@shamar/adonis 0.1.0

package/dist/controllers/admin_controller.js

@@ -0,0 +1,1075 @@
+import { resolveGridItemStyle, isValidationException } from '@shamar/core';
+import { Authorizer as AuthorizerClass } from '@shamar/cherubim';
+import { ResourceController } from '../controller.js';
+import { authRequired, assertResourceAccess, buildAuthContext, ForbiddenError, resourcePolicyFlags, respondForbidden, respondUnauthorized, UnauthorizedError, } from '../shamar/auth.js';
+import { buildListContext, buildShellContext, readFlash, } from '../shamar/view-context.js';
+import { decorateRevokedStatus, resourceActionsFor, visibleRowActions, } from '../shamar/resource-actions.js';
+import { buildListHeaders, groupRecordsForDisplay, labelListFilters, resolveDefaultFilters, } from '../shamar/list-headers.js';
+import { formSections, formSchemaTree, detailSections, detailSchemaTree, normalizeListQuery, recordTitle, LIST_ALL_RECORDS_PER_PAGE, RECORD_NAV_CAP, recordNavQuery, buildRecordPager, toFormControlValue, parseCurrencyInput, } from '../shamar/list-query.js';
+import { evaluateFormState, formClientFields } from '../form-state.js';
+import { buildRelationUiConfig, collectRelationIds, isRelationField, recordSummaryLabel, resolveRelatedMeta, relationTitleAttribute, } from '../shamar/relation-fields.js';
+import { hydrateRecordsForDisplay } from '../shamar/display-relations.js';
+export class AdminController {
+    panel;
+    config;
+    resources;
+    basePath;
+    registry;
+    panelBranding;
+    authorizer;
+    constructor(panel, config, authorizer) {
+        this.panel = panel;
+        this.config = config;
+        this.registry = panel.registry;
+        this.basePath = panel.path;
+        this.panelBranding = panel.config.branding ?? config.branding;
+        this.resources = new ResourceController(panel.adapter);
+        this.authorizer = authorizer ?? new AuthorizerClass();
+    }
+    isAuthContext(value) {
+        return typeof value === 'object' && value !== null && 'user' in value;
+    }
+    async resolveAuth(ctx) {
+        return buildAuthContext(ctx, this.config, this.panel.id);
+    }
+    async ensureAuthenticated(ctx, asJson = false) {
+        const authCtx = await this.resolveAuth(ctx);
+        const json = asJson || this.wantsJson(ctx);
+        if (authRequired(this.config) && !authCtx.user) {
+            return respondUnauthorized(ctx, this.config, json);
+        }
+        return authCtx;
+    }
+    async ensureResourceAction(ctx, meta, action, record, asJson = false) {
+        const authResult = await this.ensureAuthenticated(ctx, asJson);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        const authCtx = authResult;
+        if (!authRequired(this.config))
+            return authCtx;
+        try {
+            assertResourceAccess(this.authorizer, authCtx, this.registry, meta, action, record);
+        }
+        catch (error) {
+            if (error instanceof ForbiddenError) {
+                return respondForbidden(ctx, error.message, asJson || this.wantsJson(ctx), this.basePath);
+            }
+            if (error instanceof UnauthorizedError) {
+                return respondUnauthorized(ctx, this.config, asJson || this.wantsJson(ctx));
+            }
+            throw error;
+        }
+        return authCtx;
+    }
+    shellOpts(ctx, authCtx, extras) {
+        const policy = extras.meta && authCtx.user
+            ? resourcePolicyFlags(this.authorizer, authCtx, this.registry, extras.meta, extras.record)
+            : null;
+        const { showCreateButton, showEditButton, showDeleteButton, record, ...rest } = extras;
+        return buildShellContext({
+            config: this.config,
+            registry: this.registry,
+            basePath: this.basePath,
+            branding: this.panelBranding,
+            authorizer: this.authorizer,
+            authCtx,
+            flash: readFlash(ctx),
+            showCreateButton: showCreateButton === true ? policy?.create ?? true : showCreateButton,
+            showEditButton: showEditButton === true ? policy?.update ?? true : showEditButton,
+            showDeleteButton: showDeleteButton === true ? policy?.delete ?? true : showDeleteButton,
+            ...rest,
+        });
+    }
+    async dashboard(ctx) {
+        const authResult = await this.ensureAuthenticated(ctx);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        const authCtx = authResult;
+        const shell = this.shellOpts(ctx, authCtx, { pageTitle: 'Dashboard' });
