openxiangda 1.0.141 → 1.0.142

package/README.md

@@ -123,6 +123,8 @@ openxiangda permission audit --json
 
 调用和测试类命令会检查 JSON envelope。HTTP 200 但 `code: "PUBLIC_GRANT_DENIED"`、`success: false` 或其他字符串业务错误码会被当作失败。
 
+角色资源里的 `apiPermissionCodes` 依赖平台端已存在的 API 权限点。比如校区管理员需要维护应用角色时，manifest 应声明 `app:role:manage`；如果 `resource publish` 提示缺少这个权限点，说明当前平台租户的 `api_permissions` seed 不完整，通常是平台版本未包含 seed、服务启动 seed 没跑成功，或租户创建在 seed 之后。处理方式是升级/重启平台并补齐权限点 seed，或由平台管理员补入 `app:role:manage`、`app:page-permission-group:manage`、`app:form-permission-group:manage` 等应用级权限点；不要为了通过发布删除 manifest 里的权限声明。
+
 Codex skills are installed separately from login/profile state. Run `openxiangda skill install` after installing or linking the CLI. It installs the `openxiangda` root skill plus the 8 top-level subskills into `${CODEX_HOME:-~/.codex}/skills` by default:
 
 - `openxiangda`
@@ -228,10 +230,47 @@ const affiliatedDepartmentExternalId = user?.affiliatedDepartment?.externalId
 
 工程化资源放在工作区 `src/resources/` 下，由 `openxiangda resource validate|plan|publish|pull` 管理。`workspace publish` 会先构建并注册 workspace 表单/页面，再执行非破坏性资源 upsert，这样菜单、权限组、流程和表单设置可以解析最新的 profile-local ID。需要删除平台中 manifest 未声明的资源时，显式传 `--prune`。连接器页面运行时通过 `sdk.connector.invoke()` / `sdk.connector.call("connector.api")` 调用平台运行时接口，第三方密钥只保存在后端连接器配置中。
 
-React SPA 新应用的无需登录访问统一使用 `/view/:appType/public/*`。应用在 `src/resources/routes/*.json` 声明公开路由，在 `src/resources/public-access/*.json` 声明公开策略、外部角色和可访问资源 grant，页面用 `PublicAccessGate` 或 `createPublicAccessClient` 创建 scoped public session。React SPA 路由树必须在 `OpenXiangdaProvider` 内再包一层 `OpenXiangdaPageProvider`；页面只要调用 `usePageSdk()`、`usePageContext()`、`useDataSource()` 等 Page SDK hooks，就依赖这层 provider。公开 guest 的 form、dataView、function、connector 默认全部拒绝，只有 policy `grants` 明确列出的资源可访问，并且仍受对应表单权限组、dataView 权限组等后端权限控制。
+React SPA 新应用的无需登录访问统一使用 `/view/:appType/public/*`。应用在 `src/resources/routes/*.json` 声明公开路由，在 `src/resources/public-access/*.json` 声明公开策略、外部角色和可访问资源 grant，页面用 `PublicAccessGate` 或 `createPublicAccessClient` 创建 scoped public session。React SPA 路由树必须在 `OpenXiangdaProvider` 内再包一层 `OpenXiangdaPageProvider`；页面只要调用 `usePageSdk()`、`usePageContext()`、`useDataSource()` 等 Page SDK hooks，就依赖这层 provider。公开 guest 的 form、dataView、function、connector、storage 默认全部拒绝，只有 policy `grants` 明确列出的资源可访问，并且仍受对应表单权限组、dataView 权限组、storage grant 等后端权限控制。
 
 `mode: "ticket"` 的公开策略默认按单次 ticket 使用；只有明确配置 `ticketConfig.singleUse: false` 时才允许复用。新 public session 只返回 bearer token，SDK 会把 token 注入后续 runtime/bootstrap、dataView、function、connector 请求，不依赖认证 cookie。
 
+公开页上传图片或附件时，不要放开游客全局 `/service/file/upload`。在 public-access policy 的 `grants.storage` 中声明 bucket、动作、MIME、扩展名、大小、visibility 和 `pathPrefix`，`ImageField` / `AttachmentField` 会通过 `OpenXiangdaProvider` 注入的 public token 调用上传接口。服务端会生成 objectName，前端不要传入路径；私有文件预览/下载通过 access ticket，不直接暴露对象地址。安全默认值是：公开报名、公开采集等场景上传到私有 bucket，按公开会话授权短时预览或下载。
+
+```json
+{
+  "grants": {
+    "storage": [
+      {
+        "bucketName": "images",
+        "actions": ["upload", "preview"],
+        "allowedMimeTypes": ["image/jpeg", "image/png", "image/webp"],
+        "allowedExtensions": ["jpg", "jpeg", "png", "webp"],
+        "maxSizeBytes": 15728640,
+        "visibility": "private",
+        "pathPrefix": "public/register/images/"
+      },
+      {
+        "bucketName": "attachments",
+        "actions": ["upload", "preview", "download"],
+        "allowedMimeTypes": [
+          "application/pdf",
+          "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+          "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+          "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+          "text/plain",
+          "text/csv",
+          "application/json"
+        ],
+        "allowedExtensions": ["pdf", "docx", "xlsx", "pptx", "txt", "csv", "json"],
+        "maxSizeBytes": 31457280,
+        "visibility": "private",
+        "pathPrefix": "public/register/attachments/"
+      }
+    ]
+  }
+}
+```
+
 公开访问和测试脚本不能只判断 HTTP 状态。平台部分运行时接口可能返回 HTTP 200，同时在 JSON envelope 中返回业务错误码，例如 `code: "PUBLIC_GRANT_DENIED"`。只有 `code` 为 `200`、`"200"` 或兼容成功码 `0` 时才算成功；字符串错误码、`success: false` 或非 2xx HTTP 都必须当作失败。
 
 旧 `?publicAccess=guest` 和表单 `settings/forms/*.json` 里的 `publicAccess` 只用于旧 `sy-lowcode-view` 兼容。新 React SPA 应用不要再设计或生成这种链接。
@@ -280,7 +319,18 @@ import { ImageField } from "openxiangda"
     "forms": ["registration_form"],
     "dataViews": ["public_registration_lookup"],
     "functions": ["submit_public_registration"],
-    "connectors": ["sms.sendCode"]
+    "connectors": ["sms.sendCode"],
+    "storage": [
+      {
+        "bucketName": "images",
+        "actions": ["upload", "preview"],
+        "allowedMimeTypes": ["image/jpeg", "image/png", "image/webp"],
+        "allowedExtensions": ["jpg", "jpeg", "png", "webp"],
+        "maxSizeBytes": 15728640,
+        "visibility": "private",
+        "pathPrefix": "public/register/images/"
+      }
+    ]
   }
 }
 ```

package/lib/cli.js

@@ -5861,17 +5861,64 @@ function buildPublicGrantChecks(bound, grants, flags = {}) {
   for (const code of splitList(flags.connector || flags['connector-code'])) {
     checks.push({ type: 'connector', code, allowed: (grants.connectors || []).includes(code) });
   }
+  const storageGrants = Array.isArray(grants.storage) ? grants.storage : [];
+  for (const bucketName of splitList(flags['storage-bucket'] || flags.bucket)) {
+    const action = String(flags['storage-action'] || flags.action || 'upload').trim();
+    const extension = String(flags.extension || flags.ext || '').replace(/^\./, '').toLowerCase();
+    const mimeType = String(flags.mime || flags['mime-type'] || '').trim().toLowerCase();
+    const visibility = String(flags.visibility || '').trim();
+    const size = Number(flags.size || flags['size-bytes'] || 0);
+    checks.push({
+      type: 'storage',
+      bucketName,
+      action,
+      allowed: storageGrants.some(grant =>
+        publicStorageGrantAllows(grant, {
+          bucketName,
+          action,
+          extension,
