@svadmin/core 0.50.0 → 0.52.0

package/src/http.ts

@@ -1,85 +1,82 @@
 /**
- * HTTP fetch 工具 — 带 CSRF 防护、401 自动跳转和结构化错误语义。
+ * HTTP fetch utilities with CSRF protection, automatic 401 redirects, and structured error semantics.
  */
 
-import { HttpError, type ValidationErrors } from './types';
+import { HttpError,type ValidationErrors } from './types';
+import { Type } from '@sinclair/typebox';
+import { Value } from '@sinclair/typebox/value';
+import { definedOptions } from './defined-options';
 
 export interface FetchWithInterceptorOptions {
-  /** 401 时跳转的登录页路径 */
+  /** Login path used for 401 redirects. */
   loginPath?: string;
-  /** 403 且服务端未返回消息时使用的错误消息 */
+  /** Error message used when a 403 response has no server-provided message. */
   forbiddenMessage?: string;
-  /** 是否自动添加 X-Requested-With header (CSRF 防护) */
+  /** Whether to add the X-Requested-With header automatically for CSRF protection. */
   csrfProtection?: boolean;
-  /** 自定义 fetch 实现，便于测试或 SSR 环境注入 */
+  /** Custom fetch implementation for testing or SSR injection. */
   fetchImpl?: FetchWithInterceptor;
-  /** 自定义 401 重定向处理，便于测试或 SSR 环境注入 */
-  onUnauthorized?: (loginPath: string, returnTo: string) => void;
+  /** Custom 401 redirect handler for testing or SSR injection. */
+  onUnauthorized?: (loginPath: string,returnTo: string) => void;
 }
 
-export type FetchWithInterceptor = (url: string, init?: RequestInit) => Promise<Response>;
+export type FetchWithInterceptor=(url: string,init?: RequestInit) => Promise<Response>;
 
-const DEFAULT_OPTIONS: Required<Omit<FetchWithInterceptorOptions, 'fetchImpl' | 'onUnauthorized'>> & {
+const DEFAULT_OPTIONS: Required<Omit<FetchWithInterceptorOptions,'fetchImpl'|'onUnauthorized'>>&{
   fetchImpl: FetchWithInterceptor;
-  onUnauthorized: (loginPath: string, returnTo: string) => void;
-} = {
+  onUnauthorized: (loginPath: string,returnTo: string) => void;
+}={
   loginPath: '/auth/login',
   forbiddenMessage: 'Forbidden: 该操作已被安全策略拒绝',
   csrfProtection: true,
   get fetchImpl() {
-    if (typeof globalThis !== 'undefined' && typeof globalThis.fetch === 'function') {
-      return (url: string, init?: RequestInit) => globalThis.fetch(url, init);
+    if(typeof globalThis!=='undefined'&&typeof globalThis.fetch==='function') {
+      return (url: string,init?: RequestInit) => globalThis.fetch(url,init);
     }
     return async () => {
       throw new Error('No fetch implementation found. Pass fetchImpl in options.');
     };
   },
-  onUnauthorized: (loginPath, returnTo) => {
-    if (typeof window !== 'undefined') {
-      window.location.href = `${loginPath}?returnTo=${returnTo}`;
+  onUnauthorized: (loginPath,returnTo) => {
+    if(typeof window!=='undefined') {
+      window.location.href=`${loginPath}?returnTo=${returnTo}`;
     }
   },
 };
 
-function asRecord(value: unknown): Record<string, unknown> | null {
-  return typeof value === 'object' && value !== null
-    ? value as Record<string, unknown>
-    : null;
+function asRecord(value: unknown): Record<string,unknown>|null {
+  return Value.Check(Type.Record(Type.String(),Type.Unknown()),value)? value:null;
 }
 