+        const dashboardCards = shell.menuRoots.filter((root) => root.label !== 'Dashboard');
+        return ctx.view.render('shamar::dashboard', {
+            ...shell,
+            dashboardCards,
+        });
+    }
+    async index(ctx, options) {
+        const meta = this.requireResource(ctx);
+        const authResult = await this.ensureResourceAction(ctx, meta, 'viewAny', undefined, options?.asJson);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        const authCtx = authResult;
+        const rawQuery = this.listQuery(ctx);
+        const listHeaders = buildListHeaders(meta);
+        const filtersParam = ctx.request.input('filters');
+        const groupByParam = ctx.request.input('groupBy');
+        const hasFiltersParam = filtersParam !== undefined && filtersParam !== null;
+        const hasGroupByParam = groupByParam !== undefined && groupByParam !== null;
+        const normalized = normalizeListQuery(rawQuery);
+        if (!hasFiltersParam && meta.defaultFilters?.length) {
+            normalized.filters = resolveDefaultFilters(meta, listHeaders);
+        }
+        else if (normalized.filters?.length) {
+            normalized.filters = labelListFilters(normalized.filters, listHeaders);
+        }
+        if (!hasGroupByParam && meta.defaultGroupBy) {
+            normalized.groupBy = meta.defaultGroupBy;
+        }
+        else if (hasGroupByParam && String(groupByParam).trim() === '') {
+            normalized.groupBy = undefined;
+        }
+        // Adapter sorts/filters on FK fields; display grouping uses the column path.
+        const displayGroupBy = normalized.groupBy;
+        const groupHeader = listHeaders.find((header) => header.name === displayGroupBy || header.filterField === displayGroupBy);
+        const adapterGroupBy = groupHeader?.filterField || displayGroupBy;
+        const query = this.withPolicyScope(authCtx, meta, {
+            ...normalized,
+            groupBy: adapterGroupBy,
+        });
+        if (this.wantsJson(ctx, options?.asJson)) {
+            const result = await this.resources.index(meta, query);
+            await hydrateRecordsForDisplay(meta, result.items, this.registry, this.panel.adapter);
+            decorateRevokedStatus(result.items);
+            return ctx.response.json(result);
+        }
+        const result = await this.resources.index(meta, query);
+        await hydrateRecordsForDisplay(meta, result.items, this.registry, this.panel.adapter);
+        decorateRevokedStatus(result.items);
+        const { query: viewQuery, pagination, perPageValue } = buildListContext({
+            basePath: this.basePath,
+            meta,
+            query: rawQuery,
+            result,
+        });
+        const policy = resourcePolicyFlags(this.authorizer, authCtx, this.registry, meta);
+        const shell = this.shellOpts(ctx, authCtx, {
+            meta,
+            pageTitle: meta.label,
+            showCreateButton: policy.create,
+            showEditButton: policy.update,
+            showDeleteButton: policy.delete,
+        });
+        const groups = groupRecordsForDisplay(result.items, displayGroupBy, listHeaders);
+        return ctx.view.render('shamar::index', {
+            ...shell,
+            meta,
+            resource: meta,
+            result,
+            groups,
+            query: {
+                ...viewQuery,
+                perPage: perPageValue,
+                filters: normalized.filters ?? [],
+                groupBy: displayGroupBy ?? null,
+            },
+            pagination,
+            listHeaders,
+            listAllPerPage: LIST_ALL_RECORDS_PER_PAGE,
+            filtersLockedEmpty: hasFiltersParam && !(normalized.filters?.length),
+            groupLockedEmpty: hasGroupByParam && !displayGroupBy,
+            bulkActions: resourceActionsFor(meta, 'bulk', policy),
+            rowActions: resourceActionsFor(meta, 'row', policy),
+        });
+    }
+    async create(ctx, options) {
+        const meta = this.requireResource(ctx);
+        const authResult = await this.ensureResourceAction(ctx, meta, 'create', undefined, options?.asJson);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        const authCtx = authResult;
+        if (this.wantsJson(ctx, options?.asJson)) {
+            return ctx.response.json({ meta, fields: meta.fields });
+        }
+        const embed = this.isEmbed(ctx);
+        const policy = resourcePolicyFlags(this.authorizer, authCtx, this.registry, meta);
+        const shell = this.shellOpts(ctx, authCtx, {
