@steedos-labs/content-compliance 0.8.25 → 0.8.27

package/lib/pages/__tests__/roomsCredentialResign.test.js

@@ -0,0 +1,286 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+var tslib_1 = require("tslib");
+var fs = require("node:fs");
+var path = require("node:path");
+var vm = require("node:vm");
+var clientScript = fs.readFileSync(path.resolve(__dirname, '../../../main/default/client/pepsico_content.client.js'), 'utf8');
+var ORIGIN = 'https://example.test';
+var SPACE_ID = 'space-1';
+var SESSION_TOKEN = 'session-token';
+var RESIGNED = "Bearer ".concat(SPACE_ID, ",").concat(SESSION_TOKEN);
+var EXPIRED_ROOMS_JWT = 'Bearer expired-rooms-jwt';
+var createStorage = function (values) { return ({
+    getItem: function (key) { return (key in values ? values[key] : null); },
+    setItem: function (key, value) {
+        values[key] = value;
+    },
+    removeItem: function (key) {
+        delete values[key];
+    }
+}); };
+var loadClientScript = function (stored) {
+    if (stored === void 0) { stored = {}; }
+    var fetchCalls = [];
+    var consoleCalls = [];
+    var record = function (level) { return function (message) {
+        consoleCalls.push({ level: level, message: message });
+    }; };
+    var consoleStub = { debug: record('debug'), warn: record('warn') };
+    var localStorage = createStorage(tslib_1.__assign({}, stored));
+    var window = {
+        __meteor_runtime_config__: {},
+        drawerWidth: '',
+        fetch: function (input, init) {
+            fetchCalls.push({ input: input, init: init });
+            return Promise.resolve({ status: 200 });
+        },
+        localStorage: localStorage,
+        location: { origin: ORIGIN }
+    };
+    window.window = window;
+    vm.runInNewContext(clientScript, {
+        Date: Date,
+        Headers: Headers,
+        Object: Object,
+        Request: Request,
+        URL: URL,
+        console: consoleStub,
+        document: { title: '' },
+        loadCss: function () { return undefined; },
+        localStorage: localStorage,
+        Steedos: { absoluteUrl: function (url) { return url; } },
+        window: window
+    });
+    return { window: window, fetchCalls: fetchCalls, consoleCalls: consoleCalls };
+};
+var authorizationOf = function (call) {
+    var headers = call.init && call.init.headers;
+    if (!headers)
+        return null;
+    return typeof headers.get === 'function'
+        ? headers.get('Authorization')
+        : headers.Authorization;
+};
+var platformSession = { 'steedos:spaceId': SPACE_ID, 'steedos:token': SESSION_TOKEN };
+describe('rooms 凭证改签 (#445)', function () {
+    it('从平台实际写入的 key 读取会话凭证', function () { return tslib_1.__awaiter(void 0, void 0, void 0, function () {
+        var _a, window, fetchCalls;
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = loadClientScript(platformSession), window = _a.window, fetchCalls = _a.fetchCalls;
+                    return [4, window.fetch('/v2/c/users?userIds=u1', {
+                            headers: { Authorization: EXPIRED_ROOMS_JWT }
+                        })];
+                case 1:
+                    _b.sent();
+                    expect(authorizationOf(fetchCalls[0])).toBe(RESIGNED);
+                    return [2];
+            }
+        });
+    }); });
+    it('回落到历史 key', function () { return tslib_1.__awaiter(void 0, void 0, void 0, function () {
+        var _a, window, fetchCalls;
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = loadClientScript({
+                        'steedos:spaceId': SPACE_ID,
+                        'steedos:authToken': SESSION_TOKEN
+                    }), window = _a.window, fetchCalls = _a.fetchCalls;
+                    return [4, window.fetch('/v2/c/users?userIds=u1', {
+                            headers: { Authorization: EXPIRED_ROOMS_JWT }
+                        })];
+                case 1:
+                    _b.sent();
+                    expect(authorizationOf(fetchCalls[0])).toBe(RESIGNED);
+                    return [2];
+            }
