@things-factory/shell 10.1.79 → 10.1.121
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/client/themes/ui-tokens.css +21 -0
- package/dist-server/middlewares/domain-middleware.js +2 -1
- package/dist-server/middlewares/domain-middleware.js.map +1 -1
- package/dist-server/service/index.d.ts +2 -2
- package/dist-server/tsconfig.tsbuildinfo +1 -1
- package/package.json +3 -3
- package/tests/domain-middleware-refusal.test.ts +26 -0
|
@@ -198,6 +198,27 @@ body {
|
|
|
198
198
|
* 글자 수와 두 배 가까이 어긋난다.
|
|
199
199
|
*/
|
|
200
200
|
--ui-measure: min(1080px, 100%);
|
|
201
|
+
|
|
202
|
+
/*
|
|
203
|
+
* ── 화면의 좌우 여백 (2026-10-05) ──────────────────────────────────────
|
|
204
|
+
* 제목줄 · 본문 · 하단 동작 줄이 같은 값을 쓴다 — 그래야 화면에 왼쪽 선과 오른쪽 선이 하나씩이다.
|
|
205
|
+
* 전에는 제목줄 0 · 문서 틀 20 · 작업면 머리 띠 12 · 화면마다 12~24 였고, 1440 창의 plant 에서
|
|
206
|
+
* 본문 첫 글자가 여섯 자리에서 시작했다. 문서 틀은 더 이상 1080 에서 멈추지 않는다(사용자 결정:
|
|
207
|
+
* 창을 채우는 반응형) — 그래서 오른쪽도 이 값만큼 비운다.
|
|
208
|
+
*/
|
|
209
|
+
--ui-gutter: 16px;
|
|
210
|
+
|
|
211
|
+
/*
|
|
212
|
+
* 글 한 줄의 상한 — 페이지가 아니라 **글**에 둔다. 1440 창의 구획에서는 닿지 않아 글이 구획 폭에서
|
|
213
|
+
* 줄을 바꾸고, 2,560 창처럼 아주 넓을 때만 한 줄이 한국어 약 100자에서 멈춘다.
|
|
214
|
+
*/
|
|
215
|
+
--ui-prose-max: 100em;
|
|
216
|
+
}
|
|
217
|
+
|
|
218
|
+
@media (max-width: 600px) {
|
|
219
|
+
body {
|
|
220
|
+
--ui-gutter: 12px;
|
|
221
|
+
}
|
|
201
222
|
}
|
|
202
223
|
|
|
203
224
|
/*
|
|
@@ -59,7 +59,8 @@ async function domainMiddleware(context, next) {
|
|
|
59
59
|
});
|
|
60
60
|
context.state.unsafeIP = !safe;
|
|
61
61
|
if (!safe) {
|
|
62
|
-
|
|
62
|
+
/* `by` tells the refusal it was the address - a role would not open it (ADR-0103 decision 1). */
|
|
63
|
+
context.state.prohibitedPrivileges = (Array.isArray(privileges) ? privileges : []).map(item => ({ ...item, by: 'address' }));
|
|
63
64
|
}
|
|
64
65
|
}
|
|
65
66
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"domain-middleware.js","sourceRoot":"","sources":["../../server/middlewares/domain-middleware.ts"],"names":[],"mappings":";;;AAqBA,
|
|
1
|
+
{"version":3,"file":"domain-middleware.js","sourceRoot":"","sources":["../../server/middlewares/domain-middleware.ts"],"names":[],"mappings":";;;AAqBA,4CAuDC;;AA5ED,oEAAkC;AAClC,0DAAyD;AAEzD;;;;;;;;;GASG;AACU,QAAA,cAAc,GAAG,WAAW,CAAA;AAC5B,QAAA,eAAe,GAAG,qBAAqB,CAAA;AAEpD,SAAS,eAAe,CAAC,OAAY;IACnC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;IACpB,OAAO,CAAC,GAAG,CAAC,sBAAc,EAAE,uBAAe,CAAC,CAAA;AAC9C,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,OAAY,EAAE,IAAS;IAC5D,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ;;;;WAIG;QACH,MAAM,GAAG,MAAM,IAAA,gCAAgB,EAAC,OAAO,CAAC,CAAA;IAC1C,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,oBAAS,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,EAAE,SAAS,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE,aAAa,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;QAEnG,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,kBAAkB;YAClB,MAAM,WAAW,GACf,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBACxB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACpB,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAClC,CAAC,CAAC,CAAA;YAEJ,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,eAAe,CAAC,OAAO,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GACf,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBACxB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACpB,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAClC,CAAC,CAAC,CAAA;YAEJ,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,eAAe,CAAC,OAAO,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACrC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAClC,CAAC,CAAC,CAAA;YAEF,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAA;YAE9B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,iGAAiG;gBACjG,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;YAC9H,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;IAE7B,OAAO,IAAI,EAAE,CAAA;AACf,CAAC","sourcesContent":["import requestIp from 'request-ip'\nimport { getDomainFromURL } from '../utils/get-domain.js'\n\n/**\n * The reason an address was refused, as a header the client can read.