+            meta,
+            pageTitle: `New ${meta.singularLabel}`,
+            showBackToList: false,
+            recordBreadcrumb: { mode: 'create' },
+        });
+        const initialState = this.initialFormState(meta, null, 'create');
+        this.applyCreateQueryDefaults(ctx, meta, initialState);
+        const relationUi = await this.buildRelationUiMap(meta, null, 'create', initialState);
+        return ctx.view.render('shamar::form', {
+            ...shell,
+            meta,
+            resource: meta,
+            record: null,
+            mode: 'create',
+            embed,
+            /** Create-once resources (canEdit false) redirect to show after AJAX create. */
+            redirectAfterCreateToShow: !policy.update,
+            formSchema: formSchemaTree(meta),
+            formSections: formSections(meta),
+            formLiveFields: formClientFields(meta, {
+                state: initialState,
+                record: null,
+                operation: 'create',
+            }),
+            formStateEndpoint: `${this.basePath}/${meta.slug}/form-state`,
+            formInitialState: initialState,
+            formErrors: {},
+            relationUi,
+            recordPager: null,
+            resolveGridItemStyle,
+        });
+    }
+    async store(ctx, options) {
+        const meta = this.requireResource(ctx);
+        const authResult = await this.ensureResourceAction(ctx, meta, 'create', undefined, options?.asJson);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        let data = this.resourcePayload(meta, ctx, 'create');
+        let flashPlainText;
+        let flashMessage;
+        try {
+            const ResourceClass = this.registry.resourceClass(meta.slug);
+            if (ResourceClass?.prepareCreate) {
+                const prepared = await ResourceClass.prepareCreate(data, {
+                    adapter: this.panel.adapter,
+                    meta,
+                    userId: authResult.user?.id ?? null,
+                });
+                data = prepared.data;
+                flashPlainText = prepared.flashPlainText;
+                flashMessage = prepared.flashMessage;
+            }
+            const record = await this.resources.store(meta, data);
+            if (this.wantsJson(ctx, options?.asJson)) {
+                // AJAX create shows a copy-and-confirm modal; only flash a short success for after.
+                if (flashPlainText) {
+                    ctx.session.flash('success', `${meta.singularLabel} created`);
+                }
+                return ctx.response.created({
+                    ...record,
+                    ...(flashPlainText ? { plainText: flashPlainText } : {}),
+                });
+            }
+            return this.redirectAfterSave(ctx, meta, String(record.id), 'created', {
+                flashPlainText,
+                flashMessage,
+                authCtx: authResult,
+            });
+        }
+        catch (error) {
+            return this.handleFormValidationError(ctx, meta, error, {
+                mode: 'create',
+                record: null,
+                data,
+                asJson: options?.asJson,
+                authCtx: authResult,
+            });
+        }
+    }
+    async show(ctx, options) {
+        const meta = this.requireResource(ctx);
+        const { id } = ctx.params;
+        const record = await this.resources.show(meta, id);
+        const authResult = await this.ensureResourceAction(ctx, meta, 'view', record, options?.asJson);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        const authCtx = authResult;
+        await hydrateRecordsForDisplay(meta, [record], this.registry, this.panel.adapter);
+        decorateRevokedStatus([record]);
+        if (this.wantsJson(ctx, options?.asJson)) {
+            return ctx.response.json(record);
+        }
+        const title = recordTitle(meta, record);
+        const policy = resourcePolicyFlags(this.authorizer, authCtx, this.registry, meta, record);
+        const shell = this.shellOpts(ctx, authCtx, {
+            meta,
+            record,
+            pageTitle: title,
+            showEditButton: policy.update,
+            showDeleteButton: policy.delete,
+            showBackToList: false,
+            recordBreadcrumb: {
+                mode: 'show',
+                recordTitle: title,
+            },
+        });
+        const relationUi = await this.buildRelationUiMap(meta, record, 'show', record);
