@adminforth/list-in-place-edit 1.0.23 → 1.0.25

package/build.log

@@ -7,5 +7,5 @@ custom/
 custom/InPlaceEdit.vue
 custom/tsconfig.json
 
-sent 5,347 bytes  received 58 bytes  10,810.00 bytes/sec
+sent 5,344 bytes  received 58 bytes  10,804.00 bytes/sec
 total size is 5,132  speedup is 0.95

package/dist/index.js

@@ -56,7 +56,16 @@ export default class ListInPlaceEditPlugin extends AdminForthPlugin {
             path: `/plugin/${this.pluginInstanceId}/update-field`,
             handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser }) {
                 const { resourceId, recordId, field, value } = body;
+                if (this.resourceConfig.resourceId !== resourceId) {
+                    return { error: 'Resource ID mismatch' };
+                }
+                if (!this.options.columns.includes(field)) {
+                    return { error: 'Field not allowed to be edited' };
+                }
                 const resource = this.adminforth.config.resources.find(r => r.resourceId === resourceId);
+                if (resource.columns.some(c => c.name === field && c.backendOnly === true)) {
+                    return { error: 'Field is not editable, because it is marked as backendOnly' };
+                }
                 // Create update object with just the single field
                 const updateRecord = { [field]: value };
                 // Use AdminForth's built-in update method

package/index.ts

@@ -55,8 +55,16 @@ export default class ListInPlaceEditPlugin extends AdminForthPlugin {
       path: `/plugin/${this.pluginInstanceId}/update-field`,
       handler: async ({ body, adminUser }) => {
         const { resourceId, recordId, field, value } = body;
-
+        if (this.resourceConfig.resourceId !== resourceId) {
+          return { error: 'Resource ID mismatch' };
+        }
+        if (!this.options.columns.includes(field)) {
+          return { error: 'Field not allowed to be edited' };
+        }
         const resource = this.adminforth.config.resources.find(r => r.resourceId === resourceId);
+        if (resource.columns.some(c => c.name === field && c.backendOnly === true)) {
+          return { error: 'Field is not editable, because it is marked as backendOnly' };
+        }
         // Create update object with just the single field
         const updateRecord = { [field]: value };
         

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/list-in-place-edit",
-  "version": "1.0.23",
+  "version": "1.0.25",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "module",
@@ -19,7 +19,7 @@
   "description": "AdminForth List In Place Edit Plugin",
   "devDependencies": {
     "@types/node": "^22.10.7",
-    "adminforth": "^3.1.0",
+    "adminforth": "^3.6.2",
     "semantic-release": "^24.2.1",
     "semantic-release-slack-bot": "^4.0.2",
     "typescript": "^5.7.3"
@@ -32,7 +32,7 @@
     "vue-i18n": "^11.1.3"
   },
   "peerDependencies": {
-    "adminforth": "^3.1.0"
+    "adminforth": "^3.6.2"
   },
   "release": {
     "plugins": [

package/pnpm-workspace.yaml

@@ -0,0 +1,2 @@
+allowBuilds:
+  adminforth: true