@svadmin/lite 0.13.0 → 0.15.0

package/dist/schema-form-data.js

@@ -0,0 +1,264 @@
+import { assertSchemaFormSchema, isSchemaFormNodeVisible, prepareSchemaFormValue, validateSchemaFormValue } from '@svadmin/core/schema-form';
+export function schemaFormFieldName(path) {
+    return `data:${JSON.stringify(path)}`;
+}
+export const schemaFormActionName = 'schemaFormAction';
+export function encodeSchemaFormArrayAction(action) {
+    if (!['add', 'remove'].includes(action.type) ||
+        !Array.isArray(action.path) || action.path.length === 0 || action.path.length > 32 ||
+        !action.path.every(segment => typeof segment === 'string' && segment.length > 0 && segment.length <= 200)) {
+        throw new Error('Invalid schema form action.');
+    }
+    if (action['type'] === 'remove' &&
+        (!Number.isSafeInteger(action.index) || action.index < 0 || action.index > 1000)) {
+        throw new Error('Invalid schema form action.');
+    }
+    if (action['type'] === 'add' && action['index'] !== undefined)
+        throw new Error('Invalid schema form action.');
+    return JSON.stringify(action);
+}
+export function decodeSchemaFormArrayAction(form) {
+    const values = form.getAll(schemaFormActionName);
+    if (values.length === 0)
+        return;
+    if (values.length !== 1 || typeof values[0] !== 'string' || values[0].length > 10000)
+        throw new Error('Invalid schema form action.');
+    let parsed;
+    try {
+        parsed = JSON.parse(values[0]);
+    }
+    catch {
+        throw new Error('Invalid schema form action.');
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+        throw new Error('Invalid schema form action.');
+    const candidate = parsed;
+    if ((candidate['type'] !== 'add' && candidate['type'] !== 'remove') ||
+        !Array.isArray(candidate['path']) ||
+        !candidate['path'].every(segment => typeof segment === 'string' && segment.length > 0 && segment.length <= 200) ||
+        candidate['path'].length === 0 || candidate['path'].length > 32 ||
+        Object.keys(candidate).some(key => !['type', 'path', 'index'].includes(key))) {
+        throw new Error('Invalid schema form action.');
+    }
+    if (candidate['type'] === 'add' && Object.hasOwn(candidate, 'index'))
+        throw new Error('Invalid schema form action.');
+    if (candidate['type'] === 'remove' &&
+        (!Number.isSafeInteger(candidate['index']) || candidate['index'] < 0 || candidate['index'] > 1000)) {
+        throw new Error('Invalid schema form action.');
+    }
+    return candidate;
+}
+/** 按可信 Schema 解码并验证支持的约束；不替代资源授权和业务命令校验。 */
+export function decodeSchemaFormData(schema, form) {
+    if (decodeSchemaFormArrayAction(form))
+        throw new Error('Array actions require decodeSchemaFormSubmission.');
+    return decodeFields(schema, form, true);
+}
+function decodeFields(schema, form, validate) {
+    assertSchemaFormSchema(schema);
+    decodeSchemaFormArrayAction(form);
+    const allowed = new Set();
+    const controllers = {};
+    const controllerValues = new Map();
+    let nodes = 0;
+    let textLength = 0;
+    const fail = () => { throw new Error('Invalid schema form data.'); };
+    function values(name) {
+        allowed.add(name);
+        return form.getAll(name).map(value => {
+            if (typeof value !== 'string')
+                return fail();
+            textLength += value.length;
+            if (textLength > 1_000_000)
+                return fail();
+            return value;
+        });
+    }
+    function visit(node, path, depth) {
+        const cacheKey = JSON.stringify(path);
+        if (controllerValues.has(cacheKey))
+            return controllerValues.get(cacheKey);
+        if (++nodes > 1000 || depth > 32)
+            return fail();
+        if (node.type === 'object' || node.properties) {
+            const result = {};
+            for (const [key, child] of Object.entries(node.properties ?? {})) {
+                if (!isSchemaFormNodeVisible(child, controllers))
+                    continue;
+                Object.defineProperty(result, key, {
+                    value: visit(child, [...path, key], depth + 1),
+                    enumerable: true, configurable: true, writable: true,
+                });
+            }
+            return result;
+        }
+        if (node.type === 'array') {
+            const counts = values(`length:${JSON.stringify(path)}`);
