openxiangda 1.0.119 → 1.0.120

package/lib/cli.js

@@ -5804,6 +5804,23 @@ function validateResourceItem(kind, item, errors, warnings) {
     if (!credentials.accessKeyId || !credentials.accessKeySecret) {
       warnings.push(`${label}: 未声明凭据；publish 只适用于更新并保留平台已有密文`);
     }
+    const cors = config.cors || item.cors;
+    if (cors?.managed === true) {
+      const allowedOrigins = normalizeManifestStringArray(
+        cors.allowedOrigins || cors.allowedOrigin || cors.origins || cors.origin
+      );
+      if (allowedOrigins.length === 0) {
+        warnings.push(`${label}.cors.allowedOrigins: 未声明时后端将尝试使用当前平台域名`);
+      }
+      const allowedMethods = normalizeManifestStringArray(
+        cors.allowedMethods || cors.allowedMethod || ['PUT', 'GET', 'HEAD']
+      );
+      if (allowedMethods.length === 0) errors.push(`${label}.cors.allowedMethods: 不能为空`);
+      const maxAgeSeconds = Number(cors.maxAgeSeconds || 600);
+      if (!Number.isFinite(maxAgeSeconds) || maxAgeSeconds < 0 || maxAgeSeconds > 86400) {
+        errors.push(`${label}.cors.maxAgeSeconds: 必须在 0 到 86400 秒之间`);
+      }
+    }
   }
   if (kind === 'authConfigs') {
     const config = item.configJson || item.config || item;
@@ -7353,6 +7370,7 @@ async function publishStorageConfigResources(config, target, storageConfigs, res
       code,
       action: existing ? 'update' : 'create',
       id: data?.id,
+      corsStatus: data?.corsStatus,
     });
   }
 }
@@ -8844,6 +8862,7 @@ function normalizeStorageConfigManifest(storageConfig) {
       storageConfig.config ||
       withoutStorageConfigManifestMeta(storageConfig)
   );
+  const cors = normalizeStorageCorsForPublish(configJson.cors || storageConfig.cors);
   const credentials = normalizeStorageCredentialsForPublish(storageConfig);
   return stripUndefinedValues({
     code,
@@ -8863,11 +8882,38 @@ function normalizeStorageConfigManifest(storageConfig) {
       maxFileSizeMb: configJson.maxFileSizeMb,
       allowedExtensions: configJson.allowedExtensions,
       uploadUrlExpiresSeconds: configJson.uploadUrlExpiresSeconds,
+      cors,
     }),
     ...(credentials ? { credentials } : {}),
   });
 }
 
+function normalizeStorageCorsForPublish(cors) {
+  if (cors === undefined || cors === null || cors === '') return undefined;
+  const managed =
+    cors === true ||
+    cors.managed === true ||
+    String(cors.managed || '').toLowerCase() === 'true';
+  if (!managed) return { managed: false };
+  return stripUndefinedValues({
+    managed: true,
+    allowedOrigins: normalizeManifestStringArray(
+      cors.allowedOrigins || cors.allowedOrigin || cors.origins || cors.origin
+    ),
+    allowedMethods: normalizeManifestStringArray(
+      cors.allowedMethods || cors.allowedMethod || ['PUT', 'GET', 'HEAD'],
+      { uppercase: true }
+    ),
+    allowedHeaders: normalizeManifestStringArray(
+      cors.allowedHeaders || cors.allowedHeader || ['content-type', 'x-oss-*']
+    ),
+    exposeHeaders: normalizeManifestStringArray(
+      cors.exposeHeaders || cors.exposeHeader || ['ETag', 'x-oss-request-id']
+    ),
+    maxAgeSeconds: Number(cors.maxAgeSeconds || 600),
+  });
+}
+
 function withoutStorageConfigManifestMeta(storageConfig) {
   const next = withoutResourceMeta(storageConfig);
   delete next.code;
@@ -8876,6 +8922,7 @@ function withoutStorageConfigManifestMeta(storageConfig) {
   delete next.description;
   delete next.provider;
   delete next.status;
+  delete next.cors;
   delete next.config;
   delete next.configJson;
   delete next.credentials;
@@ -9214,6 +9261,16 @@ function normalizePermissionCodeArray(value) {
   );
 }
 