+        });
+    }); });
+    it('改签 @ 提及搜索(绝对地址同源)', function () { return tslib_1.__awaiter(void 0, void 0, void 0, function () {
+        var _a, window, fetchCalls;
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = loadClientScript(platformSession), window = _a.window, fetchCalls = _a.fetchCalls;
+                    return [4, window.fetch("".concat(ORIGIN, "/v2/c/users/search?keyword=li"), {
+                            headers: { Authorization: EXPIRED_ROOMS_JWT }
+                        })];
+                case 1:
+                    _b.sent();
+                    expect(authorizationOf(fetchCalls[0])).toBe(RESIGNED);
+                    return [2];
+            }
+        });
+    }); });
+    it('改签 POST 发评论 —— 原实现只拦 GET,发评论会静默丢失', function () { return tslib_1.__awaiter(void 0, void 0, void 0, function () {
+        var _a, window, fetchCalls;
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = loadClientScript(platformSession), window = _a.window, fetchCalls = _a.fetchCalls;
+                    return [4, window.fetch('/v2/c/rooms/objects:pepsico_material:r1/threads', {
+                            method: 'POST',
+                            headers: { Authorization: EXPIRED_ROOMS_JWT }
+                        })];
+                case 1:
+                    _b.sent();
+                    expect(authorizationOf(fetchCalls[0])).toBe(RESIGNED);
+                    return [2];
+            }
+        });
+    }); });
+    it('改签 threads 子路径 —— 原实现用精确路径匹配,该路径匹配不上', function () { return tslib_1.__awaiter(void 0, void 0, void 0, function () {
+        var _a, window, fetchCalls;
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = loadClientScript(platformSession), window = _a.window, fetchCalls = _a.fetchCalls;
+                    return [4, window.fetch('/v2/c/rooms/objects:pepsico_material:r1/threads', {
+                            headers: { Authorization: EXPIRED_ROOMS_JWT }
+                        })];
+                case 1:
+                    _b.sent();
+                    expect(authorizationOf(fetchCalls[0])).toBe(RESIGNED);
+                    return [2];
+            }
+        });
+    }); });
+    it('不动 /v2/c/auth —— 它本身就是拿会话凭证换票的接口', function () { return tslib_1.__awaiter(void 0, void 0, void 0, function () {
+        var _a, window, fetchCalls;
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = loadClientScript(platformSession), window = _a.window, fetchCalls = _a.fetchCalls;
+                    return [4, window.fetch('/v2/c/auth', { method: 'POST' })];
+                case 1:
+                    _b.sent();
+                    expect(authorizationOf(fetchCalls[0])).toBeFalsy();
+                    return [2];
+            }
+        });
+    }); });
+    it('不动非 /v2/c/ 的同源请求', function () { return tslib_1.__awaiter(void 0, void 0, void 0, function () {
+        var _a, window, fetchCalls;
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = loadClientScript(platformSession), window = _a.window, fetchCalls = _a.fetchCalls;
+                    return [4, window.fetch('/api/v1/pepsico_material', {
+                            headers: { Authorization: 'Bearer other' }
+                        })];
+                case 1:
+                    _b.sent();
+                    expect(authorizationOf(fetchCalls[0])).toBe('Bearer other');
+                    return [2];
+            }
+        });
+    }); });
+    it('不动跨域请求,避免把会话凭证泄漏到外部域', function () { return tslib_1.__awaiter(void 0, void 0, void 0, function () {
+        var _a, window, fetchCalls;
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = loadClientScript(platformSession), window = _a.window, fetchCalls = _a.fetchCalls;
+                    return [4, window.fetch('https://elsewhere.test/v2/c/users?userIds=u1', {
+                            headers: { Authorization: EXPIRED_ROOMS_JWT }
+                        })];
+                case 1:
+                    _b.sent();
+                    expect(authorizationOf(fetchCalls[0])).toBe(EXPIRED_ROOMS_JWT);