+            if (counts.length !== 1 || !/^(0|[1-9]\d*)$/.test(counts[0] ?? ''))
+                return fail();
+            const count = Number(counts[0]);
+            if (!Number.isSafeInteger(count) || count > 1000 - nodes)
+                return fail();
+            return Array.from({ length: count }, (_, index) => visit(node.items ?? { type: 'string' }, [...path, String(index)], depth + 1));
+        }
+        const entries = values(schemaFormFieldName(path));
+        if (node.type === 'boolean' && !node.enum) {
+            if (entries.length === 1 && entries[0] === 'false')
+                return false;
+            if (entries.length === 2 && entries[0] === 'false' && entries[1] === 'true')
+                return true;
+            return fail();
+        }
+        if (entries.length !== 1)
+            return fail();
+        const raw = entries[0] ?? '';
+        if (node.enum) {
+            if (raw === '')
+                return undefined;
+            if (!/^__json_enum_(0|[1-9]\d*)$/.test(raw))
+                return fail();
+            const index = Number(raw.slice('__json_enum_'.length));
+            if (!Number.isSafeInteger(index) || index >= node.enum.length)
+                return fail();
+            return node.enum[index];
+        }
+        if (node.type === 'null')
+            return raw === 'null' ? null : fail();
+        if (node.type === 'number' || node.type === 'integer') {
+            if (raw === '')
+                return undefined;
+            if (!/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/.test(raw))
+                return fail();
+            const number = Number(raw);
+            if (!Number.isFinite(number) || (node.type === 'integer' && !Number.isSafeInteger(number)))
+                return fail();
+            return number;
+        }
+        if (node.type !== undefined && node.type !== 'string')
+            return fail();
+        return raw;
+    }
+    if (schema.type !== 'object' && !schema.properties)
+        return fail();
+    // 控制字段只允许无条件标量，因此可先解码，不依赖属性声明顺序。
+    function collectControllers(node) {
+        const path = node.visibleWhen?.path;
+        if (path && !controllerValues.has(JSON.stringify(path))) {
+            let definition = schema;
+            for (const key of path) {
+                const next = definition.properties?.[key];
+                if (!next)
+                    return fail();
+                definition = next;
+            }
+            const decoded = visit(definition, [...path], path.length);
+            controllerValues.set(JSON.stringify(path), decoded);
+            let target = controllers;
+            path.forEach((key, index) => {
+                if (index === path.length - 1) {
+                    Object.defineProperty(target, key, { value: decoded, enumerable: true, configurable: true });
+                }
+                else {
+                    if (!Object.hasOwn(target, key))
+                        Object.defineProperty(target, key, {
+                            value: {}, enumerable: true, configurable: true,
+                        });
+                    target = target[key];
+                }
+            });
+        }
+        for (const child of Object.values(node.properties ?? {}))
+            collectControllers(child);
+        if (node.items)
+            collectControllers(node.items);
+    }
+    collectControllers(schema);
+    const result = visit(schema, [], 0);
+    if (validate && validateSchemaFormValue(schema, result).length > 0)
+        return fail();
+    for (const key of form.keys()) {
+        if ((key.startsWith('data:') || key.startsWith('length:')) && !allowed.has(key))
+            return fail();
+    }
+    return result;
+}
+/** 数组动作只生成下一份草稿；只有 submit 分支才可进入业务写入。 */
+export function decodeSchemaFormSubmission(schema, form) {
+    const action = decodeSchemaFormArrayAction(form);
+    if (!action)
+        return { kind: 'submit', data: decodeSchemaFormData(schema, form) };
+    const data = decodeFields(schema, form, false);
+    const fail = () => { throw new Error('Invalid schema form action.'); };
+    let node = schema;
+    let current = data;
+    for (const segment of action.path) {
+        if (node.type === 'array') {
+            if (!/^(0|[1-9]\d*)$/.test(segment) || !Array.isArray(current) ||
+                Number(segment) >= current.length)
+                return fail();
