sohelp-eleplus 1.1.26 → 1.1.28

package/sohelp-workflow-drawer/README.md

@@ -1,38 +1,51 @@
-# SohelpWorkflowDrawer
+# SohelpWorkflowDrawer 工作流审批抽屉
 
-A drawer component for displaying workflow details, processing approvals, and viewing history.
+基于 `ele-drawer` 封装的工作流审批详情抽屉组件，包含表单、流程图、表格和时间轴四个 Tab 页，支持同意、拒绝、委派、加签、减签等审批操作。
 
-## Props
-
-| Name | Type | Default | Description |
-| :--- | :--- | :--- | :--- |
-| `modelValue` | `Boolean` | - | Controls the visibility of the drawer. |
-| `data` | `Object` | - | Requires `{ id, refid }` to fetch workflow details. |
-| `showOpera` | `Boolean` | `true` | Whether to show operation buttons (Agree, Reject, etc.). |
-
-## Events
-
-| Name | Parameters | Description |
-| :--- | :--- | :--- |
-| `update:modelValue` | `(visible)` | Updates the visibility state. |
-| `reload` | - | Triggered when an operation is completed successfully. |
-| `close` | - | Triggered when the drawer is closed. |
-
-## Methods
-
-| Name | Description |
-| :--- | :--- |
-| `show(params)` | Opens the drawer with the given parameters. |
-| `close()` | Closes the drawer. |
-
-## Usage
+## 基础用法
 
 ```vue
 <template>
   <sohelp-workflow-drawer
     v-model="visible"
-    :data="{ id: '123', refid: 'flow_abc' }"
-    @reload="refreshList"
+    :data="rowData"
+    @reload="reloadTable"
+    @close="onClose"
+    ref="drawerRef"
   />
 </template>
+
+<script setup>
+import { ref } from 'vue';
+const visible = ref(false);
+const rowData = ref({ id: '', refid: '' });
+const drawerRef = ref(null);
+const reloadTable = () => { /* 刷新列表 */ };
+const onClose = () => { /* 关闭回调 */ };
+
+// 通过 expose 方法打开
+drawerRef.value?.show({ id: '123', refid: 'myRefId' });
+</script>
 ```
+
+## 属性 (Props)
+
+| 属性名 | 类型 | 默认值 | 必填 | 说明 |
+| --- | --- | --- | --- | --- |
+| modelValue (v-model) | Boolean | - | 否 | 控制抽屉显示/隐藏 |
+| data | Object | - | 否 | 审批数据对象，需包含 `id` 和 `refid` |
+
+## 事件 (Events)
+
+| 事件名 | 回调参数 | 说明 |
+| --- | --- | --- |
+| update:modelValue | `value: Boolean` | 抽屉显示状态变化 |
+| update:data | `value: Object` | 数据更新 |
+| opera | - | 操作事件 |
+| reload | - | 审批完成后请求刷新列表 |
+| close | - | 抽屉关闭时触发 |
+
+## 公开方法 (Expose)
+
+- `show(params)` - 打开抽屉并设置数据，`params` 需含 `id` 和 `refid`
+- `close()` - 关闭抽屉

package/sohelp-workflow-drawer/components/table.vue

@@ -16,7 +16,13 @@
     <template #actorList="{ row }">
       <div style="display: flex; gap: 5px; flex-wrap: wrap">
         <span v-for="item in row?.actorList" :key="item.actor_id">
-          <vxe-tag status="primary">{{ item.actor_name }}</vxe-tag>
+          <vxe-tag status="primary">{{ item?.actor_name }}</vxe-tag>
+        </span>
+      </div>
+
+      <div style="display: flex; gap: 5px; flex-wrap: wrap" v-if="row.type != 'done'">
+        <span v-for="item in row?.assigneeList" :key="item.actor_id">
+          <vxe-tag status="info">{{ item?.name }}</vxe-tag>
         </span>
       </div>
     </template>

package/sohelp-workflow-drawer/index.vue

@@ -63,23 +63,44 @@
 
       <template #footer>
         <el-button @click="userModal = false">取消</el-button>
-        <el-button type="primary" @click="saveByUser(todoType, users)" v-loading="loading" :disabled="!users.length"
+        <el-button
+          type="primary"
+          @click="saveByUser(todoType, users)"
+          v-loading="loading"
+          :disabled="!users.length"
           >{{ moreOption[todoType] }}
         </el-button>
       </template>
     </ele-modal>
 
     <template #footer>
-      <el-button plain size="small" @click="updateModelValue(false)">关闭</el-button>
-      <span v-if="showOpera">
-        <el-button type="primary" size="small" @click="openModal('agree')" v-permission="'todo.wf.agree'"
-          >同意</el-button
+      <el-button plain size="small" @click="updateModelValue(false)"
+        >关闭</el-button
+      >
+      <span v-if="showOpera && data">
+        <el-button
+          v-permission="refidPrefix + 'workflow.agree'"
+          type="primary"
+          size="small"
+          @click="openModal('agree')"
         >
-        <el-button type="danger" size="small" @click="openModal('reject')" v-permission="'todo.wf.reject'"
-          >拒绝</el-button
+          同意
+        </el-button>
+        <el-button
+          v-permission="refidPrefix + 'workflow.reject'"
+          type="danger"
+          size="small"
+          @click="openModal('reject')"
+        >
+          拒绝
+        </el-button>
+        <ele-dropdown
+          v-if="getMore.length > 0"
+          trigger="click"
+          :items="getMore"
+          @command="onOperate"
         >
-        <ele-dropdown trigger="click" :items="getMore" @command="onOperate($event)" v-if="getMore.length > 0">
-          <el-button plain="" size="small" title="更多" :icon="MoreFilled"></el-button>
+          <el-button size="small" :icon="MoreFilled" title="更多" />
         </ele-dropdown>
       </span>
     </template>
@@ -87,12 +108,13 @@
 </template>
 
 <script setup>
-  import { buttonAuth, getTodoDetail, moreOption, todoOperate } from '@/api/todo/index.js';
+  import { buttonAuth, getTodoDetail, moreOption, todoOperate } from './js';
+
   import { EleMessage } from '@/components/ele-admin-plus/components';
   import { MoreFilled } from '@element-plus/icons-vue';
   import { ElMessageBox } from 'element-plus/es';
   import { usePermission } from '@/utils/use-permission';
-  import { computed, reactive, ref, watch } from 'vue';
+  import { computed, reactive, ref } from 'vue';
   import FormTab from './components/form.vue';
   import TableTab from './components/table.vue';
   import TimelineTab from './components/timeline.vue';
@@ -103,14 +125,18 @@
 
   const props = defineProps({
     modelValue: Boolean,
-    data: Object,
-    showOpera: {
-      type: Boolean,
-      default: true
-    }
+    data: Object
   });
 
-  const emit = defineEmits(['opera', 'update:data', 'update:showOpera', 'update:modelValue', 'reload', 'close']);
+  const showOpera = ref(false);
+
+  const emit = defineEmits([
+    'opera',
+    'update:data',
+    'update:modelValue',
+    'reload',
+    'close'
+  ]);
 
   const tabs = reactive([
     { label: '表单', name: 'form' },
@@ -120,23 +146,26 @@
   ]);
   const active = ref('form');
   const detail = ref();
+  const taskData = ref(null);
 
   const todoType = ref(null);
   const userModal = ref(false);
-  const drawerVisible = ref(false);
   const loading = ref(false);
   const users = ref([]);
 
+  const todoDrawerRef = ref(null);
   const approvalModalVisible = ref(false);
   const approvalData = reactive({
     id: '',
     refid: ''
   });
 
-  /**
-   * 显示详情
-   * @param params
-   */
+  /** refid前缀 */
+  const refidPrefix = computed(() => {
+    return props.data?.refid?.split('!')?.[0] + ':' || '';
+  });
+
+  /** 显示详情 */
   const show = (params = {}) => {
     emit('update:data', params);
     emit('update:modelValue', true);
@@ -147,35 +176,33 @@
     emit('update:modelValue', value);
   };
 
-  /**
-   * 打开抽屉
-   */
+  /** 打开抽屉 */
   const open = async () => {
-    emit('update:showOpera', false);
     const { id, refid } = props.data;
     if (id && refid) {
       await getDetail({ refid, id });
-      // //获取可审批的任务
-      SohelpHttp.get('/engine/web/workflow/getMyTask', { refid: refid, id: id }).then((res) => {
+      // 获取可审批的任务
+      SohelpHttp.get('/engine/web/workflow/getMyTask', {
+        refid,
+        id
+      }).then((res) => {
         if (res.meta.success) {
-          emit('update:showOpera', res.data?.id !== '');
+          taskData.value = res.data;
+          showOpera.value = !!res.data?.id;
+        } else {
+          EleMessage.error(res.meta?.message);
         }
       });
     }
   };
 
-  /**
-   * 关闭抽屉
-   */
+  /** 关闭抽屉 */
   const close = () => {
     active.value = 'form';
     emit('close');
   };
 
-  /**
-   * 获取详情
-   * @param params
-   */
+  /** 获取详情 */
   const getDetail = async (params) => {
     loading.value = true;
     const res = await getTodoDetail(params);
@@ -187,67 +214,61 @@
     }
   };
 
-  /**
-   * 更多操作按钮
-   */
+  /** 更多操作按钮 */
   const getMore = computed(() => {
     const exclude = ['agree', 'reject', 'batchAgree', 'batchReject', 'submit'];
     return Object.entries(moreOption)
-      .filter(([key]) => !exclude.includes(key) && permission.hasPermission(buttonAuth[key]))
-      ?.map(([key, value]) => ({ title: value, command: key }));
+      .filter(
+        ([key]) =>
+          !exclude.includes(key) &&
+          permission.hasPermission(refidPrefix.value + buttonAuth[key])
+      )
+      .map(([command, title]) => ({ command, title }));
   });
 
-  /**
-   * 同意、拒绝弹窗
-   * @param type
-   */
+  /** 同意、拒绝弹窗 */
   const openModal = (type) => {
     todoType.value = type;
-    const id = props.data.id;
     Object.assign(approvalData, {
-      id: id,
+      id: props.data.id,
       refid: props.data.refid
     });
     approvalModalVisible.value = true;
   };
 
-  /**
-   * 选择用户弹窗
-   */
+  /** 选择用户弹窗 */
   const openUserModal = () => {
     users.value = todoType.value === 'delegate' ? '' : [];
   };
 
-  /**
-   * 更多操作
-   * @param type 类型
-   * @param row
-   */
+  /** 更多操作 */
   const onOperate = (type) => {
     todoType.value = type;
 
     // 委派、加签、减签
     if (['delegate', 'addSign', 'removeSign'].includes(type)) {
       userModal.value = true;
-      return false;
+      return;
     }
 
-    let data = {
-      taskId: props.data.taskId
+    const data = {
+      id: props.data.id,
+      refid: props.data.refid
     };
+
     // 跳转
     if (type === 'jump') {
-      data.nodeKey = props.data.nodeKey;
+      data.nodeKey = props.data?.nodeKey || '';
     }
 
     ElMessageBox.confirm(`确定要${moreOption[type]}吗?`, '系统提示', {
       type: 'danger',
       draggable: false
     })
-      .then(async () => {
+      .then(() => {
         save(type, data);
       })
-      .catch((e) => {});
+      .catch(() => {});
   };
 
   // 更新table
@@ -256,22 +277,16 @@
     emit('reload');
   };
 
-  /**
-   * 委派，加签，减签保存
-   * @param type
-   */
+  /** 委派，加签，减签保存 */
   const saveByUser = (type) => {
     save(type, {
       id: props.data.id,
+      refid: props.data.refid,
       [type === 'delegate' ? 'userId' : 'users']: users.value
     });
   };
 
-  /**
-   * 保存
-   * @param type
-   * @param data
-   */
+  /** 保存 */
   const save = (type, data) => {
     loading.value = true;
     todoOperate(type, data)
@@ -279,7 +294,7 @@
         loading.value = false;
         EleMessage.success(msg);
         done();
-        if (type == 'agree' || type == 'reject') {
+        if (type === 'agree' || type === 'reject') {
           todoDrawerRef.value?.closeModal();
         }
         if (['delegate', 'addSign', 'removeSign'].includes(type)) {

package/sohelp-workflow-drawer/js/index.js

@@ -15,18 +15,18 @@ export const moreOption = {
 };
 
 export const buttonAuth = {
-  agree: 'todo.wf.agree',
-  reject: 'todo.wf.reject',
-  submit: 'todo.wf.submit',
-  reclaim: 'todo.wf.reclaim',
-  delegate: 'todo.wf.delegate',
+  agree: 'workflow.agree',
+  reject: 'workflow.reject',
+  submit: 'workflow.submit',
+  reclaim: 'workflow.reclaim',
+  delegate: 'workflow.delegate',
   complete: 'todo.wf.complete',
-  addSign: 'todo.wf.add-sign',
-  removeSign: 'todo.wf.remove-sign',
-  jump: 'todo.wf.jump',
-  jumpPrevious: 'todo.wf.jump-previous',
-  jumpFirst: 'todo.wf.jump-first'
-}
+  addSign: 'workflow.add-sign',
+  removeSign: 'workflow.remove-sign',
+  jump: 'workflow.jump',
+  jumpPrevious: 'workflow.jump-previous',
+  jumpFirst: 'workflow.jump-first'
+};
 
 /**
  * 待办分页列表
@@ -74,7 +74,7 @@ export async function todoOperate(type, params) {
  * @returns
  */
 export async function getTodoDetail(params) {
-  const res = await SohelpHttp.get(`/engine/web/crud/detail`, params);
+  const res = await SohelpHttp.get(`/engine/web/crud/getById`, params);
   if (res.meta.success) {
     return res.data;
   }
@@ -111,7 +111,9 @@ export async function getTasks(params) {
  * 已阅
  */
 export async function readByCc(taskId) {
-  const res = await SohelpHttp.post(`/engine/web/workflow/readByCc`, { taskId });
+  const res = await SohelpHttp.post(`/engine/web/workflow/readByCc`, {
+    taskId
+  });
   if (res.meta.success) {
     return res.meta.message;
   }

package/utils/safe-eval.js

@@ -0,0 +1,89 @@
+/**
+ * 安全的数学/条件表达式求值器
+ * 仅支持：数字运算(+-*​/%)、比较(> < >= <= === !== == !=)、逻辑(&& || !)、属性访问(row.field)、字符串
+ * 不支持：函数调用、赋值、new、import、require 等危险操作
+ */
+
+// 白名单：只允许标识符、点号、数字、运算符、圆括号、单/双引号字符串、空白、逗号
+// 不允许：方括号[]、反引号`、花括号{}、分号;、反斜杠\（阻止unicode转义）
+const SAFE_EXPR_PATTERN = /^[\w\s.'"$+\-*/%()><=!&|?:,]+$/;
+// 扩展危险关键字检测，涵盖更多绕过手段
+const DANGEROUS_KEYWORDS = /\b(import|require|eval|Function|constructor|prototype|__proto__|window|document|globalThis|process|fetch|XMLHttpRequest|setTimeout|setInterval|alert|confirm|prompt|atob|btoa|escape|unescape|decodeURI|encodeURI|decodeURIComponent|encodeURIComponent|this|self|top|parent|frames|location|navigator|history|screen|chrome|Proxy|Reflect|Symbol|Object|Array|String|Number|Boolean|RegExp|Date|Math|JSON|Promise|Error)\b/;
+// handler 代码的危险关键字（比表达式宽松一些，允许常见的安全对象如 Math/JSON/Array 等）
+const DANGEROUS_CODE_KEYWORDS = /\b(import|require|eval|Function|constructor|prototype|__proto__|window|document|globalThis|process|fetch|XMLHttpRequest|setTimeout|setInterval|alert|confirm|prompt|Proxy|Reflect|self|top|parent|frames|location|navigator|history|screen|chrome)\b/;
+// 检测不安全的字符序列：方括号（属性访问绕过）、反引号（模板字符串）、unicode转义
+const UNSAFE_SEQUENCES = /[\[\]`\\]/;
+
+export function isSafeExpression(expr) {
+  if (!expr || typeof expr !== 'string') return false;
+  // 检测不安全字符序列（方括号、反引号、反斜杠）
+  if (UNSAFE_SEQUENCES.test(expr)) return false;
+  if (!SAFE_EXPR_PATTERN.test(expr)) return false;
+  if (DANGEROUS_KEYWORDS.test(expr)) return false;
+  return true;
+}
+
+function isSafeCode(code) {
+  if (!code || typeof code !== 'string') return false;
+  if (DANGEROUS_CODE_KEYWORDS.test(code)) return false;
+  // 在 handler 代码中也禁止 unicode 转义和反引号（防止关键字重构绕过）
+  if (/\\u[0-9a-fA-F]{4}/.test(code)) return false;
+  if (/`/.test(code)) return false;
+  return true;
+}
+
+/**
+ * 安全求值简单表达式（公式计算、条件判断）
+ * @param {string} expr - 表达式字符串，如 "row.price * row.qty"
+ * @param {Object} context - 上下文变量，如 { row: { price: 10, qty: 2 } }
+ * @returns {*} 计算结果
+ * @throws {Error} 如果表达式不安全
+ */
+export function safeEval(expr, context = {}) {
+  if (!isSafeExpression(expr)) {
+    throw new Error(`不安全的表达式: ${expr}`);
+  }
+  const keys = Object.keys(context);
+  const values = Object.values(context);
+  try {
+    const func = new Function(...keys, `"use strict"; return (${expr})`);
+    return func(...values);
+  } catch (e) {
+    throw new Error(`表达式执行错误: ${expr} - ${e.message}`);
+  }
+}
+
+/**
+ * 安全执行服务端配置的 handler 代码（带沙箱限制，异步）
+ * 仅允许访问白名单中的上下文变量
+ * @param {string} code - 代码字符串
+ * @param {string[]} paramNames - 参数名数组
+ * @param {*[]} contextValues - 参数值数组
+ * @param {Object} [thisArg] - 可选的 this 上下文
+ */
+export function safeFunctionExec(code, paramNames, contextValues, thisArg) {
+  if (!code || typeof code !== 'string') return;
+  if (!isSafeCode(code)) {
+    console.warn('[安全警告] handler 代码包含危险关键字或不安全序列，已拦截:', code.substring(0, 100));
+    return;
+  }
+  const func = new Function(...paramNames, `"use strict"; return (async () => { ${code} })()`);
+  return thisArg ? func.call(thisArg, ...contextValues) : func(...contextValues);
+}
+
+/**
+ * 安全执行服务端配置的代码（带沙箱限制，同步）
+ * @param {string} code - 代码字符串
+ * @param {string[]} paramNames - 参数名数组
+ * @param {*[]} contextValues - 参数值数组
+ * @param {Object} [thisArg] - 可选的 this 上下文
+ */
+export function safeFunctionExecSync(code, paramNames, contextValues, thisArg) {
+  if (!code || typeof code !== 'string') return;
+  if (!isSafeCode(code)) {
+    console.warn('[安全警告] handler 代码包含危险关键字或不安全序列，已拦截:', code.substring(0, 100));
+    return;
+  }
+  const func = new Function(...paramNames, `"use strict"; return (() => { ${code} })()`);
+  return thisArg ? func.call(thisArg, ...contextValues) : func(...contextValues);
+}

package/sohelp-dyn-select/props.js

@@ -1,67 +0,0 @@
-/**
- * 属性
- */
-export const prop = {
-  url: {
-    type: String,
-    required: true
-  },
-
-  mappingFields: {
-    type: Object,
-    default: () => {
-      return {
-        label: 'label',
-        value: 'value'
-      };
-    }
-  },
-
-  width: {
-    type: String,
-    default: '200px'
-  },
-
-  placeholder: {
-    type: String,
-    default: '请选择'
-  },
-
-  modelValue: {
-    type: Array || String || Number,
-    required: true
-  },
-  filterable: {
-    type: Boolean,
-    default: true
-  },
-  clearable: {
-    type: Boolean,
-    default: true
-  },
-  disabled: {
-    type: Boolean,
-    default: false
-  },
-  size: {
-    type: String,
-    validator: function (value) {
-      return ['large', 'default', 'small', ''].includes(value);
-    },
-    default: 'default'
-  },
-  multiple: {
-    type: Boolean,
-    default: false
-  },
-  type: {
-    type: String,
-    default: 'select'
-  }
-};
-
-/**
- * 事件
- */
-
-export const emit = ['update:modelValue', 'change'];

package/sohelp-user-select/index.vue~

@@ -1,53 +0,0 @@
-<template>
-  <div class="sohelp-user-select">
-    <sohelp-dyn-select
-      v-bind="$attrs"
-      :url="url"
-      :labelField="labelField"
-      :valueField="valueField"
-      :readonly="readonly"
-      :datasource="datasource"
-      v-model="modelValue"
-    ></sohelp-dyn-select>
-  </div>
-</template>
-<script setup>
-import SohelpDynSelect from "../sohelp-dyn-select/index.vue";
-
-const modelValue = defineModel("modelValue", { type: [String, Number, Array], default: "" });
-
-const props = defineProps({
-  datasource: {
-    type: [Array, Function, Promise],
-    required: true
-  },
-  url: {
-    type: String,
-    default: "/engine/web/user/list"
-  },
-  labelField: {
-    type: String,
-    default: "user_name"
-  },
-  valueField: {
-    type: String,
-    default: "id"
-  },
-  readonly: {
-    type: Boolean,
-    default: false
-  }
-});
-console.error(exposedMethods)
-// 暴露子组件特有方法
-defineExpose({
-  ...exposedMethods
-})
-
-</script>
-<script>
-export default {
-  name: "SohelpUserSelect"
-};
-</script>
-<style></style>