-function asStructuredHttpError(error: unknown): HttpError | null {
-  const record = asRecord(error);
-  if (!record || typeof record.statusCode !== 'number') return null;
-  const message = typeof record.message === 'string' ? record.message : 'HTTP request failed';
-  const errors = asValidationErrors(record.errors);
-  return new HttpError(message, record.statusCode, errors, {
-    code: typeof record.code === 'string' ? record.code : undefined,
-    details: record.details,
-    body: record.body,
+function asStructuredHttpError(error: unknown): HttpError|null {
+  const record=asRecord(error);
+  const status=record?.['statusCode'];
+  if(!record||typeof status!=='number'||!Number.isInteger(status)||status<100||status>599) return null;
+  const message=typeof record['message']==='string'? record['message']:'HTTP request failed';
+  const errors=asValidationErrors(record['errors']);
+  return new HttpError(message,status,errors,definedOptions({
+    code: typeof record['code']==='string'? record['code']:undefined,
+    details: record['details'],
+    body: record['body'],
     cause: error,
-  });
+  }));
 }
 
-function firstString(...values: unknown[]): string | undefined {
-  return values.find((value): value is string => typeof value === 'string');
+function firstString(...values: unknown[]): string|undefined {
+  return values.find((value): value is string => typeof value==='string');
 }
 
-function asValidationErrors(value: unknown): ValidationErrors | undefined {
-  const record = asRecord(value);
-  if (!record) return undefined;
-
-  const valid = Object.values(record).every((entry) => (
-    typeof entry === 'string'
-    || (Array.isArray(entry) && entry.every((item) => typeof item === 'string'))
-  ));
-  return valid ? record as ValidationErrors : undefined;
+function asValidationErrors(value: unknown): ValidationErrors|undefined {
+  const schema=Type.Record(Type.String(),Type.Union([Type.String(),Type.Array(Type.String())]));
+  return Value.Check(schema,value)? value:undefined;
 }
 
 async function readErrorBody(response: Response): Promise<unknown> {
-  const text = await response.text();
-  if (!text) return undefined;
+  const text=await response.text();
+  if(!text) return undefined;
   try {
-    return JSON.parse(text) as unknown;
+    const parsed: unknown=JSON.parse(text);
+    return parsed;
   } catch {
     return text;
   }
@@ -89,81 +86,85 @@ async function createResponseError(
   response: Response,
   forbiddenMessage: string,
 ): Promise<HttpError> {
-  const body = await readErrorBody(response);
-  const record = asRecord(body);
-  const nestedError = asRecord(record?.error);
-  const code = response.headers.get('X-Svadmin-Auth-Retry') === 'exhausted'
+  const body=await readErrorBody(response);
+  const record=asRecord(body);
+  const nestedError=asRecord(record?.['error']);
+  const code=response.headers.get('X-Svadmin-Auth-Retry')==='exhausted'
     ? 'auth_retry_exhausted'
-    : firstString(
-      record?.code,
-      record?.error_code,
-      nestedError?.code,
-      nestedError?.error_code,
-      record?.error,
+    :firstString(
+      record?.['code'],
+      record?.['error_code'],
+      nestedError?.['code'],
+      nestedError?.['error_code'],
+      record?.['error'],
     );
-  const details = record?.details ?? nestedError?.details;
-  const message = firstString(
-    record?.message,
-    nestedError?.message,
-    record?.error_description,
-    nestedError?.error_description,
+  const details=record?.['details']??nestedError?.['details'];
+  const message=firstString(
+    record?.['message'],
+    nestedError?.['message'],
+    record?.['error_description'],
+    nestedError?.['error_description'],
     body,
-  ) ?? (response.status === 401 ? 'Unauthorized' : forbiddenMessage);
+  )??(response.status===401? 'Unauthorized':forbiddenMessage);
 
   return new HttpError(
     message,
     response.status,
-    asValidationErrors(record?.errors ?? nestedError?.errors),
-    { code, details, body },
+    asValidationErrors(record?.['errors']??nestedError?.['errors']),
+    definedOptions({
+      code,
+      details,
+      body,
+    }),
   );
 }
 
 /**
- * 带拦截器的 fetch。Core 只保留错误语义；认证刷新和请求重放由认证提供方处理。
+ * Fetch with interceptors. Core owns error semantics; the auth provider handles refresh and request replay.
  */
 export function createFetchWithInterceptor(
-  options: FetchWithInterceptorOptions = {},
+  options: FetchWithInterceptorOptions={},
 ): FetchWithInterceptor {
-  const opts = { ...DEFAULT_OPTIONS, ...options };
+  const opts={ ...DEFAULT_OPTIONS,...options };
 
