces(input, index + 1);
+  const quoted = readQuotedProperty(input, next);
+  if (quoted) {
+    next = skipSpaces(input, quoted.next);
+    if (input[next] !== "]") return { dynamic: true };
+    return { dynamic: false, kind: "property", next: next + 1, value: quoted.value };
+  }
+  const number = readNumber(input, next);
+  if (number) {
+    next = skipSpaces(input, number.next);
+    if (input[next] !== "]") return { dynamic: true };
+    return { dynamic: false, kind: "index", next: next + 1, value: number.value };
+  }
+  return { dynamic: true };
+}
+__name(readBracketAccess, "readBracketAccess");
+function appendPathSegment(segments, kind, value) {
+  if (kind === "property") {
+    segments.push(value);
+    return;
+  }
+  if (segments.length) {
+    segments[segments.length - 1] = `${segments[segments.length - 1]}[${value}]`;
+    return;
+  }
+  segments.push(`[${value}]`);
+}
+__name(appendPathSegment, "appendPathSegment");
+function readAccess(input, index) {
+  const next = skipPostfix(input, index);
+  if (input[next] === "[") {
+    return readBracketAccess(input, next);
+  }
+  if (input.startsWith("?.", next)) {
+    const propertyStart = skipSpaces(input, next + 2);
+    if (input[propertyStart] === "[") {
+      return readBracketAccess(input, propertyStart);
+    }
+    const identifier = readIdentifier(input, propertyStart) || readNumber(input, propertyStart);
+    return identifier ? { dynamic: false, kind: "property", next: identifier.next, value: identifier.value } : null;
+  }
+  if (input[next] === ".") {
+    const propertyStart = skipSpaces(input, next + 1);
+    const identifier = readIdentifier(input, propertyStart) || readNumber(input, propertyStart);
+    return identifier ? { dynamic: false, kind: "property", next: identifier.next, value: identifier.value } : null;
+  }
+  return null;
+}
+__name(readAccess, "readAccess");
+function parseDotOnlyCtxReference(expr) {
+  const trimmed = expr.trim();
+  const segment = "(?:[a-zA-Z_$][a-zA-Z0-9_$-]*|\\d+)";
+  const match = trimmed.match(new RegExp(`^ctx\\.([a-zA-Z_$][a-zA-Z0-9_$]*)(?:\\.(${segment}(?:\\.${segment})*))?$`));
+  if (!match) return null;
+  return {
+    methodCall: false,
+    path: match[2] || void 0,
+    unsupportedDynamicPath: false,
+    varName: match[1]
+  };
+}
+__name(parseDotOnlyCtxReference, "parseDotOnlyCtxReference");
+function parseCtxReference(input, start) {
+  if (input.slice(start, start + 3) !== "ctx") return null;
+  if (isIdentifierPart(input[start - 1]) || isIdentifierPart(input[start + 3])) return null;
+  if (isGroupedCtxReference(input, start)) {
+    return {
+      next: start + 3,
+      reference: {
+        methodCall: false,
+        unsupportedDynamicPath: true,
+        varName: ""
       }
-    } else if (Array.isArray(src)) {
-      src.forEach(visit);
-    } else if (src && typeof src === "object") {
-      Object.values(src).forEach(visit);
+    };
+  }
+  const rootAccess = readAccess(input, start + 3);
+  if (!rootAccess) return null;
+  if (rootAccess.dynamic) {
+    return {
+      next: start + 3,
+      reference: {
+        methodCall: false,
+        unsupportedDynamicPath: true,
+        varName: ""
+      }
+    };
+  }
+  if (rootAccess.kind !== "property") {
+    return null;
+  }
+  const segments = [];
+  let next = rootAccess.next;
+  let methodCall = false;
+  let unsupportedDynamicPath = false;
+  while (next < input.length) {
+    const accessStart = skipPostfix(input, next);
+    if ((input[accessStart] === "(" || input.startsWith("?.(", accessStart)) && !segments.length) {
+      methodCall = true;
+      next = accessStart;
+      break;
     }
-  }, "visit");
-  visit(template);
-  return result;
+    const access = readAccess(input, next);
+    if (!access) {
+      next = accessStart;
+      if (input[accessStart] === "[" || input[accessStart] === "." || input.startsWith("?.", accessStart)) {
+        unsupportedDynamicPath = true;
+      }
+      break;
+    }
+    if (access.dynamic) {
+      unsupportedDynamicPath = true;
+      next = accessStart;
+      break;
+    }
+    appendPathSegment(segments, access.kind, access.value);
+    next = access.next;
+  }
+  const path = segments.join(".");
+  return {
+    next: Math.max(next, rootAccess.next),
+    reference: {
+      methodCall,
+      path: path || void 0,
+      unsupportedDynamicPath: unsupportedDynamicPath || hasGroupedContinuation(input, next),
+      varName: rootAccess.value
+    }
+  };
 }
-__name(extractUsedVariableNames, "extractUsedVariableNames");
-function extractUsedVariablePaths(template) {
+__name(parseCtxReference, "parseCtxReference");
+function collectCtxReferences(expr) {
+  const dotOnly = parseDotOnlyCtxReference(expr);
+  if (dotOnly) return [dotOnly];
+  const references = [];
+  for (let index = 0; index < expr.length; index += 1) {
+    if (expr.slice(index, index + 3) !== "ctx") continue;