+          mimeType,
+          visibility,
+          size,
+        })
+      ),
+    });
+  }
   if (checks.length === 0) {
     return [
       { type: 'forms', granted: grants.forms || [], allowed: true },
       { type: 'dataViews', granted: grants.dataViews || [], allowed: true },
       { type: 'functions', granted: grants.functions || [], allowed: true },
       { type: 'connectors', granted: grants.connectors || [], allowed: true },
+      { type: 'storage', granted: storageGrants, allowed: true },
     ];
   }
   return checks;
 }
 
+function publicStorageGrantAllows(grant, input) {
+  if (!grant || grant.bucketName !== input.bucketName) return false;
+  const actions = Array.isArray(grant.actions) ? grant.actions : [];
+  if (!actions.includes(input.action)) return false;
+  if (input.visibility && String(grant.visibility || 'private') !== input.visibility) return false;
+  if (input.size > 0 && Number(grant.maxSizeBytes || 0) > 0 && input.size > Number(grant.maxSizeBytes)) {
+    return false;
+  }
+  if (input.extension) {
+    const extensions = (grant.allowedExtensions || []).map(value =>
+      String(value || '').replace(/^\./, '').toLowerCase()
+    );
+    if (!extensions.includes(input.extension)) return false;
+  }
+  if (input.mimeType) {
+    const mimeTypes = (grant.allowedMimeTypes || []).map(value =>
+      String(value || '').trim().toLowerCase()
+    );
+    if (!mimeTypes.includes(input.mimeType)) return false;
+  }
+  return true;
+}
+
 async function buildPermissionAudit(config, target, flags = {}) {
   const manifest = loadWorkspaceResources();
   const validation = validateWorkspaceResources(manifest);
@@ -10682,9 +10729,51 @@ function normalizePublicAccessGrants(bound, grants = {}) {
     dataViews: normalizePermissionCodeArray(grants.dataViews),
     functions: normalizePermissionCodeArray(grants.functions),
     connectors: normalizePermissionCodeArray(grants.connectors),
+    storage: normalizePublicStorageGrants(grants.storage),
   });
 }
 
+function normalizePublicStorageGrants(storage = []) {
+  if (!Array.isArray(storage)) return [];
+  return storage
+    .map(item => {
+      const bucketName = String(item?.bucketName || '').trim();
+      if (!bucketName) return null;
+      return stripUndefinedValues({
+        bucketName,
+        actions: normalizePublicStorageActions(item.actions),
+        allowedMimeTypes: normalizePermissionCodeArray(item.allowedMimeTypes).map(value =>
+          value.toLowerCase()
+        ),
+        allowedExtensions: normalizePermissionCodeArray(item.allowedExtensions).map(value =>
+          value.replace(/^\./, '').toLowerCase()
+        ),
+        maxSizeBytes: normalizePublicStoragePositiveInteger(item.maxSizeBytes),
+        visibility: String(item.visibility || '').trim() === 'public' ? 'public' : 'private',
+        pathPrefix: normalizePublicStoragePathPrefix(item.pathPrefix),
+      });
+    })
+    .filter(Boolean);
+}
+
+function normalizePublicStorageActions(actions) {
+  const allowed = new Set(['upload', 'preview', 'download']);
+  const normalized = normalizePermissionCodeArray(actions).filter(action => allowed.has(action));
+  return normalized.length > 0 ? unique(normalized) : ['upload'];
+}
+
+function normalizePublicStoragePositiveInteger(value) {
+  const numeric = Number(value);
+  if (!Number.isFinite(numeric) || numeric <= 0) return undefined;
+  return Math.floor(numeric);
+}
+
+function normalizePublicStoragePathPrefix(value) {
+  const normalized = String(value || '').trim().replace(/^\/+/, '');
+  if (!normalized) return undefined;
+  return normalized.endsWith('/') ? normalized : `${normalized}/`;
+}
+
 function normalizeAuthConfigManifest(authConfig) {
   const code = authConfig.code || authConfig.resourceCode || 'default';
   const configJson = clonePlainJson(

package/lib/design-gates.js

@@ -459,12 +459,41 @@ const RESOURCE_EXPLAINS = {
         dataViews: ['public_lookup'],
         functions: [],
         connectors: [],
+        storage: [
+          {
+            bucketName: 'images',
+            actions: ['upload', 'preview'],
+            allowedMimeTypes: ['image/jpeg', 'image/png', 'image/webp'],
+            allowedExtensions: ['jpg', 'jpeg', 'png', 'webp'],
+            maxSizeBytes: 15728640,
+            visibility: 'private',
+            pathPrefix: 'public/register/images/',
+          },
+          {
+            bucketName: 'attachments',
+            actions: ['upload', 'preview', 'download'],
+            allowedMimeTypes: [
+              'application/pdf',
+              'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+              'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+              'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+              'text/plain',
+              'text/csv',
+              'application/json',
+            ],
+            allowedExtensions: ['pdf', 'docx', 'xlsx', 'pptx', 'txt', 'csv', 'json'],
+            maxSizeBytes: 31457280,
+            visibility: 'private',
+            pathPrefix: 'public/register/attachments/',
+          },
+        ],
       },
     },
     commands: [
       'openxiangda public-access upsert --json-file src/resources/public-access/public_register.json',
       'openxiangda public-access session-test public_register --path /view/APP_XXX/public/register',
       'openxiangda public-access grant-check public_register --form-code customer',
+      '公开页 ImageField/AttachmentField 上传走 public session bearer token；storage grant 按 bucket/action/MIME/ext/size/visibility/pathPrefix 限制。',
       'React 页面侧使用 PublicAccessGate；如果使用 Page SDK hooks，放在 OpenXiangdaProvider + OpenXiangdaPageProvider 内',
     ],
   },

package/openxiangda-skills/SKILL.md

@@ -50,7 +50,7 @@ OpenXiangda supports two workspace modes. Classic `sy-lowcode-app-workspace` pub
 - ✅ Run `openxiangda update check --json` at the start of substantial work; if `updateAvailable`, run `openxiangda update install` and `openxiangda skill install --force`.
