@skopon-cool/form-sdk 0.6.0 → 0.6.1

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Skopon form rendering SDK (A2UI + form_definition) with submit helpers",
   "type": "module",
   "sideEffects": [

package/src/client/authStorage.test.ts

@@ -1,14 +1,16 @@
 /**
  * @vitest-environment happy-dom
  */
-import { afterEach, describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import {
   DEFAULT_AUTH_ANSWER_AGENT_CALLBACK_URL_FIELD,
   DEFAULT_AUTH_REALTIME_WS_URL_FIELD,
+  DEFAULT_AUTH_SKOPON_API_BASE_URL_FIELD,
   DEFAULT_ANSWER_AGENT_CALLBACK_URL,
   DEFAULT_AUTH_STORAGE_KEY,
   resolveAnswerAgentCallbackUrl,
   resolveRealtimeWsUrl,
+  resolveSkoponApiBaseUrl,
   resolveSkoponAuthHeaders,
   resolveSubmitAuthHeaders,
 } from './authStorage'
@@ -17,6 +19,7 @@ describe('resolveSkoponAuthHeaders', () => {
   afterEach(() => {
     sessionStorage.clear()
     localStorage.clear()
+    vi.unstubAllGlobals()
   })
 
   it('reads Bearer token from sessionStorage auth_user by default', () => {
@@ -66,6 +69,69 @@ describe('resolveSkoponAuthHeaders', () => {
   })
 })
 
+describe('resolveSkoponApiBaseUrl', () => {
+  afterEach(() => {
+    if (typeof sessionStorage !== 'undefined') sessionStorage.clear()
+    if (typeof localStorage !== 'undefined') localStorage.clear()
+    vi.unstubAllGlobals()
+  })
+
+  it('reads and normalizes skopon_api_base_url from auth_user', () => {
+    sessionStorage.setItem(
+      DEFAULT_AUTH_STORAGE_KEY,
+      JSON.stringify({
+        [DEFAULT_AUTH_SKOPON_API_BASE_URL_FIELD]:
+          ' https://admin-test.hibot.lol/api/skopon/api/v1/ ',
+      }),
+    )
+    expect(resolveSkoponApiBaseUrl()).toBe(
+      'https://admin-test.hibot.lol/api/skopon/api/v1',
+    )
+  })
+
+  it('falls back to the current origin when session or field is missing', () => {
+    expect(resolveSkoponApiBaseUrl()).toBe(`${window.location.origin}/api/v1`)
+    sessionStorage.setItem(DEFAULT_AUTH_STORAGE_KEY, JSON.stringify({ token: 'tok' }))
+    expect(resolveSkoponApiBaseUrl()).toBe(`${window.location.origin}/api/v1`)
+  })
+
+  it('falls back to a relative API path outside the browser', () => {
+    vi.stubGlobal('window', undefined)
+    expect(resolveSkoponApiBaseUrl()).toBe('/api/v1')
+  })
+
+  it('falls back when browser storage is inaccessible', () => {
+    const origin = window.location.origin
+    vi.stubGlobal('window', {
+      location: { origin },
+      sessionStorage: {
+        getItem() {
+          throw new Error('blocked')
+        },
+      },
+    })
+    expect(resolveSkoponApiBaseUrl()).toBe(`${origin}/api/v1`)
+  })
+
+  it.each([
+    '/api/v1',
+    'ftp://example.com/api/v1',
+    'https://user:pass@example.com/api/v1',
+    'https://example.com/api/v1?tenant=1',
+    'https://example.com/api/v1#upload',
+  ])('rejects invalid configured base URL: %s', (configured) => {
+    sessionStorage.setItem(
+      DEFAULT_AUTH_STORAGE_KEY,
+      JSON.stringify({
+        [DEFAULT_AUTH_SKOPON_API_BASE_URL_FIELD]: configured,
+      }),
+    )
+    expect(() => resolveSkoponApiBaseUrl()).toThrow(
+      'skopon_api_base_url 格式无效，无法上传文件',
+    )
+  })
+})
+
 describe('resolveSubmitAuthHeaders', () => {
   afterEach(() => {
     sessionStorage.clear()