+    const parsed = parseCtxReference(expr, index);
+    if (!parsed) continue;
+    references.push(parsed.reference);
+    index = Math.max(index, parsed.next - 1);
+  }
+  return references;
+}
+__name(collectCtxReferences, "collectCtxReferences");
+function addUsagePath(usage, varName, path, methodCall) {
+  usage[varName] = usage[varName] || [];
+  if (path) {
+    usage[varName].push(path);
+  } else if (methodCall && !usage[varName].includes("")) {
+    usage[varName].push("");
+  }
+}
+__name(addUsagePath, "addUsagePath");
+function extractVariableUsage(template) {
   const usage = {};
+  let unsupportedDynamicPath = false;
+  const visitExpression = /* @__PURE__ */ __name((expr) => {
+    for (const reference of collectCtxReferences(expr)) {
+      if (reference.unsupportedDynamicPath) {
+        unsupportedDynamicPath = true;
+        continue;
+      }
+      if (!reference.varName) continue;
+      addUsagePath(usage, reference.varName, reference.path, reference.methodCall);
+    }
+  }, "visitExpression");
   const visit = /* @__PURE__ */ __name((src) => {
     if (typeof src === "string") {
       const regex = /\{\{\s*([^}]+?)\s*\}\}/g;
-      let m;
-      while ((m = regex.exec(src)) !== null) {
-        const expr = m[1];
-        const pathRegex = /ctx\.([a-zA-Z_$][a-zA-Z0-9_$]*)([^\s)]*)/g;
-        let pm;
-        while ((pm = pathRegex.exec(expr)) !== null) {
-          const varName = pm[1];
-          const after = pm[2] || "";
-          usage[varName] = usage[varName] || [];
-          if (after.startsWith(".")) {
-            usage[varName].push(after.slice(1));
-          } else if (after.startsWith("[")) {
-            const mm = after.match(/^\[\s*(["'])\s*([^'"\]]+)\s*\1\s*\](.*)$/);
-            if (mm) {
-              const first = mm[2];
-              const rest = mm[3] || "";
-              usage[varName].push(`${first}${rest}`);
-            } else {
-              const mn = after.match(/^\[(\d+)\](.*)$/);
-              if (mn) {
-                const idx = mn[1];
-                const rest = mn[2] || "";
-                usage[varName].push(`[${idx}]${rest}`);
-              }
-            }
-          } else if (after.startsWith("(")) {
-            if (!usage[varName].length) usage[varName].push("");
-          }
-        }
-        const bracketVarRegex = /ctx\[\s*(["'])\s*([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\1\s*\]([^\s)]*)/g;
-        let bm;
-        while ((bm = bracketVarRegex.exec(expr)) !== null) {
-          const varName = bm[2];
-          const after = bm[3] || "";
-          usage[varName] = usage[varName] || [];
-          if (after.startsWith(".")) {
-            usage[varName].push(after.slice(1));
-          } else if (after.startsWith("[")) {
-            const mm = after.match(/^\[\s*(["'])\s*([^'"\]]+)\s*\1\s*\](.*)$/);
-            if (mm) {
-              const first = mm[2];
-              const rest = mm[3] || "";
-              usage[varName].push(`${first}${rest}`);
-            } else {
-              const mn = after.match(/^\[(\d+)\](.*)$/);
-              if (mn) {
-                const idx = mn[1];
-                const rest = mn[2] || "";
-                usage[varName].push(`[${idx}]${rest}`);
-              }
-            }
-          } else if (after.startsWith("(")) {
-            if (!usage[varName].length) usage[varName].push("");
-          }
-        }
+      let match;
+      while ((match = regex.exec(src)) !== null) {
+        visitExpression(match[1]);
       }
-    } else if (Array.isArray(src)) {
+      return;
+    }
+    if (Array.isArray(src)) {
       src.forEach(visit);
-    } else if (src && typeof src === "object") {
+      return;
+    }
+    if (isObject(src)) {
       Object.values(src).forEach(visit);
     }
   }, "visit");
   visit(template);
-  return usage;
+  return { unsupportedDynamicPath, usage };
+}
+__name(extractVariableUsage, "extractVariableUsage");
+function extractUsedVariableNames(template) {
+  return new Set(Object.keys(extractVariableUsage(template).usage));
+}
+__name(extractUsedVariableNames, "extractUsedVariableNames");
+function extractUsedVariablePaths(template) {
+  return extractVariableUsage(template).usage;
 }
 __name(extractUsedVariablePaths, "extractUsedVariablePaths");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   extractUsedVariableNames,
-  extractUsedVariablePaths
+  extractUsedVariablePaths,
+  extractVariableUsage
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/utils",
-  "version": "2.3.0-alpha.1",
+  "version": "2.3.0-beta.10",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -19,7 +19,8 @@
     "liquidjs": "^10.23.0",
     "multer": "^2.1.1",
     "object-path": "^0.11.8",
+    "sanitize-html": "2.17.5",
     "ses": "^1.14.0"
   },
-  "gitHead": "2377df8ceb12549149017f7f14a61207bf6e49a2"
+  "gitHead": "7aa3dce6cf3201752882f7012c72997898015d89"
 }