@svadmin/lite 0.12.0 → 0.14.0

package/dist/server-adapter.js

@@ -1,5 +1,6 @@
 import { definedOptions } from '@svadmin/core/options';
-import { redirect, isRedirect } from '@sveltejs/kit';
+import { FILTER_COLLECTION_LIMIT, isFilterCollectionValue, isCollectionFilterOperator, filterOperatorsForField } from '@svadmin/core/filter-values';
+import { error, redirect, isRedirect } from '@sveltejs/kit';
 import { resourceToTypeBoxSchema } from './schema-generator';
 import { parseExplicitBoolean } from './value-normalization';
 function listRequestState(url, resource) {
@@ -58,7 +59,174 @@ function listRequestFilters(resource, url) {
             });
         }
     }
-    return filters;
+    const structured = parseStructuredFilters(resource, url);
+    return structured.length > 0 ? structured : filters;
+}
+function invalidStructuredFilters() {
+    throw error(400, 'Invalid structured filter query.');
+}
+function parseStructuredFilters(resource, url) {
+    const structuredKeys = [...url.searchParams.keys()].filter(key => key.startsWith('filters['));
+    const entryPattern = /^filters\[([0-9]+(?:\.value\.[0-9]+)*)\]\[(field|operator|value|values\.(?:0|[1-9]\d*))\]$/;
+    if (structuredKeys.some(key => !entryPattern.test(key)))
+        invalidStructuredFilters();
+    const entries = [...url.searchParams.entries()]
+        .map(([key, value]) => {
+        const match = entryPattern.exec(key);
+        return match ? { path: match[1], property: match[2], value } : undefined;
+    })
+        .filter((entry) => entry !== undefined);
+    if (entries.length === 0)
+        return [];
+    if (entries.length > 300)
+        invalidStructuredFilters();
+    const roots = [];
+    const seen = new Set();
+    let textLength = 0;
+    for (const entry of entries) {
+        textLength += entry.path.length + entry.property.length + entry.value.length;
+        if (textLength > 64_000 || entry.path.length > 400)
+            invalidStructuredFilters();
+        const entryKey = `${entry.path}:${entry.property}`;
+        if (seen.has(entryKey))
+            invalidStructuredFilters();
+        seen.add(entryKey);
+        const parts = entry.path.split('.value.');
+        if (parts.length > 33 || parts.some(part => !/^(0|[1-9]\d*)$/.test(part)))
+            invalidStructuredFilters();
+        const segments = parts.map(Number);
+        const rootIndex = segments.shift();
+        if (rootIndex === undefined || !Number.isSafeInteger(rootIndex) || rootIndex < 0 || rootIndex > 1000)
+            invalidStructuredFilters();
+        let node = roots[rootIndex];
+        if (!node) {
+            node = {};
+            roots[rootIndex] = node;
+        }
+        for (const childIndex of segments) {
+            if (!Number.isSafeInteger(childIndex) || childIndex < 0 || childIndex > 1000)
+                invalidStructuredFilters();
+            node.children ??= [];
+            node = node.children[childIndex] ??= {};
+        }
+        if (entry.property.startsWith('values.')) {
+            const index = Number(entry.property.slice('values.'.length));
+            if (!Number.isSafeInteger(index) || index >= FILTER_COLLECTION_LIMIT)
+                invalidStructuredFilters();
+            (node.values ??= [])[index] = entry.value;
+        }
+        else if (entry.property === 'field' || entry.property === 'operator' || entry.property === 'value') {
+            node[entry.property] = entry.value;
+        }
+        else
+            invalidStructuredFilters();
+    }
+    const validOperators = new Set([
+        'eq', 'ne', 'lt', 'gt', 'lte', 'gte', 'contains', 'ncontains',
+        'startswith', 'endswith', 'in', 'nin', 'null', 'nnull', 'between', 'nbetween',
+    ]);
+    let visited = 0;
+    function compileList(nodes, depth) {
+        // 数组迭代方法会跳过空洞，显式逐索引拒绝稀疏路径。
+        const filters = [];
+        for (let index = 0; index < nodes.length; index++) {
+            const node = nodes[index];
+            if (!node)
+                invalidStructuredFilters();
+            filters.push(compile(node, depth));
+        }
+        return filters;
+    }
+    function compile(node, depth) {
+        if (++visited > 1000 || depth > 32)
+            invalidStructuredFilters();
+        const operator = node.operator;
+        if (operator === 'and' || operator === 'or') {
+            if (node.field !== undefined || node.value !== undefined || node.values !== undefined)
+                invalidStructuredFilters();
+            const children = node.children ?? [];
+            return { operator, value: compileList(children, depth + 1) };