 - ✅ For non-trivial app requirements, run the architecture design gate first: forms, fields, pages, permissions, data views, status/workflow, automation, notifications, and development tasks must be decided before coding.
 - ✅ For app login/auth requirements, run the auth security gate before coding: enabled methods, registration policy, identity matching keys, provider boundary, default roles, rate limits, audit fields, and third-party ownership must be confirmed.
-- ✅ For public/no-login access requirements, run the public access design gate before coding: public routes, external role codes, guest vs ticket, form/dataView/function/connector grants, backend permission groups, and visible loading/error fallback states must be confirmed. New React SPA apps use `/view/:appType/public/*`, `src/resources/routes/`, `src/resources/public-access/`, and `PublicAccessGate`; route children that use Page SDK hooks must be inside `OpenXiangdaProvider` + `OpenXiangdaPageProvider`.
+- ✅ For public/no-login access requirements, run the public access design gate before coding: public routes, external role codes, guest vs ticket, form/dataView/function/connector/storage grants, backend permission groups, and visible loading/error fallback states must be confirmed. New React SPA apps use `/view/:appType/public/*`, `src/resources/routes/`, `src/resources/public-access/`, and `PublicAccessGate`; route children that use Page SDK hooks must be inside `OpenXiangdaProvider` + `OpenXiangdaPageProvider`.
 - ✅ For account/role/permission/data-scope/query-param authorization requirements, run `openxiangda design gates --topic permissions --json` before coding. Pick one mode from `managed-platform-account`, `existing-platform-user-assignment`, `static-role-permission`, or `query-param-context`, write the permission matrix, and use roles/page-groups/form-groups/App Functions for real enforcement.
 - ✅ Public/no-login validation must inspect the JSON envelope, not only HTTP status. HTTP 200 with `code: "PUBLIC_GRANT_DENIED"` is a denied request; success requires `code` `200`, `"200"`, or compatible `0`, and no `success: false`.
 - ✅ Use first-class resource CLI commands for discovery, diagnosis, and small live fixes: `route`, `public-access`, `auth-config`, `function`, `connector`, `notification`, `organization`, `data-view`, `menu`, and `permission`. For multi-resource formal development, still prefer `src/resources/**` + `openxiangda resource validate|plan|publish`. If a direct CLI write is intentionally used, add `--write-manifest` when the repository should stay the source of truth.
@@ -151,6 +151,7 @@ When the user provides a root domain such as `https://yida.wisejob.cn/`, use it
 - Never store token data in the project directory. User tokens live in `~/.openxiangda/profiles.json`; project state lives in `.openxiangda/state.json` and stores only IDs and mappings.
 - Shared workspace env values such as `APP_OSS_*` should live in `~/.openxiangda/.env` by default. Project `.env` files are only per-workspace overrides.
 - For custom OSS image or attachment upload, declare `src/resources/storage/<code>.json`, then set `uploadProvider: "oss"` and `storageCode` on `AttachmentField` or `ImageField`. If `imageCompression` outputs `webp` or another explicit format, include that extension in storage `allowedExtensions`.
+- For public/no-login image or attachment uploads, declare `grants.storage` in `src/resources/public-access/<code>.json`; do not open `/service/file/upload` globally. Use conservative private bucket grants by default, with explicit bucket, actions, MIME types, extensions, max size, visibility, and pathPrefix. `ImageField` / `AttachmentField` uploads inside `PublicAccessGate` use the public session bearer token injected by `OpenXiangdaProvider`.
 - For suspected platform defects, bugs, missing capabilities, unclear design rules, repeated workarounds, AI uncertainty, or product optimization requests, proactively run `openxiangda feedback submit --yes` with a concise summary and detailed description. Include the command, error, relevant files, and logs/context files when available. If robot env is missing or submission fails, run/record `openxiangda feedback preview` and tell the user what could not be sent. After successful submission, tell the user what was reported and include the feedback fingerprint. The CLI redacts tokens, cookies, secrets, phone numbers, and emails before sending.
 - For form pages, every visible field should have a concise user-facing `placeholder`. Use `tips` only for special constraints or non-obvious business rules; do not add tips to every field.
 - Form pages should display only fields the user needs to see. Use `SelectField` / `RadioField` for enums. For data maintained by another form, such as class, college, customer, or project, use `SelectField` with `optionSource.type: "linkedForm"` so the runtime queries form data through the SDK and builds dropdown options; set `remoteSearch: true` and an explicit `searchFieldId` when the source data can be large. Do not make users maintain raw ID text fields, and do not use `AssociationFormField` for new form work.
