openxiangda 1.0.122 → 1.0.124

package/openxiangda-skills/references/notifications.md

@@ -61,6 +61,27 @@ await sdk.notification.sendByType({
 });
 ```
 
+User-facing in-app message centers should read the platform inbox instead of
+creating app-specific message/log forms:
+
+```ts
+const inbox = await sdk.notification.listInbox({
+  page: 1,
+  limit: 20,
+  readStatus: "unread",
+});
+
+await sdk.notification.markRead(messageId);
+await sdk.notification.markAllRead();
+
+const unread = await sdk.notification.getUnreadCount();
+```
+
+Inbox APIs are app-scoped and only return the current logged-in user's `inapp`
+messages. Use `keyword`, `templateCode`, and `readStatus` for server-side
+filtering. Do not expose `/api/message/history` to normal users; it is an
+administrative send-history surface.
+
 CLI smoke tests:
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.122",
+  "version": "1.0.124",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {

package/packages/sdk/dist/runtime/index.cjs

@@ -2445,6 +2445,45 @@ var createPageSdk = (context) => {
         ...params,
         appType: resolveAppType(context, params.appType)
       }
+    }),
+    listInbox: (params = {}) => request({
+      path: buildOpenXiangdaAppPath(
+        context,
+        params.appType,
+        "/notifications/inbox"
+      ),
+      method: "get",
+      query: {
+        page: params.page,
+        limit: params.limit,
+        readStatus: params.readStatus,
+        keyword: params.keyword,
+        templateCode: params.templateCode
+      }
+    }),
+    getUnreadCount: (params = {}) => request({
+      path: buildOpenXiangdaAppPath(
+        context,
+        params.appType,
+        "/notifications/inbox/unread-count"
+      ),
+      method: "get"
+    }),
+    markRead: (messageId, params = {}) => request({
+      path: buildOpenXiangdaAppPath(
+        context,
+        params.appType,
+        `/notifications/inbox/${encodePathSegment(messageId)}/read`
+      ),
+      method: "post"
+    }),
+    markAllRead: (params = {}) => request({
+      path: buildOpenXiangdaAppPath(
+        context,
+        params.appType,
+        "/notifications/inbox/read-all"
+      ),
+      method: "post"
     })
   };
   const sdk = {
@@ -35317,10 +35356,18 @@ var OpenXiangdaProvider = ({
   const [accessToken, setAccessTokenState] = (0, import_react216.useState)(null);
   const accessTokenRef = (0, import_react216.useRef)(null);
   const setAccessToken = (0, import_react216.useCallback)(
-    (nextAccessToken) => {
+    (nextAccessToken, options = {}) => {
+      if (!nextAccessToken && options.clearIfToken && accessTokenRef.current?.token !== options.clearIfToken) {
+        return;
+      }
       const normalizedAccessToken = nextAccessToken || null;
-      accessTokenRef.current = normalizedAccessToken;
-      setAccessTokenState(normalizedAccessToken);
+      const nextState = normalizedAccessToken ? {
+        token: normalizedAccessToken,
+        scope: options.scope || "default",
+        path: options.path || null
+      } : null;
+      accessTokenRef.current = nextState;
+      setAccessTokenState(nextState);
     },
     []
   );
@@ -35346,7 +35393,13 @@ var OpenXiangdaProvider = ({
       return;
     }
     setState((prev) => ({ ...prev, loading: true, error: null }));
-    const requestFetch = options.accessToken !== void 0 ? createAuthorizedFetch(resolvedFetch, options.accessToken || null) : createAuthorizedFetch(resolvedFetch, accessTokenRef.current);
+    const requestFetch = options.accessToken !== void 0 ? createAuthorizedFetch(
+      resolvedFetch,
+      createAccessTokenState(
+        options.accessToken || null,
+        options.accessTokenOptions
+      )
+    ) : createAuthorizedFetch(resolvedFetch, accessTokenRef.current);
     try {
       const response = await requestFetch(
         buildServiceUrl3(
@@ -35756,9 +35809,11 @@ var buildServiceUrl3 = (servicePrefix, path) => {
 var createAuthorizedFetch = (baseFetch, accessToken) => {
   if (!accessToken) return baseFetch;
   return ((input, init = {}) => {
+    const token = resolveAccessTokenForCurrentRoute(accessToken);
+    if (!token) return baseFetch(input, init);
     const headers = new Headers(init.headers || {});
     if (!headers.has("authorization")) {
-      headers.set("authorization", `Bearer ${accessToken}`);
+      headers.set("authorization", `Bearer ${token}`);
     }
     return baseFetch(input, {
       ...init,
@@ -35766,6 +35821,34 @@ var createAuthorizedFetch = (baseFetch, accessToken) => {
     });
   });
 };
+var createAccessTokenState = (accessToken, options = {}) => accessToken ? {