+            node = node.items ?? { type: 'string' };
+            current = current[Number(segment)];
+        }
+        else {
+            if (!node.properties || !Object.hasOwn(node.properties, segment) ||
+                current === null || typeof current !== 'object' || !Object.hasOwn(current, segment))
+                return fail();
+            const next = node.properties[segment];
+            if (!next)
+                return fail();
+            node = next;
+            current = current[segment];
+        }
+        if (!isSchemaFormNodeVisible(node, data))
+            return fail();
+    }
+    if (node.type !== 'array' || !Array.isArray(current))
+        return fail();
+    // 默认值也受结构预算约束，防止嵌套默认数组放大草稿。
+    let nodes = 0;
+    let length = 0;
+    function defaultValue(definition, depth) {
+        if (++nodes > 1000 || depth > 32)
+            return fail();
+        if (definition.default !== undefined)
+            return structuredClone(definition.default);
+        if (definition.type === 'object' || definition.properties) {
+            return Object.fromEntries(Object.entries(definition.properties ?? {})
+                .map(([key, child]) => [key, defaultValue(child, depth + 1)]));
+        }
+        if (definition.type === 'array')
+            return [];
+        if (definition.type === 'null')
+            return null;
+        if (definition.enum || definition.type === 'number' || definition.type === 'integer')
+            return undefined;
+        return definition.type === 'boolean' ? false : '';
+    }
+    if (action.type === 'add') {
+        if (current.length >= Math.min(node.maxItems ?? 1000, 1000))
+            return fail();
+        current.push(defaultValue(node.items ?? { type: 'string' }, action.path.length + 1));
+    }
+    else {
+        if (action.index === undefined || action.index >= current.length ||
+            current.length <= (node.minItems ?? 0))
+            return fail();
+        current.splice(action.index, 1);
+    }
+    nodes = 0;
+    function checkBudget(value, depth) {
+        if (++nodes > 1000 || depth > 32)
+            return fail();
+        if (typeof value === 'string')
+            length += value.length;
+        if (length > 1_000_000)
+            return fail();
+        if (value && typeof value === 'object') {
+            for (const child of Object.values(value))
+                checkBudget(child, depth + 1);
+        }
+    }
+    checkBudget(data, 0);
+    // 草稿允许尚未填写的必填项，但仍投影掉条件隐藏字段。
+    return { kind: 'draft', data: prepareSchemaFormValue(schema, data).data };
+}

package/dist/server-adapter.js

@@ -1,5 +1,6 @@
 import { definedOptions } from '@svadmin/core/options';
-import { redirect, isRedirect } from '@sveltejs/kit';
+import { FILTER_COLLECTION_LIMIT, isFilterCollectionValue, isCollectionFilterOperator, filterOperatorsForField } from '@svadmin/core/filter-values';
+import { error, redirect, isRedirect } from '@sveltejs/kit';
 import { resourceToTypeBoxSchema } from './schema-generator';
 import { parseExplicitBoolean } from './value-normalization';
 function listRequestState(url, resource) {
@@ -61,57 +62,171 @@ function listRequestFilters(resource, url) {
     const structured = parseStructuredFilters(resource, url);
     return structured.length > 0 ? structured : filters;
 }
+function invalidStructuredFilters() {
+    throw error(400, 'Invalid structured filter query.');
+}
 function parseStructuredFilters(resource, url) {
+    const structuredKeys = [...url.searchParams.keys()].filter(key => key.startsWith('filters['));
+    const entryPattern = /^filters\[([0-9]+(?:\.value\.[0-9]+)*)\]\[(field|operator|value|values\.(?:0|[1-9]\d*))\]$/;
+    if (structuredKeys.some(key => !entryPattern.test(key)))
+        invalidStructuredFilters();
     const entries = [...url.searchParams.entries()]
         .map(([key, value]) => {
-        const match = /^filters\[([0-9]+(?:\.value\.[0-9]+)*)\]\[(field|operator|value)\]$/.exec(key);
+        const match = entryPattern.exec(key);
         return match ? { path: match[1], property: match[2], value } : undefined;
     })
         .filter((entry) => entry !== undefined);
     if (entries.length === 0)
         return [];
+    if (entries.length > 300)
+        invalidStructuredFilters();
     const roots = [];
+    const seen = new Set();
+    let textLength = 0;
     for (const entry of entries) {