+        return ctx.view.render('shamar::show', {
+            ...shell,
+            meta,
+            resource: meta,
+            record,
+            id: record.id,
+            detailSchema: detailSchemaTree(meta),
+            detailSections: detailSections(meta),
+            relationUi,
+            formErrors: {},
+            recordPager: await this.resolveRecordPager(ctx, meta, String(record.id), 'show'),
+            resolveGridItemStyle,
+            recordActions: visibleRowActions(meta, policy, record),
+        });
+    }
+    async edit(ctx, options) {
+        const meta = this.requireResource(ctx);
+        const { id } = ctx.params;
+        const record = await this.resources.show(meta, id);
+        const authResult = await this.ensureResourceAction(ctx, meta, 'update', record, options?.asJson);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        const authCtx = authResult;
+        if (this.wantsJson(ctx, options?.asJson)) {
+            return ctx.response.json(record);
+        }
+        const embed = this.isEmbed(ctx);
+        const title = recordTitle(meta, record);
+        const navQuery = recordNavQuery(this.listQuery(ctx));
+        const policy = resourcePolicyFlags(this.authorizer, authCtx, this.registry, meta, record);
+        const shell = this.shellOpts(ctx, authCtx, {
+            meta,
+            record,
+            pageTitle: `Edit ${title}`,
+            showDeleteButton: policy.delete,
+            showBackToList: false,
+            recordBreadcrumb: {
+                mode: 'edit',
+                recordTitle: title,
+                recordHref: `${this.basePath}/${meta.slug}/${record.id}${navQuery}`,
+            },
+        });
+        const formInitialState = this.initialFormState(meta, record, 'edit');
+        const relationUi = await this.buildRelationUiMap(meta, record, 'edit', formInitialState);
+        return ctx.view.render('shamar::form', {
+            ...shell,
+            meta,
+            resource: meta,
+            record,
+            id: record.id,
+            mode: 'edit',
+            embed,
+            formSchema: formSchemaTree(meta),
+            formSections: formSections(meta),
+            formLiveFields: formClientFields(meta, {
+                state: formInitialState,
+                record,
+                operation: 'edit',
+            }),
+            formStateEndpoint: `${this.basePath}/${meta.slug}/form-state`,
+            formInitialState,
+            formErrors: {},
+            relationUi,
+            recordPager: embed
+                ? null
+                : await this.resolveRecordPager(ctx, meta, String(record.id), 'edit'),
+            resolveGridItemStyle,
+        });
+    }
+    async formState(ctx) {
+        const meta = this.requireResource(ctx);
+        const body = ctx.request.body();
+        const operation = body.operation === 'edit' || body.operation === 'view' || body.operation === 'create'
+            ? body.operation
+            : 'edit';
+        let record = null;
+        if (body.id) {
+            try {
+                record = await this.resources.show(meta, String(body.id));
+            }
+            catch {
+                record = null;
+            }
+        }
+        const action = operation === 'create' ? 'create' : operation === 'view' ? 'view' : 'update';
+        const authResult = await this.ensureResourceAction(ctx, meta, action, record ?? undefined, true);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        const result = await evaluateFormState(meta, {
+            operation,
+            changed: body.changed,
+            state: body.state ?? {},
+            record,
+        });
+        return ctx.response.json(result);
+    }
+    async summary(ctx) {
+        const meta = this.requireResource(ctx);
+        const { id } = ctx.params;
+        const record = await this.resources.show(meta, id);
+        const authResult = await this.ensureResourceAction(ctx, meta, 'view', record, true);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        return ctx.response.json({
+            id: String(record.id),
+            label: recordSummaryLabel(meta, record),
+        });
+    }
+    async relationSearch(ctx) {
+        const meta = this.requireResource(ctx);
+        const authResult = await this.ensureResourceAction(ctx, meta, 'viewAny', undefined, true);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        const fieldName = String(ctx.request.input('field') ?? '');