+  token: accessToken,
+  scope: options.scope || "default",
+  path: options.path || null
+} : null;
+var resolveAccessTokenForCurrentRoute = (accessToken) => {
+  if (accessToken.scope !== "public") return accessToken.token;
+  const scopedPath = normalizeRoutePath(accessToken.path);
+  const currentPath = normalizeRoutePath(getCurrentPathname2());
+  if (!scopedPath) {
+    return isPublicRoutePath(currentPath) ? accessToken.token : null;
+  }
+  if (currentPath === scopedPath || isPublicRoutePath(currentPath) && currentPath.startsWith(`${scopedPath}/`)) {
+    return accessToken.token;
+  }
+  return null;
+};
+var normalizeRoutePath = (path) => {
+  const text = String(path || "").trim();
+  if (!text) return "";
+  try {
+    const base = typeof window !== "undefined" ? window.location.origin : "http://localhost";
+    return new URL(text, base).pathname.replace(/\/+$/, "") || "/";
+  } catch {
+    return text.split(/[?#]/, 1)[0].replace(/\/+$/, "") || "/";
+  }
+};
+var isPublicRoutePath = (path) => /\/public(?:\/|$)/.test(path);
 var readJsonPayload = async (response) => {
   try {
     return await response.json();
@@ -35866,6 +35949,7 @@ var attachCallback = (loginUrl, callback) => {
   }
 };
 var getCurrentHref4 = () => typeof window === "undefined" ? "" : window.location.href;
+var getCurrentPathname2 = () => typeof window === "undefined" ? "" : window.location.pathname;
 var getCurrentHostname2 = () => typeof window === "undefined" ? "" : window.location.hostname;
 var getRuntimeEnv = (key) => {
   const env = typeof process !== "undefined" ? process.env : void 0;
@@ -35958,6 +36042,8 @@ var usePublicAccess = (options = {}) => {
   const [session, setSession] = (0, import_react217.useState)(null);
   const [error, setError] = (0, import_react217.useState)(null);
   const [loading, setLoading] = (0, import_react217.useState)(Boolean(autoStart));
+  const activeSessionRef = (0, import_react217.useRef)(null);
+  const mountedRef = (0, import_react217.useRef)(true);
   const sessionInputKey = JSON.stringify(sessionInput);
   const stableSessionInput = (0, import_react217.useMemo)(() => sessionInput, [sessionInputKey]);
   const client = (0, import_react217.useMemo)(
@@ -35973,15 +36059,31 @@ var usePublicAccess = (options = {}) => {
       setLoading(true);
       setError(null);
       try {
+        const resolvedPath = input.path || stableSessionInput.path || readPathFromLocation();
         const data = await client.startSession({
           ...stableSessionInput,
           ...input,
           ticket: input.ticket || stableSessionInput.ticket || readTicketFromLocation(),
-          path: input.path || stableSessionInput.path || readPathFromLocation()
+          path: resolvedPath
         });
+        if (!mountedRef.current) return data;
+        activeSessionRef.current = {
+          accessToken: data.accessToken,
+          path: resolvedPath
+        };
         setSession(data);
-        setAccessToken(data.accessToken);
-        await reloadRuntime({ accessToken: data.accessToken });
+        setAccessToken(data.accessToken, {
+          scope: "public",
+          path: resolvedPath
+        });
+        await reloadRuntime({
+          accessToken: data.accessToken,
+          accessTokenOptions: {
+            scope: "public",
+            path: resolvedPath
+          }
+        });
+        if (!mountedRef.current) return data;
         setLoading(false);
         return data;
       } catch (caught) {
@@ -35989,8 +36091,10 @@ var usePublicAccess = (options = {}) => {
           caught instanceof Error ? caught.message : "\u516C\u5F00\u8BBF\u95EE\u4F1A\u8BDD\u521B\u5EFA\u5931\u8D25",
           { payload: caught }
         );
-        setError(nextError);
-        setLoading(false);
+        if (mountedRef.current) {
+          setError(nextError);
+          setLoading(false);
+        }
         throw nextError;
       }
     },
@@ -36000,6 +36104,20 @@ var usePublicAccess = (options = {}) => {
     if (!autoStart) return;
     void startSession().catch(() => void 0);
   }, [autoStart, startSession]);
+  (0, import_react217.useEffect)(
+    () => {
+      mountedRef.current = true;
+      return () => {
+        mountedRef.current = false;
+        const activeSession = activeSessionRef.current;
+        if (!activeSession) return;
+        activeSessionRef.current = null;
+        setAccessToken(null, { clearIfToken: activeSession.accessToken });
+        void reloadRuntime({ accessToken: null });
+      };
+    },
+    [reloadRuntime, setAccessToken]
+  );
   return {
     loading,
     error,