@@ -165,6 +166,7 @@ When the user provides a root domain such as `https://yida.wisejob.cn/`, use it
 - For app-managed platform departments/accounts, use `sdk.organization.departments.*`, `sdk.organization.accounts.*`, `ctx.organization.departments.*`, or `ctx.organization.accounts.*`. The real current user/audit actor must hold `app:organization:manage` on the app; runtime service principals do not bypass this permission. Do not call legacy `/user` or `/department` write endpoints from apps. Do not include `password` in account updates; reset target accounts with `resetPassword`, and change the current user's password with `changeMyPassword({ oldPassword, newPassword })`.
 - For account, role, data-scope, organization-account, RBAC, or query-param authorization designs, read `references/permission-design-patterns.md` and choose a permission mode before writing forms/pages/resources. Formal backends should use platform roles, page permission groups, form permission groups, public-access grants, and App Function role/scope checks; frontend hiding is display only.
 - When a role such as 校区管理员 will create app roles, assign role members, grant role permissions, maintain permission groups, or manage organization accounts, its role manifest must declare the needed `apiPermissionCodes` such as `app:role:manage`, `app:page-permission-group:manage`, `app:form-permission-group:manage`, and `app:organization:manage`. If that administrator creates another administrator role, the new role must also declare its own `apiPermissionCodes`; permissions are not inherited from the creator.
+- If `resource publish` reports a missing API permission point such as `app:role:manage`, treat it as a platform seed/data problem. The platform tenant must have the permission code in `api_permissions`; do not remove the role manifest permission just to make publish pass.
 - For application login, declare auth resources in `src/resources/auth/<code>.json` and publish them with `openxiangda resource publish`. App Function auth providers may validate external credentials and return only an identity assertion; they must never issue tokens, set cookies, or write platform user/binding tables directly. The platform auth service decides create/bind/reject and issues tokens.
 - For external/no-login pages in React SPA apps, declare `src/resources/routes/<code>.json` and `src/resources/public-access/<code>.json`, put the page under `/view/:appType/public/*`, and use `PublicAccessGate` or `createPublicAccessClient`. The route tree must also include `OpenXiangdaPageProvider` inside `OpenXiangdaProvider` before any `usePageSdk()` / `usePageContext()` / `useDataSource()` call; otherwise pages throw `usePageSdkStore 必须在 PageProvider 内使用`. Always provide `fallback` and `errorFallback` for public routes so slow networks, missing tickets, or expired tickets do not render blank pages. Public guest access to forms, dataViews, functions, and connectors is denied unless policy `grants` explicitly names the resource; backend permission groups still apply.
 - When verifying public access, parse the response body and reject string business errors such as `PUBLIC_GRANT_DENIED` even if the HTTP status is 200. Do not use `response.ok` alone as the success condition.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.141",
+  "version": "1.0.142",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {

package/packages/sdk/dist/{ProcessPreview-CsOTCTRT.d.mts → ProcessPreview-CUQFUDvw.d.mts}

@@ -248,9 +248,10 @@ interface RuntimeRequestConfig {
     method?: string;
     params?: Record<string, any>;
     data?: any;
-    headers?: Record<string, string>;
+    headers?: HeadersInit;
     responseType?: 'json' | 'blob';
 }
+type RuntimeAuthHeadersProvider = () => HeadersInit | undefined;
 type RuntimeUploadProvider = 'platform' | 'oss' | 'builtin-oss';
 interface RuntimeUploadOptions {
     uploadProvider?: RuntimeUploadProvider;
@@ -293,6 +294,8 @@ interface FormRuntimeApi {
 }
 type FormRuntimeApiConfig = Partial<FormRuntimeApi> & {
     baseUrl?: string;
+    fetchImpl?: typeof fetch;
+    getAuthHeaders?: RuntimeAuthHeadersProvider;
 };
 /** 表单引擎配置 */
 interface FormEngineConfig {
@@ -1171,4 +1174,4 @@ interface ProcessPreviewProps {
 }
 declare const ProcessPreview: React__default.FC<ProcessPreviewProps>;
 
-export { type DepartmentSelectFieldProps as $, type ApprovalPermission as A, type ReturnParams as B, type ChangeRecordQueryParams as C, type SaveTaskParams as D, type TransferParams as E, type FieldDefinition as F, type TextFieldProps as G, type TextAreaFieldProps as H, type InitiatorSelectCandidate as I, type SelectFieldProps as J, type RadioFieldProps as K, type CheckboxFieldProps as L, type MultiSelectFieldProps as M, type NumberFieldProps as N, type OptionItem as O, type ProcessStatus as P, type DateFieldProps as Q, type RuntimeResponse as R, type StatusMeta as S, type TaskStatus as T, type CascadeDateFieldProps as U, type ValidationPreset as V, type WithdrawParams as W, type AttachmentFieldProps as X, type ImageFieldProps as Y, type SubFormFieldProps as Z, type UserSelectFieldProps as _, type FormRuntimeApi as a, ProcessPreview as a$, type CascadeSelectFieldProps as a0, type AddressFieldProps as a1, type AssociationFormFieldProps as a2, type EditorFieldProps as a3, type EditorChoiceOption as a4, type SerialNumberFieldProps as a5, type LocationFieldProps as a6, type DigitalSignatureFieldProps as a7, type JSONFieldProps as a8, type ProcessAction as a9, type FieldLayoutNode as aA, type FieldValueSyncConfig as aB, type FormEffectAction as aC, type FormEffectCondition as aD, type FormEffectConditionOperator as aE, type FormEngineMode as aF, type FormLayoutNode as aG, FormSection as aH, type FormSectionProps as