package/src/client/authStorage.ts

@@ -11,8 +11,10 @@ export const DEFAULT_AUTH_STORAGE_KEY = 'auth_user'
 export const DEFAULT_AUTH_TOKEN_FIELD = 'token'
 export const DEFAULT_AUTH_ANSWER_AGENT_CALLBACK_URL_FIELD = 'answer_agent_callback_url'
 export const DEFAULT_AUTH_REALTIME_WS_URL_FIELD = 'realtime_ws_url'
+export const DEFAULT_AUTH_SKOPON_API_BASE_URL_FIELD = 'skopon_api_base_url'
 /** 与 skopon-admin 登录写入的 mock answer-agent 路径一致 */
 export const DEFAULT_ANSWER_AGENT_CALLBACK_URL = '/api/v1/mock/ask_user_answer_mock'
+export const DEFAULT_SKOPON_API_BASE_PATH = '/api/v1'
 
 function readStorage(
   kind: 'sessionStorage' | 'localStorage',
@@ -35,6 +37,71 @@ function readSessionJson(raw: string): Record<string, unknown> | null {
   }
 }
 
+function defaultSkoponApiBaseUrl(): string {
+  if (typeof window === 'undefined') return DEFAULT_SKOPON_API_BASE_PATH
+  try {
+    const origin = window.location.origin
+    const parsed = new URL(origin)
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+      return DEFAULT_SKOPON_API_BASE_PATH
+    }
+    return `${parsed.origin}${DEFAULT_SKOPON_API_BASE_PATH}`
+  } catch {
+    return DEFAULT_SKOPON_API_BASE_PATH
+  }
+}
+
+/**
+ * 从宿主登录缓存读取 Skopon API 根地址。
+ * 缺失时回退当前 Origin 的 /api/v1；非空配置必须是无凭据、Query、Hash 的绝对 HTTP(S) URL。
+ */
+export function resolveSkoponApiBaseUrl(
+  options: SkoponAuthStorageOptions & {
+    skoponApiBaseUrlField?: string
+  } = {},
+): string {
+  const storageKind = options.storage ?? 'sessionStorage'
+  const storageKey = options.storageKey ?? DEFAULT_AUTH_STORAGE_KEY
+  const field =
+    options.skoponApiBaseUrlField ?? DEFAULT_AUTH_SKOPON_API_BASE_URL_FIELD
+
+  const storage = readStorage(storageKind)
+  let raw: string | null = null
+  try {
+    raw = storage?.getItem(storageKey) ?? null
+  } catch {
+    return defaultSkoponApiBaseUrl()
+  }
+  const parsedSession = raw ? readSessionJson(raw) : null
+  const configured = parsedSession?.[field]
+  if (configured === undefined || configured === null) {
+    return defaultSkoponApiBaseUrl()
+  }
+  if (typeof configured !== 'string') {
+    throw new Error('skopon_api_base_url 格式无效，无法上传文件')
+  }
+
+  const trimmed = configured.trim()
+  if (!trimmed) return defaultSkoponApiBaseUrl()
+
+  try {
+    const parsed = new URL(trimmed)
+    if (
+      (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') ||
+      parsed.username ||
+      parsed.password ||
+      parsed.search ||
+      parsed.hash
+    ) {
+      throw new Error('invalid Skopon API base URL')
+    }
+    const pathname = parsed.pathname.replace(/\/+$/, '')
+    return `${parsed.origin}${pathname}`
+  } catch {
+    throw new Error('skopon_api_base_url 格式无效，无法上传文件')
+  }
+}
+
 function readTokenFromSessionJson(
   raw: string,
   tokenField: string,

package/src/client/uploadClient.test.ts

@@ -23,7 +23,13 @@ describe('uploadFileToCdn', () => {
   })
 