-        const segments = [...entry.path.matchAll(/\d+/g)].map(match => Number(match[0]));
+        textLength += entry.path.length + entry.property.length + entry.value.length;
+        if (textLength > 64_000 || entry.path.length > 400)
+            invalidStructuredFilters();
+        const entryKey = `${entry.path}:${entry.property}`;
+        if (seen.has(entryKey))
+            invalidStructuredFilters();
+        seen.add(entryKey);
+        const parts = entry.path.split('.value.');
+        if (parts.length > 33 || parts.some(part => !/^(0|[1-9]\d*)$/.test(part)))
+            invalidStructuredFilters();
+        const segments = parts.map(Number);
         const rootIndex = segments.shift();
-        if (rootIndex === undefined || !Number.isSafeInteger(rootIndex) || rootIndex < 0)
-            continue;
+        if (rootIndex === undefined || !Number.isSafeInteger(rootIndex) || rootIndex < 0 || rootIndex > 1000)
+            invalidStructuredFilters();
         let node = roots[rootIndex];
         if (!node) {
             node = {};
             roots[rootIndex] = node;
         }
         for (const childIndex of segments) {
-            if (!Number.isSafeInteger(childIndex) || childIndex < 0)
-                break;
+            if (!Number.isSafeInteger(childIndex) || childIndex < 0 || childIndex > 1000)
+                invalidStructuredFilters();
             node.children ??= [];
             node = node.children[childIndex] ??= {};
         }
-        node[entry.property] = entry.value;
+        if (entry.property.startsWith('values.')) {
+            const index = Number(entry.property.slice('values.'.length));
+            if (!Number.isSafeInteger(index) || index >= FILTER_COLLECTION_LIMIT)
+                invalidStructuredFilters();
+            (node.values ??= [])[index] = entry.value;
+        }
+        else if (entry.property === 'field' || entry.property === 'operator' || entry.property === 'value') {
+            node[entry.property] = entry.value;
+        }
+        else
+            invalidStructuredFilters();
     }
-    function compile(node) {
+    const validOperators = new Set([
+        'eq', 'ne', 'lt', 'gt', 'lte', 'gte', 'contains', 'ncontains',
+        'startswith', 'endswith', 'in', 'nin', 'null', 'nnull', 'between', 'nbetween',
+    ]);
+    let visited = 0;
+    function compileList(nodes, depth) {
+        // 数组迭代方法会跳过空洞，显式逐索引拒绝稀疏路径。
+        const filters = [];
+        for (let index = 0; index < nodes.length; index++) {
+            const node = nodes[index];
+            if (!node)
+                invalidStructuredFilters();
+            filters.push(compile(node, depth));
+        }
+        return filters;
+    }
+    function compile(node, depth) {
+        if (++visited > 1000 || depth > 32)
+            invalidStructuredFilters();
         const operator = node.operator;
-        if (node.field && operator && operator !== 'and' && operator !== 'or') {
-            const field = resource.fields.find(candidate => candidate.key === node.field);
-            if (!field)
-                return undefined;
-            if (operator === 'null' || operator === 'nnull') {
-                return { field: node.field, operator: operator, value: null };
+        if (operator === 'and' || operator === 'or') {
+            if (node.field !== undefined || node.value !== undefined || node.values !== undefined)
+                invalidStructuredFilters();
+            const children = node.children ?? [];
+            return { operator, value: compileList(children, depth + 1) };
+        }
+        if (node.children !== undefined || !node.field || !operator || !validOperators.has(operator)) {
+            invalidStructuredFilters();
+        }
+        const field = resource.fields.find(candidate => candidate.key === node.field);
+        if (!field || field.filterable === false)
+            invalidStructuredFilters();
+        if (isCollectionFilterOperator(operator)) {
+            if (node.value !== undefined || !node.values)
+                invalidStructuredFilters();
+            const values = [];
+            for (let index = 0; index < node.values.length; index++) {
+                const raw = node.values[index];
+                if (raw === undefined)
+                    invalidStructuredFilters();
+                if (['number', 'currency', 'percent', 'rating', 'rate'].includes(field.type)) {