+        const field = meta.fields.find((entry) => entry.name === fieldName);
+        if (!field?.relation) {
+            return ctx.response.badRequest({ message: 'Unknown relation field' });
+        }
+        const related = resolveRelatedMeta(this.registry, field.relation);
+        const titleAttribute = relationTitleAttribute(field.relation);
+        const q = ctx.request.input('q');
+        const limitRaw = Number(ctx.request.input('limit') ?? field.relation.preloadLimit ?? 25);
+        const limit = Number.isFinite(limitRaw) ? limitRaw : 25;
+        const parentId = ctx.request.input('parentId');
+        const linkedOnly = ctx.request.input('linked') === '1' ||
+            ctx.request.input('linked') === 1 ||
+            ctx.request.input('linked') === true;
+        const scope = {};
+        if (linkedOnly &&
+            field.relation.kind === 'hasMany' &&
+            field.relation.foreignKey &&
+            parentId) {
+            scope[field.relation.foreignKey] = String(parentId);
+        }
+        const results = await this.panel.adapter.search(related, {
+            q: q != null ? String(q) : undefined,
+            limit,
+            titleAttribute,
+            scope: Object.keys(scope).length ? scope : undefined,
+        });
+        return ctx.response.json({ results });
+    }
+    async relationQuickCreate(ctx) {
+        const meta = this.requireResource(ctx);
+        const authResult = await this.ensureResourceAction(ctx, meta, 'create', undefined, true);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        const body = ctx.request.body();
+        const fieldName = String(body.field ?? '');
+        const field = meta.fields.find((entry) => entry.name === fieldName);
+        if (!field?.relation) {
+            return ctx.response.badRequest({ message: 'Unknown relation field' });
+        }
+        if (!field.relation.createOption) {
+            return ctx.response.badRequest({ message: 'Inline create is not enabled for this field' });
+        }
+        const name = String(body.name ?? '').trim();
+        if (!name) {
+            return ctx.response.badRequest({ message: 'Name is required' });
+        }
+        const related = resolveRelatedMeta(this.registry, field.relation);
+        const titleAttribute = relationTitleAttribute(field.relation);
+        const payload = { [titleAttribute]: name };
+        if (field.relation.kind === 'hasMany' &&
+            field.relation.foreignKey &&
+            body.parentId) {
+            payload[field.relation.foreignKey] = String(body.parentId);
+        }
+        try {
+            const record = await this.panel.adapter.create(related, payload);
+            return ctx.response.json({
+                id: String(record.id),
+                label: recordSummaryLabel(related, record, titleAttribute),
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Cannot create this record inline.';
+            return ctx.response.badRequest({ message });
+        }
+    }
+    async relationAttach(ctx) {
+        const meta = this.requireResource(ctx);
+        const body = ctx.request.body();
+        let parentRecord;
+        if (body.parentId) {
+            try {
+                parentRecord = await this.resources.show(meta, String(body.parentId));
+            }
+            catch {
+                parentRecord = undefined;
+            }
+        }
+        const authResult = await this.ensureResourceAction(ctx, meta, 'update', parentRecord, true);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        const field = meta.fields.find((entry) => entry.name === String(body.field ?? ''));
+        if (!field?.relation || field.relation.kind !== 'hasMany' || !field.relation.foreignKey) {
+            return ctx.response.badRequest({ message: 'Attach requires a hasMany relation field' });
+        }
+        if (!body.relatedId || !body.parentId) {
+            return ctx.response.badRequest({ message: 'relatedId and parentId are required' });
+        }
+        const related = resolveRelatedMeta(this.registry, field.relation);
+        const titleAttribute = relationTitleAttribute(field.relation);
+        const record = await this.panel.adapter.update(related, String(body.relatedId), {
+            [field.relation.foreignKey]: String(body.parentId),
+        });
+        return ctx.response.json({
+            id: String(record.id),
+            label: recordSummaryLabel(related, record, titleAttribute),
+        });
+    }
+    async relationDetach(ctx) {