+                    return [2];
+            }
+        });
+    }); });
+    it('无 localStorage 凭证时删掉过期 JWT,让 cookie 会话接管', function () { return tslib_1.__awaiter(void 0, void 0, void 0, function () {
+        var _a, window, fetchCalls;
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = loadClientScript({}), window = _a.window, fetchCalls = _a.fetchCalls;
+                    return [4, window.fetch('/v2/c/users?userIds=u1', {
+                            headers: { Authorization: EXPIRED_ROOMS_JWT }
+                        })];
+                case 1:
+                    _b.sent();
+                    expect(authorizationOf(fetchCalls[0])).toBeNull();
+                    return [2];
+            }
+        });
+    }); });
+    it('无凭证且请求本就没有 Authorization 头时,不额外包装请求', function () { return tslib_1.__awaiter(void 0, void 0, void 0, function () {
+        var _a, window, fetchCalls;
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = loadClientScript({}), window = _a.window, fetchCalls = _a.fetchCalls;
+                    return [4, window.fetch('/v2/c/users?userIds=u1')];
+                case 1:
+                    _b.sent();
+                    expect(fetchCalls[0].init).toBeUndefined();
+                    return [2];
+            }
+        });
+    }); });
+});
+describe('rooms 凭证改签的可观测性', function () {
+    it('装上拦截时打一条安装日志', function () {
+        var consoleCalls = loadClientScript(platformSession).consoleCalls;
+        expect(consoleCalls.map(function (call) { return call.message; })).toContain('[pepsico][rooms-auth-fix] 已安装 /v2/c/ 请求改签拦截');
+    });
+    it('改签命中时打一条日志,且重复请求不刷屏', function () { return tslib_1.__awaiter(void 0, void 0, void 0, function () {
+        var _a, window, consoleCalls, resigned;
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = loadClientScript(platformSession), window = _a.window, consoleCalls = _a.consoleCalls;
+                    return [4, window.fetch('/v2/c/users?userIds=u1')];
+                case 1:
+                    _b.sent();
+                    return [4, window.fetch('/v2/c/users?userIds=u2')];
+                case 2:
+                    _b.sent();
+                    resigned = consoleCalls.filter(function (call) {
+                        return call.message.indexOf('已用 Steedos 会话凭证改签') !== -1;
+                    });
+                    expect(resigned).toHaveLength(1);
+                    return [2];
+            }
+        });
+    }); });
+    it('回落到 cookie 会话时告警,便于发现 localStorage 无凭证的部署', function () { return tslib_1.__awaiter(void 0, void 0, void 0, function () {
+        var _a, window, consoleCalls, warnings;
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = loadClientScript({}), window = _a.window, consoleCalls = _a.consoleCalls;
+                    return [4, window.fetch('/v2/c/users?userIds=u1', {
+                            headers: { Authorization: EXPIRED_ROOMS_JWT }
+                        })];
+                case 1:
+                    _b.sent();
+                    warnings = consoleCalls.filter(function (call) { return call.level === 'warn'; });
+                    expect(warnings).toHaveLength(1);
+                    expect(warnings[0].message).toContain('已删除过期的 rooms JWT');
+                    return [2];
+            }
+        });
+    }); });
+    it('未命中 /v2/c/ 的请求不产生改签日志 —— 无该日志即代表拦截一次都没生效', function () { return tslib_1.__awaiter(void 0, void 0, void 0, function () {
+        var _a, window, consoleCalls;
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = loadClientScript(platformSession), window = _a.window, consoleCalls = _a.consoleCalls;
+                    return [4, window.fetch('/api/v1/other')];
+                case 1:
+                    _b.sent();
+                    expect(consoleCalls.some(function (call) { return call.message.indexOf('已用 Steedos 会话凭证改签') !== -1; })).toBe(false);
+                    return [2];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=roomsCredentialResign.test.js.map