+                    if (!/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/.test(raw))
+                        invalidStructuredFilters();
+                    values.push(Number(raw));
+                }
+                else if (field.type === 'boolean') {
+                    if (raw !== 'true' && raw !== 'false')
+                        invalidStructuredFilters();
+                    values.push(raw === 'true');
+                }
+                else if (field.type === 'select') {
+                    // 集合枚举使用 JSON 标量令牌，数值 2 与字符串 "2" 不再碰撞。
+                    try {
+                        values.push(JSON.parse(raw));
+                    }
+                    catch {
+                        invalidStructuredFilters();
+                    }
+                }
+                else
+                    values.push(raw);
             }
-            if (node.value === undefined || node.value === '')
-                return undefined;
-            const value = field.type === 'number' || field.type === 'currency' || field.type === 'percent'
-                ? Number(node.value)
-                : field.type === 'boolean' ? node.value === 'true' : node.value;
-            return { field: node.field, operator: operator, value };
+            if (!isFilterCollectionValue(field, operator, values))
+                invalidStructuredFilters();
+            return { field: node.field, operator: operator, value: values };
         }
-        if ((operator === 'and' || operator === 'or') && node.children) {
-            const children = node.children.map(compile).filter((child) => child !== undefined);
-            return children.length > 0 ? { operator, value: children } : undefined;
+        if (node.values !== undefined || !filterOperatorsForField(field).includes(operator))
+            invalidStructuredFilters();
+        if (operator === 'null' || operator === 'nnull') {
+            if (node.value !== undefined)
+                invalidStructuredFilters();
+            return { field: node.field, operator, value: null };
+        }
+        if (node.value === undefined)
+            invalidStructuredFilters();
+        {
+            if ((field.type === 'boolean' && !['eq', 'ne'].includes(operator))
+                || (['in', 'nin', 'between', 'nbetween'].includes(operator)))
+                invalidStructuredFilters();
+            const raw = node.value;
+            if (['number', 'currency', 'percent', 'rating', 'rate'].includes(field.type)) {
+                if (!['eq', 'ne', 'lt', 'gt', 'lte', 'gte'].includes(operator))
+                    invalidStructuredFilters();
+                if (!/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/.test(raw))
+                    invalidStructuredFilters();
+                const value = Number(raw);
+                if (!Number.isFinite(value))
+                    invalidStructuredFilters();
+                return { field: node.field, operator: operator, value };
+            }
+            if (field.type === 'boolean') {
+                if (raw !== 'true' && raw !== 'false')
+                    invalidStructuredFilters();
+                return { field: node.field, operator: operator, value: raw === 'true' };
+            }
+            if (field.type === 'select') {
+                const matches = field.options?.filter(option => String(option.value) === raw && !option.disabled) ?? [];
+                const match = matches[0];
+                if (!['eq', 'ne'].includes(operator) || matches.length !== 1 || !match)
+                    return invalidStructuredFilters();
+                return { field: node.field, operator: operator, value: match.value };
+            }
+            return { field: node.field, operator: operator, value: raw };
         }
-        return undefined;
     }
-    return roots.map(compile).filter((filter) => filter !== undefined);
+    return compileList(roots, 0);
 }
 /**
  * Creates a SvelteKit `load` function that fetches a resource list

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/lite",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "SSR-first lightweight admin UI for @svadmin with optional progressive enhancement",
   "type": "module",
   "sideEffects": [
@@ -49,7 +49,7 @@
   },
   "peerDependencies": {
     "svelte": "^5.56.10",
-    "@svadmin/core": ">=0.34.2 <0.54.0",
+    "@svadmin/core": ">=0.34.2 <0.56.0",
     "@sveltejs/kit": "^2.70.3"
   },
   "dependencies": {