aI, type FormSubmitBehavior as aJ, type FormTemplateConfig as aK, type GridLayoutCell as aL, type GridLayoutNode as aM, type ImageCompressionConfig as aN, type ImageCompressionVariantConfig as aO, type ImageVariant as aP, type InitiatorSelectScope as aQ, type LayoutVisibleWhen as aR, type LinkedFormOptionConfig as aS, type LocationValue as aT, type LowcodePageMeta as aU, type LowcodePageNode as aV, type LowcodePageNodeType as aW, type OptionSourceType as aX, type PeopleShortcutConfig as aY, type PeopleShortcutType as aZ, type ProcessNodeType as a_, type InitiatorSelectedApprovers as aa, type ReturnPolicy as ab, type ChangeRecord as ac, type StandardFormPageMode as ad, type LowcodePageSchema as ae, type AddressValue as af, type ApprovalActionType as ag, ApprovalTimeline as ah, type ApprovalTimelineProps as ai, type AssociationFormConfig as aj, type AssociationValue as ak, type AttachmentImageVariants as al, type AttachmentItem as am, type BaseFieldProps as an, type BaseLayoutNode as ao, type DataFilter as ap, type DataLinkageCondition as aq, type DataLinkageConfig as ar, type DateRangeRestriction as as, type DateRestrictionConfig as at, type DateShortcutConfig as au, type DateShortcutType as av, type DefaultValueLinkageConfig as aw, type DepartmentTreeNode as ax, type DigitalSignatureValue as ay, type EditorToolbarAction as az, type FormSchema as b, type ProcessPreviewProps as b0, type RuntimeDataQueryParams as b1, type RuntimeDataQueryResult as b2, type RuntimeRequestConfig as b3, type RuntimeUploadOptions as b4, type RuntimeUploadProvider as b5, type SectionLayoutNode as b6, type SignaturePoint as b7, type StepLayoutItem as b8, type StepsLayoutNode as b9, type SubFormColumn as ba, type TabLayoutItem as bb, type TabsLayoutNode as bc, type TextShortcutConfig as bd, type TextShortcutType as be, type UserDisplayFormat as bf, type UserItem as bg, type FormRuntimeApiConfig as c, type FormEngineConfig as d, type FieldBehavior as e, type FormRuntimeConfig as f, type FormAppearanceConfig as g, type ValidationRule as h, type FormEffect as i, type OptionSourceConfig as j, type FormDataDeleteParams as k, type ChangeRecordListResponse as l, type FormDataQueryParams as m, type FormInstanceData as n, type InitiatorSelectRequirement as o, type ProcessBasicInfo as p, type ProcessDefinition as q, type ProcessTask as r, type ReturnableNodeResult as s, type ReturnableNode as t, type ViewPermissionQueryParams as u, type ViewPermissionSummary as v, type ApproveParams as w, type PreviewParams as x, type ProcessRoute as y, type ResubmitParams as z };
+export { type DepartmentSelectFieldProps as $, type ApprovalPermission as A, type ReturnParams as B, type ChangeRecordQueryParams as C, type SaveTaskParams as D, type TransferParams as E, type FieldDefinition as F, type TextFieldProps as G, type TextAreaFieldProps as H, type InitiatorSelectCandidate as I, type SelectFieldProps as J, type RadioFieldProps as K, type CheckboxFieldProps as L, type MultiSelectFieldProps as M, type NumberFieldProps as N, type OptionItem as O, type ProcessStatus as P, type DateFieldProps as Q, type RuntimeResponse as R, type StatusMeta as S, type TaskStatus as T, type CascadeDateFieldProps as U, type ValidationPreset as V, type WithdrawParams as W, type AttachmentFieldProps as X, type ImageFieldProps as Y, type SubFormFieldProps as Z, type UserSelectFieldProps as _, type FormRuntimeApi as a, ProcessPreview as a$, type CascadeSelectFieldProps as a0, type AddressFieldProps as a1, type AssociationFormFieldProps as a2, type EditorFieldProps as a3, type EditorChoiceOption as a4, type SerialNumberFieldProps as a5, type LocationFieldProps as a6, type DigitalSignatureFieldProps as a7, type JSONFieldProps as a8, type ProcessAction as a9, type FieldLayoutNode as aA, type FieldValueSyncConfig as aB, type FormEffectAction as aC, type FormEffectCondition as aD, type FormEffectConditionOperator as aE, type FormEngineMode as aF, type FormLayoutNode as aG, FormSection as aH, type FormSectionProps as aI, type FormSubmitBehavior as aJ, type FormTemplateConfig as aK, type GridLayoutCell as aL, type GridLayoutNode as aM, type ImageCompressionConfig as aN, type ImageCompressionVariantConfig as aO, type ImageVariant as aP, type InitiatorSelectScope as aQ, type LayoutVisibleWhen as aR, type LinkedFormOptionConfig as aS, type LocationValue as aT, type LowcodePageMeta as aU, type LowcodePageNode as aV, type LowcodePageNodeType as aW, type OptionSourceType as aX, type PeopleShortcutConfig as aY, type PeopleShortcutType as aZ, type ProcessNodeType as a_, type InitiatorSelectedApprovers as aa, type ReturnPolicy as ab, type ChangeRecord as ac, type StandardFormPageMode as ad, type LowcodePageSchema as ae, type AddressValue as af, type ApprovalActionType as ag, ApprovalTimeline as ah, type ApprovalTimelineProps as ai, type AssociationFormConfig as aj, type AssociationValue as ak, type AttachmentImageVariants as al, type AttachmentItem as am, type BaseFieldProps as an, type BaseLayoutNode as ao, type DataFilter as ap, type DataLinkageCondition as aq, type DataLinkageConfig as ar, type DateRangeRestriction as as, type DateRestrictionConfig as at, type DateShortcutConfig as au, type DateShortcutType as av, type DefaultValueLinkageConfig as aw, type DepartmentTreeNode as ax, type DigitalSignatureValue as ay, type EditorToolbarAction as az, type FormSchema as b, type ProcessPreviewProps as b0, type RuntimeAuthHeadersProvider as b1, type RuntimeDataQueryParams as b2, type RuntimeDataQueryResult as b3, type RuntimeRequestConfig as b4, type RuntimeUploadOptions as b5, type RuntimeUploadProvider as b6, type SectionLayoutNode as b7, type SignaturePoint as b8, type StepLayoutItem as b9, type StepsLayoutNode as ba, type SubFormColumn as bb, type TabLayoutItem as bc, type TabsLayoutNode as bd, type TextShortcutConfig as be, type TextShortcutType as bf, type UserDisplayFormat as bg, type UserItem as bh, type FormRuntimeApiConfig as c, type FormEngineConfig as d, type FieldBehavior as e, type FormRuntimeConfig as f, type FormAppearanceConfig as g, type ValidationRule as h, type FormEffect as i, type OptionSourceConfig as j, type FormDataDeleteParams as k, type ChangeRecordListResponse as l, type FormDataQueryParams as m, type FormInstanceData as n, type InitiatorSelectRequirement as o, type ProcessBasicInfo as p, type ProcessDefinition as q, type ProcessTask as r, type ReturnableNodeResult as s, type ReturnableNode as t, type ViewPermissionQueryParams as u, type ViewPermissionSummary as v, type ApproveParams as w, type PreviewParams as x, type ProcessRoute as y, type ResubmitParams as z };