package/lib/pages/__tests__/roomsCredentialResign.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roomsCredentialResign.test.js","sourceRoot":"","sources":["../../../src/pages/__tests__/roomsCredentialResign.test.ts"],"names":[],"mappings":";;;AAAA,4BAA8B;AAC9B,gCAAkC;AAClC,4BAA8B;AAE9B,IAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAChC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,wDAAwD,CAAC,EACjF,MAAM,CACT,CAAC;AAEF,IAAM,MAAM,GAAG,sBAAsB,CAAC;AACtC,IAAM,QAAQ,GAAG,SAAS,CAAC;AAC3B,IAAM,aAAa,GAAG,eAAe,CAAC;AACtC,IAAM,QAAQ,GAAG,iBAAU,QAAQ,cAAI,aAAa,CAAE,CAAC;AACvD,IAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAYrD,IAAM,aAAa,GAAG,UAAC,MAA8B,IAAK,OAAA,CAAC;IACvD,OAAO,EAAE,UAAC,GAAW,IAAK,OAAA,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAApC,CAAoC;IAC9D,OAAO,EAAE,UAAC,GAAW,EAAE,KAAa;QAChC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,UAAU,EAAE,UAAC,GAAW;QACpB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;CACJ,CAAC,EARwD,CAQxD,CAAC;AAEH,IAAM,gBAAgB,GAAG,UAAC,MAAmC;IAAnC,uBAAA,EAAA,WAAmC;IACzD,IAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,IAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,IAAM,MAAM,GAAG,UAAC,KAAa,IAAK,OAAA,UAAC,OAAe;QAC9C,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,OAAO,SAAA,EAAE,CAAC,CAAC;IAC1C,CAAC,EAFiC,CAEjC,CAAC;IACF,IAAM,WAAW,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAGrE,IAAM,YAAY,GAAG,aAAa,sBAAM,MAAM,EAAG,CAAC;IAClD,IAAM,MAAM,GAAQ;QAChB,yBAAyB,EAAE,EAAE;QAC7B,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,UAAC,KAAU,EAAE,IAAS;YACzB,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,CAAC,CAAC;YACjC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,YAAY,cAAA;QACZ,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;KAC/B,CAAC;IACF,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEvB,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE;QAC7B,IAAI,MAAA;QACJ,OAAO,SAAA;QACP,MAAM,QAAA;QACN,OAAO,SAAA;QACP,GAAG,KAAA;QACH,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,OAAO,EAAE,cAAM,OAAA,SAAS,EAAT,CAAS;QACxB,YAAY,cAAA;QACZ,OAAO,EAAE,EAAE,WAAW,EAAE,UAAC,GAAW,IAAK,OAAA,GAAG,EAAH,CAAG,EAAE;QAC9C,MAAM,QAAA;KACT,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,QAAA,EAAE,UAAU,YAAA,EAAE,YAAY,cAAA,EAAE,CAAC;AAChD,CAAC,CAAC;AAEF,IAAM,eAAe,GAAG,UAAC,IAAe;IACpC,IAAM,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU;QACpC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC9B,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;AAChC,CAAC,CAAC;AAEF,IAAM,eAAe,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC;AAExF,QAAQ,CAAC,mBAAmB,EAAE;IAC1B,EAAE,CAAC,qBAAqB,EAAE;;;;;oBAGhB,KAAyB,gBAAgB,CAAC,eAAe,CAAC,EAAxD,MAAM,YAAA,EAAE,UAAU,gBAAA,CAAuC;oBAEjE,WAAM,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;4BACzC,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAiB,EAAE;yBAChD,CAAC,EAAA;;oBAFF,SAEE,CAAC;oBAEH,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;;;SACzD,CAAC,CAAC;IAEH,EAAE,CAAC,WAAW,EAAE;;;;;oBACN,KAAyB,gBAAgB,CAAC;wBAC5C,iBAAiB,EAAE,QAAQ;wBAC3B,mBAAmB,EAAE,aAAa;qBACrC,CAAC,EAHM,MAAM,YAAA,EAAE,UAAU,gBAAA,CAGvB;oBAEH,WAAM,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;4BACzC,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAiB,EAAE;yBAChD,CAAC,EAAA;;oBAFF,SAEE,CAAC;oBAEH,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;;;SACzD,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE;;;;;oBACd,KAAyB,gBAAgB,CAAC,eAAe,CAAC,EAAxD,MAAM,YAAA,EAAE,UAAU,gBAAA,CAAuC;oBAEjE,WAAM,MAAM,CAAC,KAAK,CAAC,UAAG,MAAM,kCAA+B,EAAE;4BACzD,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAiB,EAAE;yBAChD,CAAC,EAAA;;oBAFF,SAEE,CAAC;oBAEH,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;;;SACzD,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE;;;;;oBAC9B,KAAyB,gBAAgB,CAAC,eAAe,CAAC,EAAxD,MAAM,YAAA,EAAE,UAAU,gBAAA,CAAuC;oBAEjE,WAAM,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE;4BAClE,MAAM,EAAE,MAAM;4BACd,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAiB,EAAE;yBAChD,CAAC