+        const meta = this.requireResource(ctx);
+        const body = ctx.request.body();
+        let parentRecord;
+        if (body.parentId) {
+            try {
+                parentRecord = await this.resources.show(meta, String(body.parentId));
+            }
+            catch {
+                parentRecord = undefined;
+            }
+        }
+        const authResult = await this.ensureResourceAction(ctx, meta, 'update', parentRecord, true);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        const field = meta.fields.find((entry) => entry.name === String(body.field ?? ''));
+        if (!field?.relation || field.relation.kind !== 'hasMany' || !field.relation.foreignKey) {
+            return ctx.response.badRequest({ message: 'Detach requires a hasMany relation field' });
+        }
+        if (!body.relatedId) {
+            return ctx.response.badRequest({ message: 'relatedId is required' });
+        }
+        const related = resolveRelatedMeta(this.registry, field.relation);
+        await this.panel.adapter.update(related, String(body.relatedId), {
+            [field.relation.foreignKey]: null,
+        });
+        return ctx.response.json({ ok: true });
+    }
+    async update(ctx, options) {
+        const meta = this.requireResource(ctx);
+        const { id } = ctx.params;
+        let existing = null;
+        try {
+            existing = await this.resources.show(meta, id);
+        }
+        catch {
+            existing = null;
+        }
+        const authResult = await this.ensureResourceAction(ctx, meta, 'update', existing ?? undefined, options?.asJson);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        const data = this.resourcePayload(meta, ctx, 'update');
+        try {
+            const record = await this.resources.update(meta, id, data);
+            if (this.wantsJson(ctx, options?.asJson)) {
+                return ctx.response.json(record);
+            }
+            return this.redirectAfterSave(ctx, meta, String(record.id), 'updated');
+        }
+        catch (error) {
+            let record = existing;
+            if (!record) {
+                try {
+                    record = await this.resources.show(meta, id);
+                }
+                catch {
+                    record = { id, ...data };
+                }
+            }
+            return this.handleFormValidationError(ctx, meta, error, {
+                mode: 'edit',
+                record,
+                data,
+                asJson: options?.asJson,
+                authCtx: authResult,
+            });
+        }
+    }
+    async destroy(ctx, options) {
+        const meta = this.requireResource(ctx);
+        const { id } = ctx.params;
+        const record = await this.resources.show(meta, id);
+        const authResult = await this.ensureResourceAction(ctx, meta, 'delete', record, options?.asJson);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        await this.resources.destroy(meta, id);
+        if (this.wantsJson(ctx, options?.asJson)) {
+            return ctx.response.noContent();
+        }
+        ctx.session.flash('success', `${meta.singularLabel} deleted`);
+        return ctx.response.redirect(`${this.basePath}/${meta.slug}`);
+    }
+    /** POST /:slug/bulk — bulk delete or custom bulk actions. */
+    async bulk(ctx, options) {
+        const meta = this.requireResource(ctx);
+        const action = String(ctx.request.input('action') ?? '').trim();
+        if (!action) {
+            return ctx.response.badRequest({ message: 'Missing action.' });
+        }
+        const authGate = this.actionAuthGate(meta, action);
+        const authResult = await this.ensureAuthenticated(ctx, options?.asJson);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        const authCtx = authResult;
+        const ids = this.collectBulkIds(ctx);
+        if (ids.length === 0 && !ctx.request.input('selectAll')) {
+            ctx.session.flash('error', 'No records selected.');
+            return ctx.response.redirect(`${this.basePath}/${meta.slug}`);
+        }
+        let records = [];
+        if (ctx.request.input('selectAll')) {
+            const query = this.withPolicyScope(authCtx, meta, normalizeListQuery(this.listQuery(ctx)));
+            const result = await this.resources.index(meta, {
+                ...query,
+                page: 1,
+                perPage: LIST_ALL_RECORDS_PER_PAGE,
+            });
+            records = result.items;
+        }
+        else {
+            for (const id of ids) {