package/packages/sdk/dist/{ProcessPreview-CsOTCTRT.d.ts → ProcessPreview-CUQFUDvw.d.ts}

@@ -248,9 +248,10 @@ interface RuntimeRequestConfig {
     method?: string;
     params?: Record<string, any>;
     data?: any;
-    headers?: Record<string, string>;
+    headers?: HeadersInit;
     responseType?: 'json' | 'blob';
 }
+type RuntimeAuthHeadersProvider = () => HeadersInit | undefined;
 type RuntimeUploadProvider = 'platform' | 'oss' | 'builtin-oss';
 interface RuntimeUploadOptions {
     uploadProvider?: RuntimeUploadProvider;
@@ -293,6 +294,8 @@ interface FormRuntimeApi {
 }
 type FormRuntimeApiConfig = Partial<FormRuntimeApi> & {
     baseUrl?: string;
+    fetchImpl?: typeof fetch;
+    getAuthHeaders?: RuntimeAuthHeadersProvider;
 };
 /** 表单引擎配置 */
 interface FormEngineConfig {
@@ -1171,4 +1174,4 @@ interface ProcessPreviewProps {
 }
 declare const ProcessPreview: React__default.FC<ProcessPreviewProps>;
 
-export { type DepartmentSelectFieldProps as $, type ApprovalPermission as A, type ReturnParams as B, type ChangeRecordQueryParams as C, type SaveTaskParams as D, type TransferParams as E, type FieldDefinition as F, type TextFieldProps as G, type TextAreaFieldProps as H, type InitiatorSelectCandidate as I, type SelectFieldProps as J, type RadioFieldProps as K, type CheckboxFieldProps as L, type MultiSelectFieldProps as M, type NumberFieldProps as N, type OptionItem as O, type ProcessStatus as P, type DateFieldProps as Q, type RuntimeResponse as R, type StatusMeta as S, type TaskStatus as T, type CascadeDateFieldProps as U, type ValidationPreset as V, type WithdrawParams as W, type AttachmentFieldProps as X, type ImageFieldProps as Y, type SubFormFieldProps as Z, type UserSelectFieldProps as _, type FormRuntimeApi as a, ProcessPreview as a$, type CascadeSelectFieldProps as a0, type AddressFieldProps as a1, type AssociationFormFieldProps as a2, type EditorFieldProps as a3, type EditorChoiceOption as a4, type SerialNumberFieldProps as a5, type LocationFieldProps as a6, type DigitalSignatureFieldProps as a7, type JSONFieldProps as a8, type ProcessAction as a9, type FieldLayoutNode as aA, type FieldValueSyncConfig as aB, type FormEffectAction as aC, type FormEffectCondition as aD, type FormEffectConditionOperator as aE, type FormEngineMode as aF, type FormLayoutNode as aG, FormSection as aH, type FormSectionProps as aI, type FormSubmitBehavior as aJ, type FormTemplateConfig as aK, type GridLayoutCell as aL, type GridLayoutNode as aM, type ImageCompressionConfig as aN, type ImageCompressionVariantConfig as aO, type ImageVariant as aP, type InitiatorSelectScope as aQ, type LayoutVisibleWhen as aR, type LinkedFormOptionConfig as aS, type LocationValue as aT, type LowcodePageMeta as aU, type LowcodePageNode as aV, type LowcodePageNodeType as aW, type OptionSourceType as aX, type PeopleShortcutConfig as aY, type PeopleShortcutType as aZ, type ProcessNodeType as a_, type InitiatorSelectedApprovers as aa, type ReturnPolicy as ab, type ChangeRecord as ac, type StandardFormPageMode as ad, type LowcodePageSchema as ae, type AddressValue as af, type ApprovalActionType as ag, ApprovalTimeline as ah, type ApprovalTimelineProps as ai, type AssociationFormConfig as aj, type AssociationValue as ak, type AttachmentImageVariants as al, type AttachmentItem as am, type BaseFieldProps as an, type BaseLayoutNode as ao, type DataFilter as ap, type DataLinkageCondition as aq, type DataLinkageConfig as ar, type DateRangeRestriction as as, type DateRestrictionConfig as at, type DateShortcutConfig as au, type DateShortcutType as av, type DefaultValueLinkageConfig as aw, type DepartmentTreeNode as ax, type DigitalSignatureValue as ay, type EditorToolbarAction as az, type FormSchema as b, type ProcessPreviewProps as b0, type RuntimeDataQueryParams as b1, type RuntimeDataQueryResult as b2, type RuntimeRequestConfig as b3, type RuntimeUploadOptions as b4, type RuntimeUploadProvider as b5, type SectionLayoutNode as b6, type SignaturePoint as b7, type StepLayoutItem as b8, type StepsLayoutNode as b9, type SubFormColumn as ba, type TabLayoutItem as bb, type TabsLayoutNode as bc, type TextShortcutConfig as bd, type TextShortcutType as be, type UserDisplayFormat as bf, type UserItem as bg, type FormRuntimeApiConfig as c, type FormEngineConfig as d, type FieldBehavior as e, type FormRuntimeConfig as f, type FormAppearanceConfig as g, type ValidationRule as h, type FormEffect as i, type OptionSourceConfig as j, type FormDataDeleteParams as k, type ChangeRecordListResponse as l, type FormDataQueryParams as m, type FormInstanceData as n, type InitiatorSelectRequirement as o, type ProcessBasicInfo as p, type ProcessDefinition as q, type ProcessTask as r, type ReturnableNodeResult as s, type ReturnableNode as t, type ViewPermissionQueryParams as u, type ViewPermissionSummary as v, type ApproveParams as w, type PreviewParams as x, type ProcessRoute as y, type ResubmitParams as z };