,EAAA;;oBAHF,SAGE,CAAC;oBAEH,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;;;SACzD,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE;;;;;oBACjC,KAAyB,gBAAgB,CAAC,eAAe,CAAC,EAAxD,MAAM,YAAA,EAAE,UAAU,gBAAA,CAAuC;oBAEjE,WAAM,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE;4BAClE,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAiB,EAAE;yBAChD,CAAC,EAAA;;oBAFF,SAEE,CAAC;oBAEH,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;;;SACzD,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE;;;;;oBAC7B,KAAyB,gBAAgB,CAAC,eAAe,CAAC,EAAxD,MAAM,YAAA,EAAE,UAAU,gBAAA,CAAuC;oBAEjE,WAAM,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAA;;oBAApD,SAAoD,CAAC;oBAErD,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;;;;SACtD,CAAC,CAAC;IAEH,EAAE,CAAC,kBAAkB,EAAE;;;;;oBACb,KAAyB,gBAAgB,CAAC,eAAe,CAAC,EAAxD,MAAM,YAAA,EAAE,UAAU,gBAAA,CAAuC;oBAEjE,WAAM,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE;4BAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE;yBAC7C,CAAC,EAAA;;oBAFF,SAEE,CAAC;oBAEH,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;;;;SAC/D,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE;;;;;oBACjB,KAAyB,gBAAgB,CAAC,eAAe,CAAC,EAAxD,MAAM,YAAA,EAAE,UAAU,gBAAA,CAAuC;oBAEjE,WAAM,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;4BAC/D,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAiB,EAAE;yBAChD,CAAC,EAAA;;oBAFF,SAEE,CAAC;oBAEH,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;;;;SAClE,CAAC,CAAC;IAIH,EAAE,CAAC,0CAA0C,EAAE;;;;;oBACrC,KAAyB,gBAAgB,CAAC,EAAE,CAAC,EAA3C,MAAM,YAAA,EAAE,UAAU,gBAAA,CAA0B;oBAEpD,WAAM,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;4BACzC,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAiB,EAAE;yBAChD,CAAC,EAAA;;oBAFF,SAEE,CAAC;oBAEH,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;;;;SACrD,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE;;;;;oBAChC,KAAyB,gBAAgB,CAAC,EAAE,CAAC,EAA3C,MAAM,YAAA,EAAE,UAAU,gBAAA,CAA0B;oBAEpD,WAAM,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAA;;oBAA5C,SAA4C,CAAC;oBAE7C,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC9C,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAIH,QAAQ,CAAC,iBAAiB,EAAE;IACxB,EAAE,CAAC,cAAc,EAAE;QACP,IAAA,YAAY,GAAK,gBAAgB,CAAC,eAAe,CAAC,aAAtC,CAAuC;QAE3D,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,UAAC,IAAI,IAAK,OAAA,IAAI,CAAC,OAAO,EAAZ,CAAY,CAAC,CAAC,CAAC,SAAS,CACtD,6CAA6C,CAChD,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE;;;;;oBAChB,KAA2B,gBAAgB,CAAC,eAAe,CAAC,EAA1D,MAAM,YAAA,EAAE,YAAY,kBAAA,CAAuC;oBAEnE,WAAM,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAA;;oBAA5C,SAA4C,CAAC;oBAC7C,WAAM,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAA;;oBAA5C,SAA4C,CAAC;oBAEvC,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,UAAC,IAAI;wBACtC,OAAA,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;oBAAhD,CAAgD,CACnD,CAAC;oBACF,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SACpC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE;;;;;oBACtC,KAA2B,gBAAgB,CAAC,EAAE,CAAC,EAA7C,MAAM,YAAA,EAAE,YAAY,kBAAA,CAA0B;oBAEtD,WAAM,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;4BACzC,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAiB,EAAE;yBAChD,CAAC,EAAA;;oBAFF,SAEE,CAAC;oBAEG,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,UAAC,IAAI,IAAK,OAAA,IAAI,CAAC,KAAK,KAAK,MAAM,EAArB,CAAqB,CAAC,CAAC;oBACtE,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBACjC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;;;;SAC7D,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE;;;;;oBACrC,KAA2B,gBAAgB,CAAC,eAAe,CAAC,EAA1D,MAAM,YAAA,EAAE,YAAY,kBAAA,CAAuC;oBAEnE,WAAM,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAA;;oBAAnC,SAAmC,CAAC;oBAEpC,MAAM,CACF,YAAY,CAAC,IAAI,CAAC,UAAC,IAAI,IAAK,OAAA,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,EAAhD,CAAgD,CAAC,CAChF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;;;SACjB,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/main/default/client/pepsico_content.client.js