+        }
+        if (node.children !== undefined || !node.field || !operator || !validOperators.has(operator)) {
+            invalidStructuredFilters();
+        }
+        const field = resource.fields.find(candidate => candidate.key === node.field);
+        if (!field || field.filterable === false)
+            invalidStructuredFilters();
+        if (isCollectionFilterOperator(operator)) {
+            if (node.value !== undefined || !node.values)
+                invalidStructuredFilters();
+            const values = [];
+            for (let index = 0; index < node.values.length; index++) {
+                const raw = node.values[index];
+                if (raw === undefined)
+                    invalidStructuredFilters();
+                if (['number', 'currency', 'percent', 'rating', 'rate'].includes(field.type)) {
+                    if (!/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/.test(raw))
+                        invalidStructuredFilters();
+                    values.push(Number(raw));
+                }
+                else if (field.type === 'boolean') {
+                    if (raw !== 'true' && raw !== 'false')
+                        invalidStructuredFilters();
+                    values.push(raw === 'true');
+                }
+                else if (field.type === 'select') {
+                    // 集合枚举使用 JSON 标量令牌，数值 2 与字符串 "2" 不再碰撞。
+                    try {
+                        values.push(JSON.parse(raw));
+                    }
+                    catch {
+                        invalidStructuredFilters();
+                    }
+                }
+                else
+                    values.push(raw);
+            }
+            if (!isFilterCollectionValue(field, operator, values))
+                invalidStructuredFilters();
+            return { field: node.field, operator: operator, value: values };
+        }
+        if (node.values !== undefined || !filterOperatorsForField(field).includes(operator))
+            invalidStructuredFilters();
+        if (operator === 'null' || operator === 'nnull') {
+            if (node.value !== undefined)
+                invalidStructuredFilters();
+            return { field: node.field, operator, value: null };
+        }
+        if (node.value === undefined)
+            invalidStructuredFilters();
+        {
+            if ((field.type === 'boolean' && !['eq', 'ne'].includes(operator))
+                || (['in', 'nin', 'between', 'nbetween'].includes(operator)))
+                invalidStructuredFilters();
+            const raw = node.value;
+            if (['number', 'currency', 'percent', 'rating', 'rate'].includes(field.type)) {
+                if (!['eq', 'ne', 'lt', 'gt', 'lte', 'gte'].includes(operator))
+                    invalidStructuredFilters();
+                if (!/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/.test(raw))
+                    invalidStructuredFilters();
+                const value = Number(raw);
+                if (!Number.isFinite(value))
+                    invalidStructuredFilters();
+                return { field: node.field, operator: operator, value };
+            }
+            if (field.type === 'boolean') {
+                if (raw !== 'true' && raw !== 'false')
+                    invalidStructuredFilters();
+                return { field: node.field, operator: operator, value: raw === 'true' };
+            }
+            if (field.type === 'select') {
+                const matches = field.options?.filter(option => String(option.value) === raw && !option.disabled) ?? [];
+                const match = matches[0];
+                if (!['eq', 'ne'].includes(operator) || matches.length !== 1 || !match)
+                    return invalidStructuredFilters();
+                return { field: node.field, operator: operator, value: match.value };
+            }
+            return { field: node.field, operator: operator, value: raw };
+        }
+    }
+    return compileList(roots, 0);
 }
 /**
  * Creates a SvelteKit `load` function that fetches a resource list

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/lite",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "SSR-first lightweight admin UI for @svadmin with optional progressive enhancement",
   "type": "module",
   "sideEffects": [
@@ -49,7 +49,7 @@
   },
   "peerDependencies": {
     "svelte": "^5.56.10",
-    "@svadmin/core": ">=0.34.2 <0.53.0",
+    "@svadmin/core": ">=0.34.2 <0.55.0",
     "@sveltejs/kit": "^2.70.3"
   },
   "dependencies": {