-  return async (url: string, init: RequestInit = {}): Promise<Response> => {
-    const headers = new Headers(init.headers || {});
-    if (
+  return async (url: string,init: RequestInit={}): Promise<Response> => {
+    const headers=new Headers(init.headers||{});
+    if(
       opts.csrfProtection
-      && init.method
-      && ['POST', 'PUT', 'DELETE', 'PATCH'].includes(init.method.toUpperCase())
+      &&init.method
+      &&['POST','PUT','DELETE','PATCH'].includes(init.method.toUpperCase())
     ) {
-      headers.set('X-Requested-With', 'XMLHttpRequest');
+      headers.set('X-Requested-With','XMLHttpRequest');
     }
 
     let response: Response;
     try {
-      response = await opts.fetchImpl(url, { ...init, headers });
-    } catch (error) {
-      if (error instanceof HttpError) throw error;
-      const structuredError = asStructuredHttpError(error);
-      if (structuredError) throw structuredError;
+      response=await opts.fetchImpl(url,{ ...init,headers });
+    } catch(error) {
+      if(error instanceof HttpError) throw error;
+      const structuredError=asStructuredHttpError(error);
+      if(structuredError) throw structuredError;
       throw error;
     }
 
-    if (response.ok || (response.status !== 401 && response.status !== 403)) {
+    if(response.ok||(response.status!==401&&response.status!==403)) {
       return response;
     }
 
-    const httpError = await createResponseError(response, opts.forbiddenMessage);
-    if (response.status === 401) {
-      const returnTo = typeof window !== 'undefined'
+    const httpError=await createResponseError(response,opts.forbiddenMessage);
+    if(response.status===401) {
+      const returnTo=typeof window!=='undefined'
         ? encodeURIComponent(window.location.pathname)
-        : '';
+        :'';
       try {
-        opts.onUnauthorized(opts.loginPath, returnTo);
+        opts.onUnauthorized(opts.loginPath,returnTo);
       } catch {
-        // 重定向适配器失败不能覆盖服务端的结构化 401 错误。
+        // Redirect adapter failures must not replace the server's structured 401 error.
       }
     }
     throw httpError;
   };
 }
 
-/** 便捷全局实例 — 使用默认配置。 */
-export const fetchWithInterceptor = createFetchWithInterceptor();
+/** Convenient global instance using the default configuration. */
+export const fetchWithInterceptor=createFetchWithInterceptor();