@@ -63,3 +63,124 @@ if(false){
         }, {});
     })
 }
+
+// issue #445 临时规避:@steedos-widgets/liveblocks 的 resolveUsers / resolveRoomsInfo /
+// resolveMentionSuggestions,以及发评论/读评论,全部复用缓存的 rooms JWT(仅 60 秒有效)。
+// 过期后 /v2/c/ 接口返回 401 —— 评论作者名显示为 Anonymous、@ 提及搜不到人(刷新才恢复),
+// 发评论则静默丢失。这里把全部同源 /v2/c/ 请求的 Authorization 改签为 Steedos 会话凭证,
+// 使其命中 RoomsGuard 的 AuthGuard 分支(不受 60 秒限制);/v2/c/auth 除外,它本身就是拿
+// 会话凭证换票的接口。平台包(@builder6/rooms / @steedos-widgets/liveblocks)修复后,
+// 本拦截可整体移除。
+//
+// 凭证的 localStorage key 要留意:平台(@steedos/webapp)写入的是 'steedos:token'。
+// 此处原先读的 'steedos:authToken' 平台从未写入,取到 null 后整段改签被静默跳过,
+// 等于这个兜底自上线起从未生效过。'steedos:authToken' 现仅作历史回落保留。
+//
+// 覆盖范围也一并放宽:原实现只拦 GET、且用精确路径匹配 ['/v2/c/users',
+// '/v2/c/users/search', '/v2/c/rooms'],因此 POST 发评论与 /v2/c/rooms/{roomId}/threads
+// 都不在范围内。现改为前缀匹配且不限方法。
+//
+// 会话不在 localStorage(例如只落 cookie)的部署里取不到凭证。此时改为删掉那个已过期的
+// Authorization 头:服务端 AuthGuard.extractTokenFromHeaderOrCookie 优先读头、头不存在
+// 才回落 cookie,过期 JWT 恰好把有效的 cookie 会话挡在外面,删掉反而能过。
+// 与饮料项目(steedos-project-pepsico-bev)的同一处规避保持行为一致。
+//
+// 这段规避坏掉时是**静默**的 —— 上一次就是读错 localStorage key,整段从未生效却没有
+// 任何迹象,一直拖到 UAT 抓包才发现。同类的静默失效还有:widget 抢先缓存了原始 fetch
+// 引用导致包装无效、平台升级后接口不再是 /v2/c/ 前缀。所以在安装与两个命中分支上各打
+// 一次日志(每页仅一次,不刷屏),按下面的阶梯即可在控制台自查:
+//   看不到 "已安装" 行             → client.js 没跑,或 window.fetch 不可包装
+//   有 "已安装"、无 "改签"/"删除"  → 拦截装上了但一次都没命中(前缀变了,或 widget 没走 window.fetch)
+//   有 "删除过期 JWT" 行           → localStorage 里没有会话凭证,正走 cookie 兜底
+(function () {
+    if (window.__pepsicoRoomsAuthFix || typeof window.fetch !== 'function') return;
+    window.__pepsicoRoomsAuthFix = true;
+
+    var PATCHED_PATH_PREFIX = '/v2/c/';
+    var EXCLUDED_PATHS = ['/v2/c/auth'];
+    var nativeFetch = window.fetch;
+    var logged = {};
+
+    function logOnce(key, level, message) {
+        if (logged[key]) return;
+        logged[key] = true;
+
+        try {
+            if (typeof console !== 'undefined' && typeof console[level] === 'function') {
+                console[level]('[pepsico][rooms-auth-fix] ' + message);
+            }
+        } catch (e) {}
+    }
+
+    function steedosAuthorization() {
+        try {
+            var spaceId = window.localStorage.getItem('steedos:spaceId');
+            var authToken = window.localStorage.getItem('steedos:token') ||
+                window.localStorage.getItem('steedos:authToken');
+
+            if (spaceId && authToken) {
+                return 'Bearer ' + spaceId + ',' + authToken;
+            }
+        } catch (e) {}
+
+        return null;
+    }
+
+    function isPatchedUrl(url) {
+        try {
+            var parsed = new URL(url, window.location.origin);
+
+            return parsed.origin === window.location.origin &&
+                parsed.pathname.indexOf(PATCHED_PATH_PREFIX) === 0 &&
+                EXCLUDED_PATHS.indexOf(parsed.pathname) === -1;
+        } catch (e) {
+            return false;
+        }
+    }
+
+    window.fetch = function (input, init) {
+        try {
+            var url;
+
+            if (typeof input === 'string') {
+                url = input;
+            } else if (input && typeof input.url === 'string') {
+                url = input.url;
+            } else if (input) {
+                url = String(input);
+            }
+
+            if (url && isPatchedUrl(url)) {
+                var authorization = steedosAuthorization();
+                var requestHeaders = init && init.headers;
+
+                if (!requestHeaders && typeof Request === 'function' && input instanceof Request) {
+                    requestHeaders = input.headers;
+                }
+
+                var headers = new Headers(requestHeaders || {});
+
+                if (authorization) {
+                    headers.set('Authorization', authorization);
+                    init = Object.assign({}, init, { headers: headers });
+                    logOnce('resigned', 'debug', '已用 Steedos 会话凭证改签 /v2/c/ 请求');
+                } else if (headers.has('Authorization')) {
+                    // 会话在 cookie 里:删掉过期的 rooms JWT,让 AuthGuard 回落到 cookie 会话
+                    headers.delete('Authorization');
+                    init = Object.assign({}, init, { headers: headers });
+                    logOnce(
+                        'cookie-fallback',
+                        'warn',
+                        'localStorage 无会话凭证,已删除过期的 rooms JWT 改由 cookie 会话认证'
+                    );
+                }
+            }
+        } catch (e) {
+            // 拦截逻辑自身出错时不影响原始请求
+        }
+
+        return nativeFetch.call(this, input, init);
+    };
+
+    logOnce('installed', 'debug', '已安装 /v2/c/ 请求改签拦截');
+})();