   it('uploads multipart data to the fixed endpoint with session Bearer auth', async () => {
-    sessionStorage.setItem('auth_user', JSON.stringify({ token: 'token-1' }))
+    sessionStorage.setItem(
+      'auth_user',
+      JSON.stringify({
+        token: 'token-1',
+        skopon_api_base_url: 'https://admin-test.hibot.lol/api/skopon/api/v1/',
+      }),
+    )
     const fetchMock = vi.fn(async () =>
       response({
         success: true,
@@ -39,7 +45,9 @@ describe('uploadFileToCdn', () => {
     })
     expect(fetchMock).toHaveBeenCalledTimes(1)
     const [url, init] = fetchMock.mock.calls[0] as unknown as [string, RequestInit]
-    expect(url).toBe(CDN_UPLOAD_PATH)
+    expect(url).toBe(
+      `https://admin-test.hibot.lol/api/skopon/api/v1${CDN_UPLOAD_PATH}`,
+    )
     expect(init.method).toBe('POST')
     expect(init.headers).toEqual({ Authorization: 'Bearer token-1' })
     expect((init.headers as Record<string, string>)['Content-Type']).toBeUndefined()
@@ -48,6 +56,37 @@ describe('uploadFileToCdn', () => {
     expect((init.body as FormData).get('purpose')).toBeNull()
   })
 
+  it('falls back to the current origin API base when session config is missing', async () => {
+    const fetchMock = vi.fn(async () =>
+      response({ success: true, data: { url: 'https://cdn.example.com/a.txt' } }),
+    )
+    vi.stubGlobal('fetch', fetchMock)
+
+    await uploadFileToCdn(new File(['x'], 'x.txt'))
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      `${window.location.origin}/api/v1${CDN_UPLOAD_PATH}`,
+      expect.objectContaining({ method: 'POST' }),
+    )
+  })
+
+  it('rejects an invalid configured base URL without sending a request', async () => {
+    sessionStorage.setItem(
+      'auth_user',
+      JSON.stringify({
+        token: 'token-1',
+        skopon_api_base_url: '/api/v1',
+      }),
+    )
+    const fetchMock = vi.fn()
+    vi.stubGlobal('fetch', fetchMock)
+
+    await expect(uploadFileToCdn(new File(['x'], 'x.txt'))).rejects.toThrow(
+      'skopon_api_base_url 格式无效，无法上传文件',
+    )
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
   it.each([
     [{ success: false, message: '七牛上传失败', data: {} }, '七牛上传失败'],
     [{ success: true, data: { url: '   ' } }, '响应缺少文件地址'],

package/src/client/uploadClient.ts

@@ -1,7 +1,10 @@
 import { parseEnvelope } from './apiEnvelope'
-import { resolveSkoponAuthHeaders } from './authStorage'
+import {
+  resolveSkoponApiBaseUrl,
+  resolveSkoponAuthHeaders,
+} from './authStorage'
 
-export const CDN_UPLOAD_PATH = '/api/v1/dev/upload/cdn'
+export const CDN_UPLOAD_PATH = '/univ/upload/cdn'
 export const CDN_UPLOAD_TIMEOUT_MS = 120_000
 
 export interface CdnUploadResult {
@@ -27,6 +30,7 @@ export async function uploadFileToCdn(
   file: File,
   options: { signal?: AbortSignal } = {},
 ): Promise<CdnUploadResult> {
+  const uploadUrl = `${resolveSkoponApiBaseUrl()}${CDN_UPLOAD_PATH}`
   const controller = new AbortController()
   let timedOut = false
 
@@ -45,7 +49,7 @@ export async function uploadFileToCdn(
   try {
     const formData = new FormData()
     formData.append('file', file)
-    const response = await fetch(CDN_UPLOAD_PATH, {
+    const response = await fetch(uploadUrl, {
       method: 'POST',
       headers: resolveSkoponAuthHeaders(),
       body: formData,

package/src/index.ts

@@ -106,6 +106,7 @@ export {
 export {
   resolveAnswerAgentCallbackUrl,
   resolveRealtimeWsUrl,
+  resolveSkoponApiBaseUrl,
   resolveSkoponAuthHeaders,
   resolveSubmitAuthHeaders,
   resolveClientHeaders,
@@ -113,7 +114,9 @@ export {
   DEFAULT_AUTH_TOKEN_FIELD,
   DEFAULT_AUTH_ANSWER_AGENT_CALLBACK_URL_FIELD,
   DEFAULT_AUTH_REALTIME_WS_URL_FIELD,
+  DEFAULT_AUTH_SKOPON_API_BASE_URL_FIELD,
   DEFAULT_ANSWER_AGENT_CALLBACK_URL,
+  DEFAULT_SKOPON_API_BASE_PATH,
   type SkoponAuthStorageOptions,
   type ClientHeadersOptions,
 } from './client/authStorage'