+export { type DepartmentSelectFieldProps as $, type ApprovalPermission as A, type ReturnParams as B, type ChangeRecordQueryParams as C, type SaveTaskParams as D, type TransferParams as E, type FieldDefinition as F, type TextFieldProps as G, type TextAreaFieldProps as H, type InitiatorSelectCandidate as I, type SelectFieldProps as J, type RadioFieldProps as K, type CheckboxFieldProps as L, type MultiSelectFieldProps as M, type NumberFieldProps as N, type OptionItem as O, type ProcessStatus as P, type DateFieldProps as Q, type RuntimeResponse as R, type StatusMeta as S, type TaskStatus as T, type CascadeDateFieldProps as U, type ValidationPreset as V, type WithdrawParams as W, type AttachmentFieldProps as X, type ImageFieldProps as Y, type SubFormFieldProps as Z, type UserSelectFieldProps as _, type FormRuntimeApi as a, ProcessPreview as a$, type CascadeSelectFieldProps as a0, type AddressFieldProps as a1, type AssociationFormFieldProps as a2, type EditorFieldProps as a3, type EditorChoiceOption as a4, type SerialNumberFieldProps as a5, type LocationFieldProps as a6, type DigitalSignatureFieldProps as a7, type JSONFieldProps as a8, type ProcessAction as a9, type FieldLayoutNode as aA, type FieldValueSyncConfig as aB, type FormEffectAction as aC, type FormEffectCondition as aD, type FormEffectConditionOperator as aE, type FormEngineMode as aF, type FormLayoutNode as aG, FormSection as aH, type FormSectionProps as aI, type FormSubmitBehavior as aJ, type FormTemplateConfig as aK, type GridLayoutCell as aL, type GridLayoutNode as aM, type ImageCompressionConfig as aN, type ImageCompressionVariantConfig as aO, type ImageVariant as aP, type InitiatorSelectScope as aQ, type LayoutVisibleWhen as aR, type LinkedFormOptionConfig as aS, type LocationValue as aT, type LowcodePageMeta as aU, type LowcodePageNode as aV, type LowcodePageNodeType as aW, type OptionSourceType as aX, type PeopleShortcutConfig as aY, type PeopleShortcutType as aZ, type ProcessNodeType as a_, type InitiatorSelectedApprovers as aa, type ReturnPolicy as ab, type ChangeRecord as ac, type StandardFormPageMode as ad, type LowcodePageSchema as ae, type AddressValue as af, type ApprovalActionType as ag, ApprovalTimeline as ah, type ApprovalTimelineProps as ai, type AssociationFormConfig as aj, type AssociationValue as ak, type AttachmentImageVariants as al, type AttachmentItem as am, type BaseFieldProps as an, type BaseLayoutNode as ao, type DataFilter as ap, type DataLinkageCondition as aq, type DataLinkageConfig as ar, type DateRangeRestriction as as, type DateRestrictionConfig as at, type DateShortcutConfig as au, type DateShortcutType as av, type DefaultValueLinkageConfig as aw, type DepartmentTreeNode as ax, type DigitalSignatureValue as ay, type EditorToolbarAction as az, type FormSchema as b, type ProcessPreviewProps as b0, type RuntimeAuthHeadersProvider as b1, type RuntimeDataQueryParams as b2, type RuntimeDataQueryResult as b3, type RuntimeRequestConfig as b4, type RuntimeUploadOptions as b5, type RuntimeUploadProvider as b6, type SectionLayoutNode as b7, type SignaturePoint as b8, type StepLayoutItem as b9, type StepsLayoutNode as ba, type SubFormColumn as bb, type TabLayoutItem as bc, type TabsLayoutNode as bd, type TextShortcutConfig as be, type TextShortcutType as bf, type UserDisplayFormat as bg, type UserItem as bh, type FormRuntimeApiConfig as c, type FormEngineConfig as d, type FieldBehavior as e, type FormRuntimeConfig as f, type FormAppearanceConfig as g, type ValidationRule as h, type FormEffect as i, type OptionSourceConfig as j, type FormDataDeleteParams as k, type ChangeRecordListResponse as l, type FormDataQueryParams as m, type FormInstanceData as n, type InitiatorSelectRequirement as o, type ProcessBasicInfo as p, type ProcessDefinition as q, type ProcessTask as r, type ReturnableNodeResult as s, type ReturnableNode as t, type ViewPermissionQueryParams as u, type ViewPermissionSummary as v, type ApproveParams as w, type PreviewParams as x, type ProcessRoute as y, type ResubmitParams as z };

package/packages/sdk/dist/components/index.cjs

@@ -10116,7 +10116,31 @@ var parseResponse = async (response) => {
     message: response.statusText
   };
 };
-var createDefaultRequest = (baseUrl) => async (config) => {
+var applyAuthHeaders = (headers, getAuthHeaders) => {
+  const authHeaders = getAuthHeaders?.();
+  if (authHeaders) {
+    new Headers(authHeaders).forEach((value, key) => {
+      if (!headers.has(key)) headers.set(key, value);
+    });
+  }
+  const token = typeof window !== "undefined" ? window.localStorage?.getItem("token") : void 0;
+  if (token && !headers.has("authorization")) {
+    headers.set("authorization", token);
+  }
+};
+var applyXhrAuthHeaders = (xhr, getAuthHeaders) => {
+  let hasAuthorization = false;
+  const authHeaders = getAuthHeaders?.();
+  if (authHeaders) {
+    new Headers(authHeaders).forEach((value, key) => {
+      if (key.toLowerCase() === "authorization") hasAuthorization = true;
+      xhr.setRequestHeader(key, value);
+    });
+  }
+  const token = typeof window !== "undefined" ? window.localStorage?.getItem("token") : void 0;
+  if (token && !hasAuthorization) xhr.setRequestHeader("authorization", token);
+};
+var createDefaultRequest = (baseUrl, fetchImpl = fetch, getAuthHeaders) => async (config) => {
   const method = config.method ?? "get";
   const url = appendQuery(joinUrl(baseUrl, config.url), config.params);
   const headers = new Headers(config.headers);
@@ -10129,11 +10153,8 @@ var createDefaultRequest = (baseUrl) => async (config) => {
       body = JSON.stringify(config.data);
     }
   }
-  const token = typeof window !== "undefined" ? window.localStorage?.getItem("token") : void 0;
-  if (token && !headers.has("authorization")) {