package/main/default/objects/pepesio_ch__c/fields/type.field.yml

@@ -17,6 +17,8 @@ options:
     value: mp4
   - label: png
     value: png
+  - label: gif
+    value: gif
 required: true
 sort_no: 150
 type: select

package/main/default/objects/pepsico_km_pls_file/fields/pls_file.field.yml

@@ -1,9 +1,24 @@
 name: pls_file
 amis:
   id: 'u:be441c91bd73'
+  # 覆盖平台默认的 file 只读渲染。平台默认取 ${pls_file|asArray} 的 value/name,
+  # 该值只有列表视图的响应适配器(getTableApi)会重写成对象数组; lookup 弹窗(picker)的
+  # 适配器没有这段重写, 字段值仍是裸文件 id 字符串, 导致 value 取空 ->
+  # 点击后打开 cfs_files_filerecord 记录抽屉时报"无法找到记录"。
+  # 这里统一改为从 _display 取值(列表、lookup 弹窗、记录详情三处都有 _display),
+  # 并去掉 url 上的 download 参数, 让 PDF 在新标签页内联预览而不是直接下载。
+  body:
+    type: each
+    source: '${_display.pls_file|asArray}'
+    className: flex flex-col
+    items:
+      type: tpl
+      tpl: >-
+        <% if(data && data.url){ %><a href="<%= data.url.split('?')[0] %>"
+        target="_blank"><%= data.name %></a><% } %>
 group: 上传信息
 is_wide: true
-label: PLS原始文件查看
+label: PLS文件
 readonly: true
 required: false
 sort_no: 150

package/main/default/objects/pepsico_km_pls_file/listviews/lookup.listview.yml

@@ -1,6 +1,8 @@
 name: lookup
 columns:
-  - field: name
+  - field: pls_file
+    width: '300'
+    wrap: true
   - field: product_name
   - field: brand
   - field: issue_date

package/main/default/objects/space_users/fields/agency_contract_expiry_date.field.yml

@@ -0,0 +1,9 @@
+name: agency_contract_expiry_date
+amis:
+  id: 'u:agency_contract_expiry_date'
+group: 系统信息
+label: Agency合同截止日期
+required: false
+sort_no: 1710
+type: date
+visible_on: '{{global.user.is_space_admin}}'

package/main/default/objects/space_users/fields/agency_pepsico_contact.field.yml

@@ -0,0 +1,14 @@
+name: agency_pepsico_contact
+amis:
+  id: 'u:agency_pepsico_contact'
+filters: []
+group: 系统信息
+is_wide: false
+label: Agency百事内部对接人
+multiple: false
+reference_to: space_users
+reference_to_field: user
+required: false
+sort_no: 1720
+type: lookup
+visible_on: '{{global.user.is_space_admin}}'