package/src/i18n.svelte.ts

@@ -53,6 +53,31 @@ const baseLocales: Record<string, Record<string, string>> = {
     'common.page': '{current} / {total}',
     'common.export': '导出',
     'common.import': '导入',
+    'common.chooseFile': '选择文件',
+    'common.noFileChosen': '未选择文件',
+    'common.filesSelected': '已选择 {count} 个文件',
+    'common.uploadFile': '上传文件',
+    'common.mapColumns': '映射列',
+    'common.importProgress': '导入与校验',
+    'common.dropFileHere': '将 CSV 或 JSON 文件拖放到这里',
+    'common.fileFormatHint': '支持 UTF-8 编码的 .csv、.json 文件',
+    'common.selectFile': '浏览文件',
+    'common.detectedRows': '已检测',
+    'common.records': '条记录',
+    'common.ignoreColumn': '忽略',
+    'common.startImport': '开始导入',
+    'common.importing': '导入中...',
+    'common.completed': '已完成',
+    'common.succeeded': '成功',
+    'common.failed': '失败',
+    'common.failedRowsHint': '条记录导入失败。',
+    'common.downloadErrors': '下载失败 CSV',
+    'common.importAnother': '再次导入',
+    'common.selectOption': '请选择',
+    'common.yesTrue': '是 / 真',
+    'common.noFalse': '否 / 假',
+    'common.startDate': '开始日期',
+    'common.endDate': '结束日期',
     'common.clone': '克隆',
     'common.autoSaving': '自动保存中...',
     'common.autoSaved': '已自动保存',
@@ -115,6 +140,8 @@ const baseLocales: Record<string, Record<string, string>> = {
     'common.saveView': '保存',
     'common.perPage': '每页',
     'common.copyId': '复制 ID',
+    'common.moreActions': '更多操作',
+    'common.quickEdit': '快速编辑',
     'common.showMore': '展开更多',
     'common.showLess': '收起',
     'common.showPassword': '显示密码',
@@ -724,6 +751,31 @@ const baseLocales: Record<string, Record<string, string>> = {
     'common.page': '{current} / {total}',
     'common.export': 'Export',
     'common.import': 'Import',
+    'common.chooseFile': 'Choose file',
+    'common.noFileChosen': 'No file chosen',
+    'common.filesSelected': '{count} files selected',
+    'common.uploadFile': 'Upload file',
+    'common.mapColumns': 'Map columns',
+    'common.importProgress': 'Import & verify',
+    'common.dropFileHere': 'Drag and drop CSV or JSON file here',
+    'common.fileFormatHint': 'Supports .csv, .json with UTF-8 encoding',
+    'common.selectFile': 'Browse file',
+    'common.detectedRows': 'Detected',
+    'common.records': 'records',
+    'common.ignoreColumn': 'Ignore',
+    'common.startImport': 'Start import',
+    'common.importing': 'Importing...',
+    'common.completed': 'Completed',
+    'common.succeeded': 'Succeeded',
+    'common.failed': 'Failed',
+    'common.failedRowsHint': 'records failed to import.',
+    'common.downloadErrors': 'Download failed CSV',
+    'common.importAnother': 'Import another',
+    'common.selectOption': 'Select an option...',
+    'common.yesTrue': 'Yes / True',
+    'common.noFalse': 'No / False',
+    'common.startDate': 'Start date',
+    'common.endDate': 'End date',
     'common.clone': 'Clone',
     'common.autoSaving': 'Auto-saving...',
     'common.autoSaved': 'Saved',
@@ -786,6 +838,8 @@ const baseLocales: Record<string, Record<string, string>> = {
     'common.saveView': 'Save',
     'common.perPage': 'per page',
     'common.copyId': 'Copy ID',
+    'common.moreActions': 'More actions',
+    'common.quickEdit': 'Quick edit',
     'common.showMore': 'Show more',
     'common.showLess': 'Show less',
     'common.showPassword': 'Show password',
@@ -1355,7 +1409,7 @@ function detectLocale(): string {
   if (typeof navigator === 'undefined') return 'en';
   const browserLang = navigator.language || navigator.languages?.[0] || 'zh-CN';
   if (locales[browserLang]) return browserLang;
-  const prefix = browserLang.split('-')[0];
+  const [prefix = browserLang] = browserLang.split('-');
   for (const key of Object.keys(locales)) {
     if (key === browserLang || key.startsWith(prefix + '-')) return key;
   }
@@ -1407,7 +1461,7 @@ function translateFromTables(
   params?: Record<string, string | number>,
 ): string {
   const localeTable = locales[locale];
-  let text = localeTable?.[key] ?? locales.en?.[key] ?? key;
+  let text = localeTable?.[key] ?? locales['en']?.[key] ?? key;
 