+function normalizeManifestStringArray(value, options = {}) {
+  const source = Array.isArray(value) ? value : value === undefined || value === null ? [] : [value];
+  const items = source
+    .flatMap(item => String(item || '').split(','))
+    .map(item => item.trim())
+    .filter(Boolean)
+    .map(item => options.uppercase ? item.toUpperCase() : item);
+  return unique(items);
+}
+
 function saveResourceEntry(target, bucket, code, extra = {}) {
   saveStateResource(target, bucket, code, pickStateFields(extra, ['formUuid']), [
     'formUuid',

package/openxiangda-skills/references/component-guide.md

@@ -81,6 +81,8 @@ import {
 <AttachmentField name="ossFiles" label="OSS 附件" uploadProvider="oss" storageCode="evaluate_oss" />
 ```
 
+OSS 浏览器直传所需的 CORS 规则在 `src/resources/storage/<code>.json` 的 `configJson.cors.managed` 中声明，不要把 bucket 配置写进组件 props。
+
 > ✅ 一句话原则：**这些场景看到了，直接抄上表，不要自己写。**
 
 ---

package/openxiangda-skills/references/forms/component-registry.md

@@ -75,7 +75,7 @@ Rules:
 - For `CascadeDateField`, store a date range and document whether the value is inclusive.
 - For `UserSelectField` and `DepartmentSelectField`, do not invent user or department IDs. Use runtime/platform selection.
 - For `AttachmentField` and `ImageField`, do not hardcode OSS URLs in defaults unless the file has already been uploaded by platform tooling.
-- For custom OSS attachment upload, first declare a `src/resources/storage/<code>.json` resource, then set `uploadProvider: "oss"` and `storageCode: "<code>"` on `AttachmentField`. Never put OSS AK/SK values in schema, page code, or committed resource files.
+- For custom OSS attachment upload, first declare a `src/resources/storage/<code>.json` resource, optionally enable `configJson.cors.managed` for browser direct-upload CORS, then set `uploadProvider: "oss"` and `storageCode: "<code>"` on `AttachmentField`. Never put OSS AK/SK values in schema, page code, or committed resource files.
 - For `SubFormField`, use `columns` for child fields and keep child `fieldId` values stable within the subform.
 - `TextAreaField` is accepted by workspace tools and normalized to runtime `TextareaField`; prefer `TextAreaField` in OpenXiangda docs for readability.
 

package/openxiangda-skills/references/openxiangda-api.md

@@ -643,3 +643,71 @@ Requires Bearer token. Returns runtime bootstrap information for an existing cod
 ### GET `/apps/:appType/snapshot`
 
 Requires Bearer token. Returns app metadata, forms, menus, code page definitions, code page releases, and permission hints.
+
+## Storage Configs
+
+Storage config APIs manage application-level custom upload targets. The first provider is Aliyun OSS.
+
+### GET `/apps/:appType/storage-configs`
+
+Requires Bearer token and storage-config manage permission. Lists storage configs.
+
+### POST `/apps/:appType/storage-configs`
+
+Requires Bearer token and storage-config manage permission. Creates or upserts a storage config.
+
+Body:
+
+```json
+{
+  "code": "evaluate_oss",
+  "name": "Evaluate OSS",
+  "provider": "oss",
+  "status": "active",
+  "configJson": {
+    "region": "oss-cn-hangzhou",
+    "bucket": "evaluate-oss",
+    "publicBaseUrl": "https://evaluate-oss.oss-cn-hangzhou.aliyuncs.com",
+    "pathPrefix": "openxiangda/{{appType}}/{{yyyy}}/{{MM}}/{{dd}}",