\n *\n * The domain's IP lists answer 403, and so does \"no domain chosen\" (domain-authenticate-middleware).\n * The client sent both to check-in; for a refused address check-in sends the person straight back,\n * so the screen stopped with nothing said (ADR README, plan 3). With this header the client can tell\n * the two apart and say what happened - the address is not let in, and check-in cannot change that.\n *\n * A header, not a body: it reaches the client whatever the request was (GraphQL, HTML, a file).\n */\nexport const REFUSAL_HEADER = 'x-refusal'\nexport const REFUSED_ADDRESS = 'address-not-allowed'\n\nfunction refuseByAddress(context: any) {\n context.status = 403\n context.set(REFUSAL_HEADER, REFUSED_ADDRESS)\n}\n\nexport async function domainMiddleware(context: any, next: any) {\n var { domain } = context.state\n if (!domain) {\n /*\n * The domainTypes should be checked only when signin and checkin.\n * For purposes such as API calls, the target domainTypes may be different from the system domainTypes.\n * So, we don't check domainTypes here.\n */\n domain = await getDomainFromURL(context)\n }\n\n if (domain) {\n const ip = requestIp.getClientIp(context.req)\n const { whitelist = [], blacklist = [], protectedlist = [], privileges = [] } = domain.iplist || {}\n\n if (Array.isArray(whitelist) && whitelist.length > 0) {\n /* whitelist 우선 */\n const whitelisted =\n Array.isArray(whitelist) &&\n whitelist.some(item => {\n return new RegExp(item).test(ip)\n })\n\n if (!whitelisted) {\n return refuseByAddress(context)\n }\n } else {\n const blacklisted =\n Array.isArray(blacklist) &&\n blacklist.some(item => {\n return new RegExp(item).test(ip)\n })\n\n if (blacklisted) {\n return refuseByAddress(context)\n }\n }\n\n if (Array.isArray(protectedlist) && protectedlist.length > 0) {\n const safe = protectedlist.some(item => {\n return new RegExp(item).test(ip)\n })\n\n context.state.unsafeIP = !safe\n\n if (!safe) {\n /* `by` tells the refusal it was the address - a role would not open it (ADR-0103 decision 1). */\n context.state.prohibitedPrivileges = (Array.isArray(privileges) ? privileges : []).map(item => ({ ...item, by: 'address' }))\n }\n }\n }\n\n context.state.domain = domain\n\n return next()\n}\n"]}
|
|
@@ -4,12 +4,12 @@ export * from './domain/domain.js';
|
|
|
4
4
|
export * from './domain/domain-types.js';
|
|
5
5
|
export * from './subscription-data/data-types.js';
|
|
6
6
|
export * from './env-var/env-var.js';
|
|
7
|
-
export declare const entities: (typeof import("./
|
|
7
|
+
export declare const entities: (typeof import("./env-var/env-var.js").EnvVar | typeof import("./domain/domain.js").Domain | typeof import("./attribute-set/attribute-set.js").AttributeSet)[];
|
|
8
8
|
export declare const schema: {
|
|
9
9
|
typeDefs: {
|
|
10
10
|
transactionDirectiveTypeDefs: import("graphql").DocumentNode;
|
|
11
11
|
};
|
|
12
|
-
resolverClasses: (typeof import("./
|
|
12
|
+
resolverClasses: (typeof import("./domain/domain-query.js").DomainQuery | typeof import("./domain/domain-mutation.js").DomainMutation | typeof import("./attribute-set/attribute-set-query.js").AttributeSetQuery | typeof import("./attribute-set/attribute-set-mutation.js").AttributeSetMutation | typeof import("./subscription-data/data-resolver.js").DataResolver | typeof import("./env-var/env-var-query.js").EnvVarQuery | typeof import("./env-var/env-var-mutation.js").EnvVarMutation)[];
|
|
13
13
|
directives: {
|
|
14
14
|
transaction: (schema: import("graphql").GraphQLSchema) => import("graphql").GraphQLSchema;
|
|
15
15
|
};
|