   if (params) {
     for (const [param, value] of Object.entries(params)) {

package/src/import-contract.ts

@@ -0,0 +1,106 @@
+import Papa from 'papaparse';
+import { Type, type Static } from '@sinclair/typebox';
+import { checkExact } from './schema-validation';
+import { snapshotPlainData } from './plain-data';
+import { HttpError } from './types';
+import { parseContractId, parseContractRecord, type ContractSchemas, type ResourceContract } from './resource-contract';
+import { decodeOneResult, decodeManyResult, rejectProviderResponse } from './record-decoder';
+
+export type ImportFormat = 'auto' | 'csv' | 'json';
+const progressSchema = Type.Object({
+  totalAmount: Type.Integer({ minimum: 0 }),
+  attemptedAmount: Type.Integer({ minimum: 0 }),
+  processedAmount: Type.Integer({ minimum: 0 }),
+}, { additionalProperties: false });
+export type ImportOperationProgress = Static<typeof progressSchema>;
+
+export function newImportProgress(): ImportOperationProgress {
+  return { totalAmount: 0, attemptedAmount: 0, processedAmount: 0 };
+}
+
+export function snapshotImportProgress(value: unknown): ImportOperationProgress {
+  const progress = snapshotPlainData(value);
+  if (!checkExact(progressSchema, progress) || progress.processedAmount > progress.attemptedAmount ||
+    progress.attemptedAmount > progress.totalAmount ||
+    !Object.values(progress).every(Number.isSafeInteger)) throw new HttpError('Invalid import progress', 500);
+  return progress;
+}
+
+export function invalidImportInput(row?: number): never {
+  throw new HttpError('Invalid import input', 422, undefined, {
+    code: 'INVALID_RESOURCE_INPUT',
+    details: { phase: 'input', writeMayHaveSucceeded: false, ...(row === undefined ? {} : { row }) },
+  });
+}
+
+/** Files are the only non-JSON input; do not invoke caller-supplied getters or text methods. */
+export function snapshotImportFile(value: unknown) {
+  try {
+    if (typeof value !== 'object' || value === null ||
+        ![Object.prototype, null].includes(Object.getPrototypeOf(value)) ||
+        Reflect.ownKeys(value).length !== 1) return invalidImportInput();
+    const property = Object.getOwnPropertyDescriptor(value, 'file');
+    const file: unknown = property && 'value' in property ? property.value : undefined;
+    if (!(file instanceof File)) return invalidImportInput();
+    const ownName = Object.getOwnPropertyDescriptor(file, 'name');
+    if (ownName && !('value' in ownName)) return invalidImportInput();
+    const name: unknown = ownName ? ownName.value : Object.getOwnPropertyDescriptor(File.prototype, 'name')?.get?.call(file);
+    if (typeof name !== 'string') return invalidImportInput();
+    const read = Blob.prototype.text.bind(file);
+    return { file, name, read };
+  } catch {
+    return invalidImportInput();
+  }
+}
+
+const rowsSchema = Type.Array(Type.Record(Type.String(), Type.Unknown()));
+const csvSchema = Type.Array(Type.Array(Type.String()));
+
+/** CSV values stay strings; only an explicit mapper may supply business conversions. */
+export function parseImportRows(text: string, name: string, format: ImportFormat): Record<string, unknown>[] {
+  try {
+    const source = text.charCodeAt(0) === 0xFEFF ? text.slice(1) : text;
+    const selected = format === 'auto' ? name.toLowerCase().endsWith('.json') ? 'json'
+      : name.toLowerCase().endsWith('.csv') ? 'csv' : undefined : format;
+    if (selected === 'json') {
+      const data = snapshotPlainData(JSON.parse(source));
+      return checkExact(rowsSchema, data) ? data : invalidImportInput();
+    }
+    if (selected !== 'csv') return invalidImportInput();
+    const parsed = Papa.parse<unknown>(source, { delimiter: ',', dynamicTyping: false, skipEmptyLines: true });
+    const data = snapshotPlainData(parsed.data);
+    if (parsed.errors.length || !checkExact(csvSchema, data)) return invalidImportInput();
+    const [headers, ...rows] = data;
+    if (!headers) return [];
+    if (headers.some(header => header.trim() === '') || new Set(headers).size !== headers.length) return invalidImportInput();
+    return rows.map((row, index) => {
+      if (row.length !== headers.length) return invalidImportInput(index + 1);
+      return Object.fromEntries(headers.map((header, column) => [header, row[column]]));
+    });
+  } catch {
+    return invalidImportInput();
+  }
+}
+
+export function decodeImportReceipt<S extends ContractSchemas>(
+  contract: ResourceContract<S>, response: unknown, inputs: readonly unknown[],
+  batch: boolean, seen: ReadonlySet<string | number>,
+) {
+  try {
+    const receipt = snapshotPlainData(response);
+    const rows = batch
+      ? decodeManyResult(receipt, value => parseContractRecord(contract, value), true).data
+      : [decodeOneResult(receipt, value => parseContractRecord(contract, value), true).data];
+    if (rows.length !== inputs.length || new Set(rows.map(row => row.id)).size !== rows.length) rejectProviderResponse(true);
+    for (const [index, row] of rows.entries()) {
+      const recordId = parseContractId(contract, row.id);
+      const submitted = inputs[index];
+      const id: unknown = typeof submitted === 'object' && submitted !== null
+        ? Object.getOwnPropertyDescriptor(submitted, 'id')?.value : undefined;
+      if ((id !== undefined && id !== recordId) || seen.has(recordId)) rejectProviderResponse(true);
+    }
+    return rows;
+  } catch {
+    return rejectProviderResponse(true);
+  }
+}