+    "allowedExtensions": ["txt", "pdf", "png"],
+    "cors": {
+      "managed": true,
+      "allowedOrigins": ["https://yida.wisejob.cn"],
+      "allowedMethods": ["PUT", "GET", "HEAD"],
+      "allowedHeaders": ["content-type", "x-oss-*"],
+      "exposeHeaders": ["ETag", "x-oss-request-id"],
+      "maxAgeSeconds": 600
+    }
+  },
+  "credentials": {
+    "accessKeyId": "resolved at publish time",
+    "accessKeySecret": "resolved at publish time"
+  }
+}
+```
+
+When `configJson.cors.managed` is true, the backend attempts to merge the required OSS bucket CORS rule after saving the storage config. The response may include `corsStatus`; `applied: false` means the storage config was saved but the OSS credentials could not manage bucket CORS.
+
+### GET `/apps/:appType/storage-configs/:code`
+
+Requires Bearer token and storage-config manage permission. Returns the storage config with credential status only, never plaintext AK/SK.
+
+### PUT `/apps/:appType/storage-configs/:code`
+
+Requires Bearer token and storage-config manage permission. Updates the storage config. Omit `credentials` to keep the existing encrypted credentials.
+
+### DELETE `/apps/:appType/storage-configs/:code`
+
+Requires Bearer token and storage-config manage permission. Deletes the storage config metadata; it does not delete existing OSS objects.
+
+### POST `/apps/:appType/storage-configs/:code/cors/apply`
+
+Requires Bearer token and storage-config manage permission. Re-applies the declared managed CORS rule for an existing config.
+
+### POST `/apps/:appType/storage-configs/:code/uploads/initiate`
+
+Requires Bearer token. Creates a short-lived signed OSS upload URL for browser direct upload.
+
+### POST `/apps/:appType/storage-configs/:code/objects/delete`
+
+Requires Bearer token. Deletes an OSS object under the configured `pathPrefix`.

package/openxiangda-skills/references/resource-manifest-cheatsheet.md

@@ -155,7 +155,15 @@ await auth.phoneCodeLogin({ phone, code, challengeId: sent.challengeId });
     "publicBaseUrl": "https://evaluate-oss.oss-cn-hangzhou.aliyuncs.com",
     "pathPrefix": "openxiangda/{{appType}}/{{yyyy}}/{{MM}}/{{dd}}",
     "maxFileSizeMb": 20,
-    "allowedExtensions": ["txt", "pdf", "png"]
+    "allowedExtensions": ["txt", "pdf", "png"],
+    "cors": {
+      "managed": true,
+      "allowedOrigins": ["https://yida.wisejob.cn"],
+      "allowedMethods": ["PUT", "GET", "HEAD"],
+      "allowedHeaders": ["content-type", "x-oss-*"],
+      "exposeHeaders": ["ETag", "x-oss-request-id"],
+      "maxAgeSeconds": 600
+    }
   },
   "credentials": {
     "accessKeyId": "${APP_OSS_ACCESS_KEY_ID}",
@@ -177,6 +185,8 @@ await auth.phoneCodeLogin({ phone, code, challengeId: sent.challengeId });
 
 默认附件不配置 `uploadProvider`/`storageCode` 时仍走平台上传。OSS 附件保存真实 OSS URL；预览、下载、删除对象都通过 storage 配置对应的运行时接口处理。
 
+`configJson.cors.managed: true` 会在发布 storage 配置时顺便设置 OSS bucket CORS。后端会读取现有规则并合并，不覆盖其他系统规则；该操作需要 OSS 凭据具备 bucket CORS 管理权限。未声明 `cors.managed` 时不会修改 bucket 级配置。
+
 ## 1. Public Route — `src/resources/routes/<code>.json`
 
 新 React SPA 公开页使用 `/view/:appType/public/*`，不要再使用旧 `?publicAccess=guest`。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.119",
+  "version": "1.0.120",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {