npm - @adminforth/bulk-ai-flow - Versions diffs - 1.27.3 → 1.27.5 - Mend

@adminforth/bulk-ai-flow 1.27.3 → 1.27.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/build.log +2 -2
package/custom/VisionAction.vue +4 -6
package/dist/custom/VisionAction.vue +4 -6
package/dist/index.d.ts +23 -1
package/dist/index.js +313 -104
package/index.ts +363 -108
package/package.json +1 -1

package/build.log CHANGED Viewed

@@ -14,5 +14,5 @@ custom/package.json
 custom/pnpm-lock.yaml
 custom/tsconfig.json
-sent 130,464 bytes  received 191 bytes  261,310.00 bytes/sec
-total size is 129,741  speedup is 0.99
+sent 130,414 bytes  received 191 bytes  261,210.00 bytes/sec
+total size is 129,691  speedup is 0.99

package/custom/VisionAction.vue CHANGED Viewed

@@ -884,7 +884,7 @@ async function processOneRecord(recordId: string, sessionIds: string[]) {
   record.label = oldDataResult._label || record.label;
   initializeRecordData(record, oldDataResult);
   if (props.meta.isAttachFiles) {
-    await fetchImages(record, oldDataResult);
+    await fetchImages(record, recordId);
     if (!checkIfDialogOpen()) {
       return;
     }
@@ -1162,16 +1162,14 @@ function normalizeEnumValue(key: string, value: any) {
   return match ? value : null;
 }
-async function fetchImages(record: RecordState, oldRecord: Record<string, any>) {
+async function fetchImages(record: RecordState, recordId: string) {
   try {
     const res = await callAdminForthApi({
       path: `/plugin/${props.meta.pluginInstanceId}/get_images`,
       method: 'POST',
-      body: {
-        record: [oldRecord],
-      },
+      body: { recordId },
     });
-    record.images = res.images?.[0] || [];
+    record.images = res.images || [];
     touchRecords();
   } catch (error) {
     console.error('Failed to get images:', error);

package/dist/custom/VisionAction.vue CHANGED Viewed

@@ -884,7 +884,7 @@ async function processOneRecord(recordId: string, sessionIds: string[]) {
   record.label = oldDataResult._label || record.label;
   initializeRecordData(record, oldDataResult);
   if (props.meta.isAttachFiles) {
-    await fetchImages(record, oldDataResult);
+    await fetchImages(record, recordId);
     if (!checkIfDialogOpen()) {
       return;
     }
@@ -1162,16 +1162,14 @@ function normalizeEnumValue(key: string, value: any) {
   return match ? value : null;
 }
-async function fetchImages(record: RecordState, oldRecord: Record<string, any>) {
+async function fetchImages(record: RecordState, recordId: string) {
   try {
     const res = await callAdminForthApi({
       path: `/plugin/${props.meta.pluginInstanceId}/get_images`,
       method: 'POST',
-      body: {
-        record: [oldRecord],
-      },
+      body: { recordId },
     });
-    record.images = res.images?.[0] || [];
+    record.images = res.images || [];
     touchRecords();
   } catch (error) {
     console.error('Failed to get images:', error);

package/dist/index.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import { AdminForthPlugin } from "adminforth";
-import type { IAdminForth, IHttpServer, AdminForthResource } from "adminforth";
+import type { IAdminForth, IHttpServer, AdminForthResource, AdminUser } from "adminforth";
 import type { PluginOptions } from './types.js';
 import { RateLimiter } from "adminforth";
 export default class BulkAiFlowPlugin extends AdminForthPlugin {
@@ -26,5 +26,27 @@ export default class BulkAiFlowPlugin extends AdminForthPlugin {
     modifyResourceConfig(adminforth: IAdminForth, resourceConfig: AdminForthResource): Promise<void>;
     validateConfigAfterDiscover(adminforth: IAdminForth, resourceConfig: AdminForthResource): void;
     instanceUniqueRepresentation(pluginOptions: any): string;
+    pluginManagedFields(): Set<string>;
+    checkUpdateAllowed({ adminUser, requestBody, recordId, oldRecord, fields }: {
+        adminUser: AdminUser;
+        requestBody: any;
+        recordId: any;
+        oldRecord: any;
+        fields: Record<string, any>;
+    }): Promise<string | null>;
+    /**
+     * Reads one record the way the core show route does: the resource-level `show` permission first,
+     * then the resource's own `show.beforeDatasourceRequest` hooks so row-level scoping narrows the
+     * filters before the query runs.
+     * The returned record is the raw row, so callers which send it to the browser must pass it
+     * through `scopeRecordForFrontend` first.
+     */
+    private getRecordForShow;
+    /**
+     * The action dialog only ever renders the fields this plugin generates, so only those leave the
+     * backend, next to the primary key and the record label. backendOnly columns are dropped the same
+     * way the core show route drops them.
+     */
+    private scopeRecordForFrontend;
     setupEndpoints(server: IHttpServer): void;
 }

package/dist/index.js CHANGED Viewed

@@ -7,7 +7,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { AdminForthFilterOperators, AdminForthPlugin, Filters } from "adminforth";
+import { AdminForthFilterOperators, AdminForthPlugin, Filters, interpretResource, ActionCheckSource, AllowedActionsEnum } from "adminforth";
 import { suggestIfTypo, filtersTools } from "adminforth";
 import Handlebars from 'handlebars';
 import { RateLimiter } from "adminforth";
@@ -17,7 +17,7 @@ const getRecordsBodySchema = z.object({
     record: z.array(z.any()).nullish(),
 }).strict();
 const getImagesBodySchema = z.object({
-    record: z.array(z.any()).nullish(),
+    recordId: z.union([z.string(), z.number()]),
 }).strict();
 const getOldDataBodySchema = z.object({
     recordId: z.union([z.string(), z.number()]).nullish(),
@@ -28,7 +28,7 @@ const updateFieldsBodySchema = z.object({
     saveImages: z.boolean().nullish(),
 }).strict();
 const getImageGenerationPromptsBodySchema = z.object({
-    recordId: z.union([z.string(), z.number()]).nullish(),
+    recordId: z.union([z.string(), z.number()]),
     customPrompt: z.string().nullish(),
 }).strict();
 const createJobBodySchema = z.object({
@@ -55,6 +55,43 @@ const compileOldImageLinkBodySchema = z.object({
 const getFilteredIdsBodySchema = z.object({
     filters: z.any(),
 }).passthrough();
+function resolveBoolOrFn(val, ctx) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (typeof val === 'function') {
+            return !!(yield val(ctx));
+        }
+        return !!val;
+    });
+}
+function isShownInEdit(column, ctx) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const showIn = column.showIn || {};
+        if (showIn.edit !== undefined) {
+            return yield resolveBoolOrFn(showIn.edit, ctx);
+        }
+        if (showIn.all !== undefined) {
+            return yield resolveBoolOrFn(showIn.all, ctx);
+        }
+        return true;
+    });
+}
+function valueIsUnchanged(newValue, oldValue) {
+    if (newValue === oldValue) {
+        return true;
+    }
+    if (newValue === null || newValue === undefined || oldValue === null || oldValue === undefined) {
+        return false;
+    }
+    if (typeof newValue === 'object' || typeof oldValue === 'object') {
+        try {
+            return JSON.stringify(newValue) === JSON.stringify(oldValue);
+        }
+        catch (_a) {
+            return false;
+        }
+    }
+    return String(newValue) === String(oldValue);
+}
 const STUB_MODE = false;
 const jobs = new Map();
 export default class BulkAiFlowPlugin extends AdminForthPlugin {
@@ -810,44 +847,186 @@ export default class BulkAiFlowPlugin extends AdminForthPlugin {
     instanceUniqueRepresentation(pluginOptions) {
         return `${this.pluginOptions.actionName}`;
     }
+    pluginManagedFields() {
+        return new Set([
+            ...Object.keys(this.options.fillFieldsFromImages || {}),
+            ...Object.keys(this.options.fillPlainFields || {}),
+            ...Object.keys(this.options.generateImages || {}),
+        ]);
+    }
+    checkUpdateAllowed(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ adminUser, requestBody, recordId, oldRecord, fields }) {
+            const meta = { requestBody, newRecord: fields, oldRecord, pk: recordId };
+            const ctx = {
+                adminUser,
+                resource: this.resourceConfig,
+                meta,
+                source: ActionCheckSource.EditRequest,
+                adminforth: this.adminforth,
+            };
+            const { allowedActions } = yield interpretResource(adminUser, this.resourceConfig, meta, ActionCheckSource.EditRequest, this.adminforth);
+            const editAllowed = allowedActions[AllowedActionsEnum.edit];
+            if (editAllowed !== true) {
+                return typeof editAllowed === 'string' ? editAllowed : 'You are not allowed to edit records in this resource';
+            }
+            const managedFields = this.pluginManagedFields();
+            for (const [fieldName, value] of Object.entries(fields)) {
+                if (valueIsUnchanged(value, oldRecord[fieldName])) {
+                    continue;
+                }
+                const column = this.resourceConfig.columns.find((col) => col.name === fieldName);
+                if (!column) {
+                    return `Field "${fieldName}" does not exist in resource "${this.resourceConfig.resourceId}"`;
+                }
+                if (!managedFields.has(fieldName)) {
+                    return `Field "${fieldName}" cannot be modified, it is not generated by the "${this.options.actionName}" action`;
+                }
+                if (column.primaryKey) {
+                    return `Field "${fieldName}" cannot be modified as it is a primary key`;
+                }
+                if (yield resolveBoolOrFn(column.backendOnly, ctx)) {
+                    return `Field "${fieldName}" cannot be modified as it is restricted from editing (backendOnly is true).`;
+                }
+                if (column.editReadonly) {
+                    return `Field "${fieldName}" cannot be modified as it is restricted from editing (editReadonly is true).`;
+                }
+                if (!(yield isShownInEdit(column, ctx)) && !column.allowModifyWhenNotShowInEdit) {
+                    return `Field "${fieldName}" cannot be modified as it is restricted from editing (showIn.edit is false). If you need to allow updating this hidden field, set column.allowModifyWhenNotShowInEdit = true.`;
+                }
+            }
+            if (this.options.isAllowedToSave) {
+                const isAllowedToSave = yield this.options.isAllowedToSave({
+                    record: oldRecord,
+                    adminUser: adminUser,
+                    resource: this.resourceConfig,
+                });
+                if ((isAllowedToSave === null || isAllowedToSave === void 0 ? void 0 : isAllowedToSave.ok) === false) {
+                    return isAllowedToSave.error;
+                }
+            }
+            return null;
+        });
+    }
+    /**
+     * Reads one record the way the core show route does: the resource-level `show` permission first,
+     * then the resource's own `show.beforeDatasourceRequest` hooks so row-level scoping narrows the
+     * filters before the query runs.
+     * The returned record is the raw row, so callers which send it to the browser must pass it
+     * through `scopeRecordForFrontend` first.
+     */
+    getRecordForShow(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ adminUser, recordId, extra }) {
+            var _b, _c;
+            const meta = { requestBody: extra.body, pk: recordId };
+            const ctx = {
+                adminUser,
+                resource: this.resourceConfig,
+                meta,
+                source: ActionCheckSource.ShowRequest,
+                adminforth: this.adminforth,
+            };
+            const { allowedActions } = yield interpretResource(adminUser, this.resourceConfig, meta, ActionCheckSource.ShowRequest, this.adminforth);
+            const showAllowed = allowedActions[AllowedActionsEnum.show];
+            if (showAllowed !== true) {
+                return { error: typeof showAllowed === 'string' ? showAllowed : 'You are not allowed to view records in this resource' };
+            }
+            const primaryKeyColumn = this.resourceConfig.columns.find((col) => col.primaryKey);
+            const hookQuery = {
+                resourceId: this.resourceConfig.resourceId,
+                source: 'show',
+                filters: [Filters.EQ(primaryKeyColumn.name, recordId)],
+                limit: 1,
+                offset: 0,
+                sort: [],
+            };
+            for (const hook of ((_c = (_b = this.resourceConfig.hooks) === null || _b === void 0 ? void 0 : _b.show) === null || _c === void 0 ? void 0 : _c.beforeDatasourceRequest) || []) {
+                const filterTools = filtersTools.get(hookQuery);
+                hookQuery.filtersTools = filterTools;
+                const resp = yield hook({
+                    resource: this.resourceConfig,
+                    query: hookQuery,
+                    adminUser,
+                    //@ts-ignore
+                    filtersTools: filterTools,
+                    extra,
+                    adminforth: this.adminforth,
+                });
+                if (!resp || (!resp.ok && !resp.error)) {
+                    throw new Error(`Hook must return object with {ok: true} or { error: 'Error' } `);
+                }
+                if (resp.error) {
+                    return { error: resp.error };
+                }
+            }
+            const record = yield this.adminforth.resource(this.resourceConfig.resourceId).get(hookQuery.filters);
+            if (!record) {
+                return { error: 'Record not found' };
+            }
+            return { record, ctx };
+        });
+    }
+    /**
+     * The action dialog only ever renders the fields this plugin generates, so only those leave the
+     * backend, next to the primary key and the record label. backendOnly columns are dropped the same
+     * way the core show route drops them.
+     */
+    scopeRecordForFrontend(record, ctx) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const primaryKeyColumn = this.resourceConfig.columns.find((col) => col.primaryKey);
+            const managedFields = this.pluginManagedFields();
+            const scoped = {
+                [primaryKeyColumn.name]: record[primaryKeyColumn.name],
+                _label: this.resourceConfig.recordLabel(record),
+            };
+            for (const column of this.resourceConfig.columns.filter((col) => managedFields.has(col.name))) {
+                if (yield resolveBoolOrFn(column.backendOnly, ctx)) {
+                    continue;
+                }
+                scoped[column.name] = record[column.name];
+            }
+            return scoped;
+        });
+    }
     setupEndpoints(server) {
         server.endpoint({
             method: 'POST',
             path: `/plugin/${this.pluginInstanceId}/get_old_data`,
             request_schema: getOldDataBodySchema,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response }) {
+            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, headers, query, cookies, requestUrl }) {
                 const data = body;
                 const recordId = data.recordId;
                 if (recordId === undefined || recordId === null) {
                     return { ok: false, error: "Missing recordId" };
                 }
-                const primaryKeyColumn = this.resourceConfig.columns.find((col) => col.primaryKey);
-                const record = yield this.adminforth.resource(this.resourceConfig.resourceId)
-                    .get([Filters.EQ(primaryKeyColumn.name, recordId)]);
-                if (!record) {
-                    return { ok: false, error: "Record not found" };
+                const { record, ctx, error } = yield this.getRecordForShow({
+                    adminUser,
+                    recordId,
+                    extra: { body, query, headers, cookies, requestUrl },
+                });
+                if (error) {
+                    return { ok: false, error };
                 }
-                record._label = this.resourceConfig.recordLabel(record);
-                return { ok: true, record };
+                return { ok: true, record: yield this.scopeRecordForFrontend(record, ctx) };
             })
         });
         server.endpoint({
             method: 'POST',
             path: `/plugin/${this.pluginInstanceId}/get_images`,
             request_schema: getImagesBodySchema,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response }) {
+            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, headers, query, cookies, requestUrl }) {
                 const data = body;
-                let images = [];
-                if (data.record) {
-                    for (const record of data.record) {
-                        if (this.options.attachFiles) {
-                            images.push(yield this.options.attachFiles({ record: record }));
-                        }
-                    }
+                // attachFiles runs with server privileges and usually mints download URLs, so it is only
+                // ever given a record loaded here after the show check, never one supplied by the client
+                const { record, error } = yield this.getRecordForShow({
+                    adminUser,
+                    recordId: data.recordId,
+                    extra: { body, query, headers, cookies, requestUrl },
+                });
+                if (error) {
+                    return { ok: false, error };
                 }
-                return {
-                    images,
-                };
+                const images = this.options.attachFiles ? yield this.options.attachFiles({ record }) : [];
+                return { ok: true, images };
             })
         });
         server.endpoint({
@@ -856,113 +1035,138 @@ export default class BulkAiFlowPlugin extends AdminForthPlugin {
             request_schema: updateFieldsBodySchema,
             handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, headers, response }) {
                 const data = body;
-                let isAllowedToSave = { ok: true, error: '' };
-                if (this.options.isAllowedToSave) {
-                    isAllowedToSave = yield this.options.isAllowedToSave({ record: {}, adminUser: adminUser, resource: this.resourceConfig });
-                }
-                if (isAllowedToSave.ok !== false) {
-                    const selectedIds = data.selectedIds || [];
-                    const fieldsToUpdate = data.fields || {};
-                    const saveImages = data.saveImages;
-                    const outputImageFields = [];
-                    if (this.options.generateImages) {
-                        for (const [key, value] of Object.entries(this.options.generateImages)) {
-                            outputImageFields.push(key);
-                        }
+                const selectedIds = data.selectedIds || [];
+                const fieldsToUpdate = data.fields || {};
+                const saveImages = data.saveImages;
+                const outputImageFields = [];
+                if (this.options.generateImages) {
+                    for (const [key, value] of Object.entries(this.options.generateImages)) {
+                        outputImageFields.push(key);
                     }
-                    const primaryKeyColumn = this.resourceConfig.columns.find((col) => col.primaryKey);
-                    const decimalFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'decimal').map(c => c.name);
-                    const integerFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'integer').map(c => c.name);
-                    const floatFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'float').map(c => c.name);
-                    const updates = selectedIds.map((ID, idx) => __awaiter(this, void 0, void 0, function* () {
-                        const oldRecord = yield this.adminforth.resource(this.resourceConfig.resourceId).get([Filters.EQ(primaryKeyColumn.name, ID)]);
-                        for (const [key, value] of Object.entries(outputImageFields)) {
-                            const columnPlugin = this.adminforth.activatedPlugins.find(p => p.resourceConfig.resourceId === this.resourceConfig.resourceId &&
-                                p.pluginOptions.pathColumnName === value);
-                            if (columnPlugin && saveImages) {
-                                if (columnPlugin.pluginOptions.storageAdapter.objectCanBeAccesedPublicly()) {
-                                    if (oldRecord[value]) {
-                                        // put tag to delete old file
-                                        try {
-                                            if (columnPlugin.pluginOptions.storageAdapter.markKeyForDeletion !== undefined) {
-                                                yield columnPlugin.pluginOptions.storageAdapter.markKeyForDeletion(oldRecord[value]);
-                                            }
-                                            else {
-                                                yield columnPlugin.pluginOptions.storageAdapter.markKeyForDeletation(oldRecord[value]);
-                                            }
-                                        }
-                                        catch (e) {
-                                            // file might be e.g. already deleted, so we catch error
-                                            console.error(`Error setting tag to true for object ${oldRecord[value]}. File will not be auto-cleaned up`);
-                                        }
-                                    }
-                                    if (fieldsToUpdate[idx][value] && fieldsToUpdate[idx][value] !== null) {
-                                        // remove tag from new file
-                                        // in this case we let it crash if it fails: this is a new file which just was uploaded.
-                                        if (columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletion !== undefined) {
-                                            yield columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletion(fieldsToUpdate[idx][value]);
+                }
+                const primaryKeyColumn = this.resourceConfig.columns.find((col) => col.primaryKey);
+                const decimalFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'decimal').map(c => c.name);
+                const integerFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'integer').map(c => c.name);
+                const floatFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'float').map(c => c.name);
+                // authorize every record before touching anything: this endpoint writes to the same
+                // table as the core edit route, so it has to enforce the same permissions
+                const managedFields = this.pluginManagedFields();
+                const oldRecords = [];
+                const sanitizedFields = [];
+                for (const [idx, ID] of selectedIds.entries()) {
+                    const oldRecord = yield this.adminforth.resource(this.resourceConfig.resourceId).get([Filters.EQ(primaryKeyColumn.name, ID)]);
+                    if (!oldRecord) {
+                        return { ok: false, error: `Record with ${primaryKeyColumn.name} ${ID} not found` };
+                    }
+                    const fields = fieldsToUpdate[idx];
+                    if (!fields || typeof fields !== 'object' || Array.isArray(fields)) {
+                        return { ok: false, error: `No fields to update passed for record ${ID}` };
+                    }
+                    const accessError = yield this.checkUpdateAllowed({
+                        adminUser,
+                        requestBody: body,
+                        recordId: ID,
+                        oldRecord,
+                        fields,
+                    });
+                    if (accessError) {
+                        return { ok: false, error: accessError };
+                    }
+                    oldRecords.push(oldRecord);
+                    // everything else (e.g. the primary key which frontend echoes back) is never written
+                    sanitizedFields.push(Object.fromEntries(Object.entries(fields).filter(([fieldName]) => managedFields.has(fieldName))));
+                }
+                const updates = selectedIds.map((ID, idx) => __awaiter(this, void 0, void 0, function* () {
+                    const oldRecord = oldRecords[idx];
+                    const recordFields = sanitizedFields[idx];
+                    for (const [key, value] of Object.entries(outputImageFields)) {
+                        const columnPlugin = this.adminforth.activatedPlugins.find(p => p.resourceConfig.resourceId === this.resourceConfig.resourceId &&
+                            p.pluginOptions.pathColumnName === value);
+                        if (columnPlugin && saveImages) {
+                            if (columnPlugin.pluginOptions.storageAdapter.objectCanBeAccesedPublicly()) {
+                                if (oldRecord[value]) {
+                                    // put tag to delete old file
+                                    try {
+                                        if (columnPlugin.pluginOptions.storageAdapter.markKeyForDeletion !== undefined) {
+                                            yield columnPlugin.pluginOptions.storageAdapter.markKeyForDeletion(oldRecord[value]);
                                         }
                                         else {
-                                            yield columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletation(fieldsToUpdate[idx][value]);
+                                            yield columnPlugin.pluginOptions.storageAdapter.markKeyForDeletation(oldRecord[value]);
                                         }
                                     }
+                                    catch (e) {
+                                        // file might be e.g. already deleted, so we catch error
+                                        console.error(`Error setting tag to true for object ${oldRecord[value]}. File will not be auto-cleaned up`);
+                                    }
                                 }
-                            }
-                        }
-                        // Convert decimal fields to numbers
-                        if (decimalFieldsArray.length > 0) {
-                            for (const fieldName of decimalFieldsArray) {
-                                if (fieldsToUpdate[idx].hasOwnProperty(fieldName)) {
-                                    fieldsToUpdate[idx][fieldName] = `${fieldsToUpdate[idx][fieldName]}`;
+                                if (recordFields[value] && recordFields[value] !== null) {
+                                    // remove tag from new file
+                                    // in this case we let it crash if it fails: this is a new file which just was uploaded.
+                                    if (columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletion !== undefined) {
+                                        yield columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletion(recordFields[value]);
+                                    }
+                                    else {
+                                        yield columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletation(recordFields[value]);
+                                    }
                                 }
                             }
                         }
-                        if (integerFieldsArray.length > 0) {
-                            for (const fieldName of integerFieldsArray) {
-                                if (fieldsToUpdate[idx].hasOwnProperty(fieldName)) {
-                                    fieldsToUpdate[idx][fieldName] = parseInt(fieldsToUpdate[idx][fieldName], 10);
-                                }
+                    }
+                    // Convert decimal fields to numbers
+                    if (decimalFieldsArray.length > 0) {
+                        for (const fieldName of decimalFieldsArray) {
+                            if (recordFields.hasOwnProperty(fieldName)) {
+                                recordFields[fieldName] = `${recordFields[fieldName]}`;
                             }
                         }
-                        if (floatFieldsArray.length > 0) {
-                            for (const fieldName of floatFieldsArray) {
-                                if (fieldsToUpdate[idx].hasOwnProperty(fieldName)) {
-                                    fieldsToUpdate[idx][fieldName] = parseFloat(fieldsToUpdate[idx][fieldName]);
-                                }
+                    }
+                    if (integerFieldsArray.length > 0) {
+                        for (const fieldName of integerFieldsArray) {
+                            if (recordFields.hasOwnProperty(fieldName)) {
+                                recordFields[fieldName] = parseInt(recordFields[fieldName], 10);
                             }
                         }
-                        const newRecord = Object.assign(Object.assign({}, oldRecord), fieldsToUpdate[idx]);
-                        return this.adminforth.updateResourceRecord({
-                            resource: this.resourceConfig,
-                            recordId: ID,
-                            oldRecord: oldRecord,
-                            updates: newRecord,
-                            adminUser: adminUser,
-                        });
-                    }));
-                    try {
-                        yield Promise.all(updates);
                     }
-                    catch (error) {
-                        return { ok: false, error: `Error updating records, because of unprocesseble data for record ID ${selectedIds}` };
+                    if (floatFieldsArray.length > 0) {
+                        for (const fieldName of floatFieldsArray) {
+                            if (recordFields.hasOwnProperty(fieldName)) {
+                                recordFields[fieldName] = parseFloat(recordFields[fieldName]);
+                            }
+                        }
                     }
-                    return { ok: true };
+                    const newRecord = Object.assign(Object.assign({}, oldRecord), recordFields);
+                    return this.adminforth.updateResourceRecord({
+                        resource: this.resourceConfig,
+                        recordId: ID,
+                        oldRecord: oldRecord,
+                        updates: newRecord,
+                        adminUser: adminUser,
+                    });
+                }));
+                try {
+                    yield Promise.all(updates);
                 }
-                else {
-                    return { ok: false, error: isAllowedToSave.error };
+                catch (error) {
+                    return { ok: false, error: `Error updating records, because of unprocesseble data for record ID ${selectedIds}` };
                 }
+                return { ok: true };
             })
         });
         server.endpoint({
             method: 'POST',
             path: `/plugin/${this.pluginInstanceId}/get_image_generation_prompts`,
             request_schema: getImageGenerationPromptsBodySchema,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, headers, response }) {
-                var _b;
+            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, headers, query, cookies, requestUrl }) {
                 const data = body;
-                const Id = data.recordId || [];
                 const customPrompt = data.customPrompt || null;
-                const record = yield this.adminforth.resource(this.resourceConfig.resourceId).get([Filters.EQ((_b = this.resourceConfig.columns.find(c => c.primaryKey)) === null || _b === void 0 ? void 0 : _b.name, Id)]);
+                const { record, error } = yield this.getRecordForShow({
+                    adminUser,
+                    recordId: data.recordId,
+                    extra: { body, query, headers, cookies, requestUrl },
+                });
+                if (error) {
+                    return { ok: false, error };
+                }
                 const compiledGenerationOptions = yield this.compileGenerationFieldTemplates(record, JSON.stringify({ "prompt": customPrompt }));
                 return compiledGenerationOptions;
             })
@@ -1141,6 +1345,11 @@ export default class BulkAiFlowPlugin extends AdminForthPlugin {
             handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, headers, query, cookies, requestUrl, response }) {
                 var _b, _c;
                 const resource = this.resourceConfig;
+                const { allowedActions } = yield interpretResource(adminUser, resource, { requestBody: body }, ActionCheckSource.ListRequest, this.adminforth);
+                const listAllowed = allowedActions[AllowedActionsEnum.list];
+                if (listAllowed !== true) {
+                    return { ok: false, error: typeof listAllowed === 'string' ? listAllowed : 'You are not allowed to list records in this resource' };
+                }
                 for (const hook of ((_c = (_b = resource.hooks) === null || _b === void 0 ? void 0 : _b.list) === null || _c === void 0 ? void 0 : _c.beforeDatasourceRequest) || []) {
                     const filterTools = filtersTools.get(body);
                     body.filtersTools = filterTools;

package/index.ts CHANGED Viewed

@@ -1,5 +1,5 @@
-import { AdminForthFilterOperators, AdminForthPlugin, Filters } from "adminforth";
-import type { IAdminForth, IHttpServer, AdminForthComponentDeclaration, AdminForthResource } from "adminforth";
+import { AdminForthFilterOperators, AdminForthPlugin, Filters, interpretResource, ActionCheckSource, AllowedActionsEnum } from "adminforth";
+import type { IAdminForth, IHttpServer, AdminForthComponentDeclaration, AdminForthResource, AdminUser } from "adminforth";
 import { suggestIfTypo, filtersTools } from "adminforth";
 import type { PluginOptions } from './types.js';
 import Handlebars from 'handlebars';
@@ -12,7 +12,7 @@ const getRecordsBodySchema = z.object({
 }).strict();
 const getImagesBodySchema = z.object({
-  record: z.array(z.any()).nullish(),
+  recordId: z.union([z.string(), z.number()]),
 }).strict();
 const getOldDataBodySchema = z.object({
@@ -26,7 +26,7 @@ const updateFieldsBodySchema = z.object({
 }).strict();
 const getImageGenerationPromptsBodySchema = z.object({
-  recordId: z.union([z.string(), z.number()]).nullish(),
+  recordId: z.union([z.string(), z.number()]),
   customPrompt: z.string().nullish(),
 }).strict();
@@ -58,6 +58,49 @@ const compileOldImageLinkBodySchema = z.object({
 const getFilteredIdsBodySchema = z.object({
   filters: z.any(),
 }).passthrough();
+type AccessCheckContext = {
+  adminUser: AdminUser;
+  resource: AdminForthResource;
+  meta: any;
+  source: ActionCheckSource;
+  adminforth: IAdminForth;
+};
+async function resolveBoolOrFn(val: any, ctx: AccessCheckContext): Promise<boolean> {
+  if (typeof val === 'function') {
+    return !!(await val(ctx));
+  }
+  return !!val;
+}
+async function isShownInEdit(column: AdminForthResource['columns'][number], ctx: AccessCheckContext): Promise<boolean> {
+  const showIn = (column.showIn as any) || {};
+  if (showIn.edit !== undefined) {
+    return await resolveBoolOrFn(showIn.edit, ctx);
+  }
+  if (showIn.all !== undefined) {
+    return await resolveBoolOrFn(showIn.all, ctx);
+  }
+  return true;
+}
+function valueIsUnchanged(newValue: any, oldValue: any): boolean {
+  if (newValue === oldValue) {
+    return true;
+  }
+  if (newValue === null || newValue === undefined || oldValue === null || oldValue === undefined) {
+    return false;
+  }
+  if (typeof newValue === 'object' || typeof oldValue === 'object') {
+    try {
+      return JSON.stringify(newValue) === JSON.stringify(oldValue);
+    } catch {
+      return false;
+    }
+  }
+  return String(newValue) === String(oldValue);
+}
 const STUB_MODE = false;
 const jobs = new Map();
 export default class  BulkAiFlowPlugin extends AdminForthPlugin {
@@ -828,25 +871,194 @@ export default class  BulkAiFlowPlugin extends AdminForthPlugin {
     return `${this.pluginOptions.actionName}`;
   }
+  pluginManagedFields(): Set<string> {
+    return new Set([
+      ...Object.keys(this.options.fillFieldsFromImages || {}),
+      ...Object.keys(this.options.fillPlainFields || {}),
+      ...Object.keys(this.options.generateImages || {}),
+    ]);
+  }
+  async checkUpdateAllowed({ adminUser, requestBody, recordId, oldRecord, fields }: {
+    adminUser: AdminUser,
+    requestBody: any,
+    recordId: any,
+    oldRecord: any,
+    fields: Record<string, any>,
+  }): Promise<string | null> {
+    const meta = { requestBody, newRecord: fields, oldRecord, pk: recordId };
+    const ctx: AccessCheckContext = {
+      adminUser,
+      resource: this.resourceConfig,
+      meta,
+      source: ActionCheckSource.EditRequest,
+      adminforth: this.adminforth,
+    };
+    const { allowedActions } = await interpretResource(
+      adminUser,
+      this.resourceConfig,
+      meta,
+      ActionCheckSource.EditRequest,
+      this.adminforth,
+    );
+    const editAllowed = allowedActions[AllowedActionsEnum.edit] as boolean | string | undefined;
+    if (editAllowed !== true) {
+      return typeof editAllowed === 'string' ? editAllowed : 'You are not allowed to edit records in this resource';
+    }
+    const managedFields = this.pluginManagedFields();
+    for (const [fieldName, value] of Object.entries(fields)) {
+      if (valueIsUnchanged(value, oldRecord[fieldName])) {
+        continue;
+      }
+      const column = this.resourceConfig.columns.find((col) => col.name === fieldName);
+      if (!column) {
+        return `Field "${fieldName}" does not exist in resource "${this.resourceConfig.resourceId}"`;
+      }
+      if (!managedFields.has(fieldName)) {
+        return `Field "${fieldName}" cannot be modified, it is not generated by the "${this.options.actionName}" action`;
+      }
+      if (column.primaryKey) {
+        return `Field "${fieldName}" cannot be modified as it is a primary key`;
+      }
+      if (await resolveBoolOrFn(column.backendOnly, ctx)) {
+        return `Field "${fieldName}" cannot be modified as it is restricted from editing (backendOnly is true).`;
+      }
+      if (column.editReadonly) {
+        return `Field "${fieldName}" cannot be modified as it is restricted from editing (editReadonly is true).`;
+      }
+      if (!(await isShownInEdit(column, ctx)) && !column.allowModifyWhenNotShowInEdit) {
+        return `Field "${fieldName}" cannot be modified as it is restricted from editing (showIn.edit is false). If you need to allow updating this hidden field, set column.allowModifyWhenNotShowInEdit = true.`;
+      }
+    }
+    if (this.options.isAllowedToSave) {
+      const isAllowedToSave = await this.options.isAllowedToSave({
+        record: oldRecord,
+        adminUser: adminUser,
+        resource: this.resourceConfig,
+      });
+      if (isAllowedToSave?.ok === false) {
+        return isAllowedToSave.error;
+      }
+    }
+    return null;
+  }
+  /**
+   * Reads one record the way the core show route does: the resource-level `show` permission first,
+   * then the resource's own `show.beforeDatasourceRequest` hooks so row-level scoping narrows the
+   * filters before the query runs.
+   * The returned record is the raw row, so callers which send it to the browser must pass it
+   * through `scopeRecordForFrontend` first.
+   */
+  private async getRecordForShow({ adminUser, recordId, extra }: {
+    adminUser: AdminUser,
+    recordId: any,
+    extra: { body: any, query: any, headers: any, cookies: any, requestUrl: string },
+  }): Promise<{ record?: any, ctx?: AccessCheckContext, error?: string }> {
+    const meta = { requestBody: extra.body, pk: recordId };
+    const ctx: AccessCheckContext = {
+      adminUser,
+      resource: this.resourceConfig,
+      meta,
+      source: ActionCheckSource.ShowRequest,
+      adminforth: this.adminforth,
+    };
+    const { allowedActions } = await interpretResource(
+      adminUser,
+      this.resourceConfig,
+      meta,
+      ActionCheckSource.ShowRequest,
+      this.adminforth,
+    );
+    const showAllowed = allowedActions[AllowedActionsEnum.show] as boolean | string | undefined;
+    if (showAllowed !== true) {
+      return { error: typeof showAllowed === 'string' ? showAllowed : 'You are not allowed to view records in this resource' };
+    }
+    const primaryKeyColumn = this.resourceConfig.columns.find((col) => col.primaryKey);
+    const hookQuery: any = {
+      resourceId: this.resourceConfig.resourceId,
+      source: 'show',
+      filters: [Filters.EQ(primaryKeyColumn.name, recordId)],
+      limit: 1,
+      offset: 0,
+      sort: [],
+    };
+    for (const hook of this.resourceConfig.hooks?.show?.beforeDatasourceRequest || []) {
+      const filterTools = filtersTools.get(hookQuery);
+      hookQuery.filtersTools = filterTools;
+      const resp = await hook({
+        resource: this.resourceConfig,
+        query: hookQuery,
+        adminUser,
+        //@ts-ignore
+        filtersTools: filterTools,
+        extra,
+        adminforth: this.adminforth,
+      });
+      if (!resp || (!resp.ok && !resp.error)) {
+        throw new Error(`Hook must return object with {ok: true} or { error: 'Error' } `);
+      }
+      if (resp.error) {
+        return { error: resp.error };
+      }
+    }
+    const record = await this.adminforth.resource(this.resourceConfig.resourceId).get(hookQuery.filters);
+    if (!record) {
+      return { error: 'Record not found' };
+    }
+    return { record, ctx };
+  }
+  /**
+   * The action dialog only ever renders the fields this plugin generates, so only those leave the
+   * backend, next to the primary key and the record label. backendOnly columns are dropped the same
+   * way the core show route drops them.
+   */
+  private async scopeRecordForFrontend(record: any, ctx: AccessCheckContext): Promise<Record<string, any>> {
+    const primaryKeyColumn = this.resourceConfig.columns.find((col) => col.primaryKey);
+    const managedFields = this.pluginManagedFields();
+    const scoped: Record<string, any> = {
+      [primaryKeyColumn.name]: record[primaryKeyColumn.name],
+      _label: this.resourceConfig.recordLabel(record),
+    };
+    for (const column of this.resourceConfig.columns.filter((col) => managedFields.has(col.name))) {
+      if (await resolveBoolOrFn(column.backendOnly, ctx)) {
+        continue;
+      }
+      scoped[column.name] = record[column.name];
+    }
+    return scoped;
+  }
   setupEndpoints(server: IHttpServer) {
     server.endpoint({
       method: 'POST',
       path: `/plugin/${this.pluginInstanceId}/get_old_data`,
       request_schema: getOldDataBodySchema,
-      handler: async ({ body, response }) => {
+      handler: async ({ body, adminUser, headers, query, cookies, requestUrl }) => {
         const data = body as z.infer<typeof getOldDataBodySchema>;
         const recordId = data.recordId;
         if (recordId === undefined || recordId === null) {
           return { ok: false, error: "Missing recordId" };
         }
-        const primaryKeyColumn = this.resourceConfig.columns.find((col) => col.primaryKey);
-        const record = await this.adminforth.resource(this.resourceConfig.resourceId)
-          .get([Filters.EQ(primaryKeyColumn.name, recordId)]);
-        if (!record) {
-          return { ok: false, error: "Record not found" };
+        const { record, ctx, error } = await this.getRecordForShow({
+          adminUser,
+          recordId,
+          extra: { body, query, headers, cookies, requestUrl },
+        });
+        if (error) {
+          return { ok: false, error };
         }
-        record._label = this.resourceConfig.recordLabel(record);
-        return { ok: true, record };
+        return { ok: true, record: await this.scopeRecordForFrontend(record, ctx) };
       }
     });
@@ -855,19 +1067,20 @@ export default class  BulkAiFlowPlugin extends AdminForthPlugin {
       method: 'POST',
       path: `/plugin/${this.pluginInstanceId}/get_images`,
       request_schema: getImagesBodySchema,
-      handler: async ({ body, response }) => {
+      handler: async ({ body, adminUser, headers, query, cookies, requestUrl }) => {
         const data = body as z.infer<typeof getImagesBodySchema>;
-        let images = [];
-        if(data.record){
-          for( const record of data.record ) {
-            if (this.options.attachFiles) {
-              images.push(await this.options.attachFiles({ record: record }));
-            }
-          }
+        // attachFiles runs with server privileges and usually mints download URLs, so it is only
+        // ever given a record loaded here after the show check, never one supplied by the client
+        const { record, error } = await this.getRecordForShow({
+          adminUser,
+          recordId: data.recordId,
+          extra: { body, query, headers, cookies, requestUrl },
+        });
+        if (error) {
+          return { ok: false, error };
         }
-        return {
-          images,
-        };
+        const images = this.options.attachFiles ? await this.options.attachFiles({ record }) : [];
+        return { ok: true, images };
       }
     });
@@ -878,105 +1091,129 @@ export default class  BulkAiFlowPlugin extends AdminForthPlugin {
       request_schema: updateFieldsBodySchema,
       handler: async ({ body, adminUser, headers, response }) => {
         const data = body as z.infer<typeof updateFieldsBodySchema>;
-        let isAllowedToSave: any = { ok: true, error: '' };
-        if(this.options.isAllowedToSave) {
-          isAllowedToSave = await this.options.isAllowedToSave({ record: {}, adminUser: adminUser, resource: this.resourceConfig });
+        const selectedIds = data.selectedIds || [];
+        const fieldsToUpdate = data.fields || {};
+        const saveImages = data.saveImages;
+        const outputImageFields = [];
+        if (this.options.generateImages) {
+          for (const [key, value] of Object.entries(this.options.generateImages)) {
+            outputImageFields.push(key);
+          }
         }
-        if (isAllowedToSave.ok !== false) {
-          const selectedIds = data.selectedIds || [];
-          const fieldsToUpdate = data.fields || {};
-          const saveImages = data.saveImages;
-          const outputImageFields = [];
-          if (this.options.generateImages) {
-            for (const [key, value] of Object.entries(this.options.generateImages)) {
-              outputImageFields.push(key);
-            }
+        const primaryKeyColumn = this.resourceConfig.columns.find((col) => col.primaryKey);
+        const decimalFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'decimal').map(c => c.name);
+        const integerFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'integer').map(c => c.name);
+        const floatFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'float').map(c => c.name);
+        // authorize every record before touching anything: this endpoint writes to the same
+        // table as the core edit route, so it has to enforce the same permissions
+        const managedFields = this.pluginManagedFields();
+        const oldRecords: any[] = [];
+        const sanitizedFields: Record<string, any>[] = [];
+        for (const [idx, ID] of selectedIds.entries()) {
+          const oldRecord = await this.adminforth.resource(this.resourceConfig.resourceId).get( [Filters.EQ(primaryKeyColumn.name, ID)] );
+          if (!oldRecord) {
+            return { ok: false, error: `Record with ${primaryKeyColumn.name} ${ID} not found` };
           }
-          const primaryKeyColumn = this.resourceConfig.columns.find((col) => col.primaryKey);
-          const decimalFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'decimal').map(c => c.name);
-          const integerFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'integer').map(c => c.name);
-          const floatFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'float').map(c => c.name);
-          const updates = selectedIds.map(async (ID, idx) => {
-            const oldRecord = await this.adminforth.resource(this.resourceConfig.resourceId).get( [Filters.EQ(primaryKeyColumn.name, ID)] );
-            for (const [key, value] of Object.entries(outputImageFields)) {
-              const columnPlugin = this.adminforth.activatedPlugins.find(p =>
-                p.resourceConfig!.resourceId === this.resourceConfig.resourceId &&
-                p.pluginOptions.pathColumnName === value
-              );
-              if (columnPlugin && saveImages) {
-                if(columnPlugin.pluginOptions.storageAdapter.objectCanBeAccesedPublicly()) {
-                  if (oldRecord[value]) {
-                    // put tag to delete old file
-                    try {
-                      if (columnPlugin.pluginOptions.storageAdapter.markKeyForDeletion !== undefined) {
-                        await columnPlugin.pluginOptions.storageAdapter.markKeyForDeletion(oldRecord[value]);
-                      } else {
-                        await columnPlugin.pluginOptions.storageAdapter.markKeyForDeletation(oldRecord[value]);
-                      }
-                    } catch (e) {
-                      // file might be e.g. already deleted, so we catch error
-                      console.error(`Error setting tag to true for object ${oldRecord[value]}. File will not be auto-cleaned up`);
-                    }
-                  }
-                  if (fieldsToUpdate[idx][value] && fieldsToUpdate[idx][value] !== null) {
-                  // remove tag from new file
-                  // in this case we let it crash if it fails: this is a new file which just was uploaded.
-                    if (columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletion !== undefined) {
-                      await  columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletion(fieldsToUpdate[idx][value]);
+          const fields = fieldsToUpdate[idx];
+          if (!fields || typeof fields !== 'object' || Array.isArray(fields)) {
+            return { ok: false, error: `No fields to update passed for record ${ID}` };
+          }
+          const accessError = await this.checkUpdateAllowed({
+            adminUser,
+            requestBody: body,
+            recordId: ID,
+            oldRecord,
+            fields,
+          });
+          if (accessError) {
+            return { ok: false, error: accessError };
+          }
+          oldRecords.push(oldRecord);
+          // everything else (e.g. the primary key which frontend echoes back) is never written
+          sanitizedFields.push(Object.fromEntries(
+            Object.entries(fields).filter(([fieldName]) => managedFields.has(fieldName))
+          ));
+        }
+        const updates = selectedIds.map(async (ID, idx) => {
+          const oldRecord = oldRecords[idx];
+          const recordFields = sanitizedFields[idx];
+          for (const [key, value] of Object.entries(outputImageFields)) {
+            const columnPlugin = this.adminforth.activatedPlugins.find(p =>
+              p.resourceConfig!.resourceId === this.resourceConfig.resourceId &&
+              p.pluginOptions.pathColumnName === value
+            );
+            if (columnPlugin && saveImages) {
+              if(columnPlugin.pluginOptions.storageAdapter.objectCanBeAccesedPublicly()) {
+                if (oldRecord[value]) {
+                  // put tag to delete old file
+                  try {
+                    if (columnPlugin.pluginOptions.storageAdapter.markKeyForDeletion !== undefined) {
+                      await columnPlugin.pluginOptions.storageAdapter.markKeyForDeletion(oldRecord[value]);
                     } else {
-                      await  columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletation(fieldsToUpdate[idx][value]);
+                      await columnPlugin.pluginOptions.storageAdapter.markKeyForDeletation(oldRecord[value]);
                     }
+                  } catch (e) {
+                    // file might be e.g. already deleted, so we catch error
+                    console.error(`Error setting tag to true for object ${oldRecord[value]}. File will not be auto-cleaned up`);
+                  }
+                }
+                if (recordFields[value] && recordFields[value] !== null) {
+                // remove tag from new file
+                // in this case we let it crash if it fails: this is a new file which just was uploaded.
+                  if (columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletion !== undefined) {
+                    await  columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletion(recordFields[value]);
+                  } else {
+                    await  columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletation(recordFields[value]);
                   }
                 }
               }
             }
+          }
-            // Convert decimal fields to numbers
-            if (decimalFieldsArray.length > 0) {
-              for (const fieldName of decimalFieldsArray) {
-                if (fieldsToUpdate[idx].hasOwnProperty(fieldName)) {
-                  fieldsToUpdate[idx][fieldName] = `${fieldsToUpdate[idx][fieldName]}`;
-                }
+          // Convert decimal fields to numbers
+          if (decimalFieldsArray.length > 0) {
+            for (const fieldName of decimalFieldsArray) {
+              if (recordFields.hasOwnProperty(fieldName)) {
+                recordFields[fieldName] = `${recordFields[fieldName]}`;
               }
             }
-            if (integerFieldsArray.length > 0) {
-              for (const fieldName of integerFieldsArray) {
-                if (fieldsToUpdate[idx].hasOwnProperty(fieldName)) {
-                  fieldsToUpdate[idx][fieldName] = parseInt(fieldsToUpdate[idx][fieldName], 10);
-                }
+          }
+          if (integerFieldsArray.length > 0) {
+            for (const fieldName of integerFieldsArray) {
+              if (recordFields.hasOwnProperty(fieldName)) {
+                recordFields[fieldName] = parseInt(recordFields[fieldName], 10);
               }
             }
-            if (floatFieldsArray.length > 0) {
-              for (const fieldName of floatFieldsArray) {
-                if (fieldsToUpdate[idx].hasOwnProperty(fieldName)) {
-                  fieldsToUpdate[idx][fieldName] = parseFloat(fieldsToUpdate[idx][fieldName]);
-                }
+          }
+          if (floatFieldsArray.length > 0) {
+            for (const fieldName of floatFieldsArray) {
+              if (recordFields.hasOwnProperty(fieldName)) {
+                recordFields[fieldName] = parseFloat(recordFields[fieldName]);
               }
             }
-            const newRecord = {
-              ...oldRecord,
-              ...fieldsToUpdate[idx]
-            };
-            return this.adminforth.updateResourceRecord({
-              resource: this.resourceConfig,
-              recordId: ID,
-              oldRecord: oldRecord,
-              updates: newRecord,
-              adminUser: adminUser,
-            })
-          });
-          try {
-            await Promise.all(updates);
-          } catch (error) {
-            return { ok: false, error: `Error updating records, because of unprocesseble data for record ID ${selectedIds}` };
           }
-          return { ok: true };
-        } else {
-          return { ok: false, error: isAllowedToSave.error };
+          const newRecord = {
+            ...oldRecord,
+            ...recordFields
+          };
+          return this.adminforth.updateResourceRecord({
+            resource: this.resourceConfig,
+            recordId: ID,
+            oldRecord: oldRecord,
+            updates: newRecord,
+            adminUser: adminUser,
+          })
+        });
+        try {
+          await Promise.all(updates);
+        } catch (error) {
+          return { ok: false, error: `Error updating records, because of unprocesseble data for record ID ${selectedIds}` };
         }
+        return { ok: true };
       }
     });
@@ -985,11 +1222,17 @@ export default class  BulkAiFlowPlugin extends AdminForthPlugin {
       method: 'POST',
       path: `/plugin/${this.pluginInstanceId}/get_image_generation_prompts`,
       request_schema: getImageGenerationPromptsBodySchema,
-      handler: async ({ body, headers, response }) => {
+      handler: async ({ body, adminUser, headers, query, cookies, requestUrl }) => {
         const data = body as z.infer<typeof getImageGenerationPromptsBodySchema>;
-        const Id = data.recordId || [];
         const customPrompt = data.customPrompt || null;
-        const record = await this.adminforth.resource(this.resourceConfig.resourceId).get([Filters.EQ(this.resourceConfig.columns.find(c => c.primaryKey)?.name, Id)]);
+        const { record, error } = await this.getRecordForShow({
+          adminUser,
+          recordId: data.recordId,
+          extra: { body, query, headers, cookies, requestUrl },
+        });
+        if (error) {
+          return { ok: false, error };
+        }
         const compiledGenerationOptions = await this.compileGenerationFieldTemplates(record, JSON.stringify({"prompt": customPrompt}));
         return compiledGenerationOptions;
       }
@@ -1179,6 +1422,18 @@ export default class  BulkAiFlowPlugin extends AdminForthPlugin {
       handler: async ({ body, adminUser, headers, query, cookies, requestUrl, response }) => {
         const resource = this.resourceConfig;
+        const { allowedActions } = await interpretResource(
+          adminUser,
+          resource,
+          { requestBody: body },
+          ActionCheckSource.ListRequest,
+          this.adminforth,
+        );
+        const listAllowed = allowedActions[AllowedActionsEnum.list] as boolean | string | undefined;
+        if (listAllowed !== true) {
+          return { ok: false, error: typeof listAllowed === 'string' ? listAllowed : 'You are not allowed to list records in this resource' };
+        }
         for (const hook of resource.hooks?.list?.beforeDatasourceRequest || []) {
           const filterTools = filtersTools.get(body);
           body.filtersTools = filterTools;

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/bulk-ai-flow",
-  "version": "1.27.3",
+  "version": "1.27.5",
   "publishConfig": {
     "access": "public"
   },