-    headers.set("authorization", token);
-  }
-  const response = await fetch(url, {
+  applyAuthHeaders(headers, getAuthHeaders);
+  const response = await fetchImpl(url, {
     method,
     headers,
     body,
@@ -10201,7 +10222,7 @@ var normalizeUploadData = (data, file, bucketName, baseUrl = "") => {
     variants
   };
 };
-var uploadWithXhr = (baseUrl, file, bucketName, onProgress, options = {}) => new Promise((resolve, reject) => {
+var uploadWithXhr = (baseUrl, file, bucketName, onProgress, options = {}, getAuthHeaders) => new Promise((resolve, reject) => {
   if (globalThis.process?.env?.VITEST) {
     onProgress?.(100);
     resolve({
@@ -10231,8 +10252,7 @@ var uploadWithXhr = (baseUrl, file, bucketName, onProgress, options = {}) => new
     )
   );
   xhr.withCredentials = true;
-  const token = typeof window !== "undefined" ? window.localStorage?.getItem("token") : void 0;
-  if (token) xhr.setRequestHeader("authorization", token);
+  applyXhrAuthHeaders(xhr, getAuthHeaders);
   xhr.upload.onprogress = (event) => {
     if (event.lengthComputable) {
       onProgress?.(Math.round(event.loaded / event.total * 100));
@@ -10336,7 +10356,8 @@ async function uploadChunkedFile(request, file, bucketName, baseUrl, onProgress,
       fileSize: file.size,
       chunkSize: DEFAULT_CHUNK_SIZE,
       bucketName,
-      visibility: options.visibility
+      visibility: options.visibility,
+      contentType: file.type || void 0
     }
   });
   const uploadInfo = initiate.data || initiate.result;
@@ -10395,7 +10416,7 @@ var createSegmentProgress = (onProgress, start, end) => (percent) => {
   onProgress?.(Math.round(next));
 };
 var getAttachmentUrl = (item) => item.publicUrl || item.previewUrl || item.downloadUrl || item.url || "";
-async function uploadSingleRuntimeFile(request, baseUrl, file, bucketName, onProgress, options) {
+async function uploadSingleRuntimeFile(request, baseUrl, file, bucketName, onProgress, options, getAuthHeaders) {
   const singleOptions = stripImageCompressionOptions(options);
   if (singleOptions.uploadProvider === "builtin-oss") {
     return uploadBuiltinOssFile(request, file, bucketName, onProgress, singleOptions);
@@ -10406,7 +10427,7 @@ async function uploadSingleRuntimeFile(request, baseUrl, file, bucketName, onPro
   if (file.size > CHUNK_UPLOAD_THRESHOLD) {
     return uploadChunkedFile(request, file, bucketName, baseUrl, onProgress);
   }
-  return uploadWithXhr(baseUrl, file, bucketName, onProgress);
+  return uploadWithXhr(baseUrl, file, bucketName, onProgress, {}, getAuthHeaders);
 }
 function toImageVariantMetadata(uploaded, variant) {
   return {
@@ -10420,7 +10441,7 @@ function toImageVariantMetadata(uploaded, variant) {
     quality: variant.quality
   };
 }
-async function uploadFileWithImageVariants(request, baseUrl, file, bucketName, onProgress, options) {
+async function uploadFileWithImageVariants(request, baseUrl, file, bucketName, onProgress, options, getAuthHeaders) {
   let variants = [];
   try {
     variants = await createCompressedImageVariants(file, options.imageCompression);
@@ -10428,7 +10449,15 @@ async function uploadFileWithImageVariants(request, baseUrl, file, bucketName, o
     variants = [];
   }
   if (variants.length === 0) {
-    return uploadSingleRuntimeFile(request, baseUrl, file, bucketName, onProgress, options);
+    return uploadSingleRuntimeFile(
+      request,
+      baseUrl,
+      file,
+      bucketName,
+      onProgress,
+      options,
+      getAuthHeaders
+    );
   }
   const originalProgressEnd = 70;
   const uploaded = await uploadSingleRuntimeFile(
@@ -10437,7 +10466,8 @@ async function uploadFileWithImageVariants(request, baseUrl, file, bucketName, o
     file,
     bucketName,
     createSegmentProgress(onProgress, 0, originalProgressEnd),
-    options
+    options,
+    getAuthHeaders
   );
   const imageVariants = { ...uploaded.variants || {} };
   const variantProgressStep = (100 - originalProgressEnd) / variants.length;
@@ -10452,7 +10482,8 @@ async function uploadFileWithImageVariants(request, baseUrl, file, bucketName, o
         variant.file,
         bucketName,
         createSegmentProgress(onProgress, start, end),
-        options
+        options,
+        getAuthHeaders
       );
       imageVariants[variant.kind] = toImageVariantMetadata(variantUpload, variant);
     } catch {
@@ -10469,11 +10500,20 @@ async function uploadFileWithImageVariants(request, baseUrl, file, bucketName, o
 }
 function createFormRuntimeApi(config) {
   const { baseUrl = getDefaultBaseUrl(), ...overrides } = config ?? {};
-  const request = overrides.request ?? createDefaultRequest(baseUrl);
+  const { fetchImpl, getAuthHeaders } = overrides;
+  const request = overrides.request ?? createDefaultRequest(baseUrl, fetchImpl, getAuthHeaders);
   const defaults = {
     request,
     uploadFile: async (file, bucketName = "files", onProgress, options = {}) => {
-      return uploadFileWithImageVariants(request, baseUrl, file, bucketName, onProgress, options);
+      return uploadFileWithImageVariants(
+        request,
+        baseUrl,
+        file,
+        bucketName,
+        onProgress,
+        options,
+        getAuthHeaders
+      );
     },
     uploadPublicFile: async (file, bucketName = DEFAULT_PUBLIC_FILE_BUCKET, onProgress) => {
       if (file.size > CHUNK_UPLOAD_THRESHOLD) {
@@ -10483,7 +10523,7 @@ function createFormRuntimeApi(config) {
       }
       return uploadWithXhr(baseUrl, file, bucketName, onProgress, {
         visibility: "public"
-      });
+      }, getAuthHeaders);
     },
     deleteFile: async (objectName, bucketName = "files", options = {}) => {
       if (options.uploadProvider === "builtin-oss" || options.storageScope === "platform") {