+                try {
+                    records.push(await this.resources.show(meta, id));
+                }
+                catch {
+                    /* skip missing */
+                }
+            }
+        }
+        if (records.length === 0) {
+            ctx.session.flash('error', 'No matching records found.');
+            return ctx.response.redirect(`${this.basePath}/${meta.slug}`);
+        }
+        if (action === 'delete') {
+            for (const record of records) {
+                try {
+                    assertResourceAccess(this.authorizer, authCtx, this.registry, meta, 'delete', record);
+                }
+                catch (error) {
+                    if (error instanceof ForbiddenError) {
+                        return respondForbidden(ctx, error.message, options?.asJson || this.wantsJson(ctx), this.basePath);
+                    }
+                    throw error;
+                }
+                await this.resources.destroy(meta, String(record.id));
+            }
+            const message = records.length === 1
+                ? `${meta.singularLabel} deleted`
+                : `${records.length} ${meta.label.toLowerCase()} deleted`;
+            if (this.wantsJson(ctx, options?.asJson)) {
+                return ctx.response.json({ message, count: records.length });
+            }
+            ctx.session.flash('success', message);
+            return ctx.response.redirect(`${this.basePath}/${meta.slug}`);
+        }
+        return this.runCustomAction(ctx, meta, authCtx, action, records, authGate, options?.asJson);
+    }
+    /** POST /:slug/:id/action/:action — single-record custom action. */
+    async recordAction(ctx, options) {
+        const meta = this.requireResource(ctx);
+        const { id, action: actionParam } = ctx.params;
+        const action = String(actionParam ?? ctx.request.input('action') ?? '').trim();
+        if (!action) {
+            return ctx.response.badRequest({ message: 'Missing action.' });
+        }
+        const record = await this.resources.show(meta, id);
+        const authGate = this.actionAuthGate(meta, action);
+        const authResult = await this.ensureResourceAction(ctx, meta, authGate, record, options?.asJson);
+        if (!this.isAuthContext(authResult))
+            return authResult;
+        if (action === 'delete') {
+            await this.resources.destroy(meta, id);
+            if (this.wantsJson(ctx, options?.asJson)) {
+                return ctx.response.noContent();
+            }
+            ctx.session.flash('success', `${meta.singularLabel} deleted`);
+            return ctx.response.redirect(`${this.basePath}/${meta.slug}`);
+        }
+        return this.runCustomAction(ctx, meta, authResult, action, [record], authGate, options?.asJson, String(record.id));
+    }
+    actionAuthGate(meta, action) {
+        const config = (meta.actions ?? []).find((entry) => entry.name === action);
+        const gate = config?.ability ?? action;
+        if (gate === 'create')
+            return 'create';
+        if (gate === 'edit' || gate === 'update')
+            return 'update';
+        if (gate === 'view')
+            return 'view';
+        if (gate === 'viewAny')
+            return 'viewAny';
+        return 'delete';
+    }
+    collectBulkIds(ctx) {
+        const raw = ctx.request.input('ids');
+        if (Array.isArray(raw)) {
+            return raw.map(String).map((id) => id.trim()).filter(Boolean);
+        }
+        if (raw != null && String(raw).trim() !== '') {
+            return [String(raw).trim()];
+        }
+        return [];
+    }
+    async runCustomAction(ctx, meta, authCtx, action, records, authGate, asJson, redirectId) {
+        for (const record of records) {
+            try {
+                assertResourceAccess(this.authorizer, authCtx, this.registry, meta, authGate, record);
+            }
+            catch (error) {
+                if (error instanceof ForbiddenError) {
+                    return respondForbidden(ctx, error.message, asJson || this.wantsJson(ctx), this.basePath);
+                }
+                throw error;
+            }
+        }
+        const ResourceClass = this.registry.resourceClass(meta.slug);
+        if (!ResourceClass?.handleAction) {
+            return ctx.response.badRequest({ message: `Unknown action: ${action}` });
+        }
+        const result = await ResourceClass.handleAction(action, records, {
+            adapter: this.panel.adapter,
+            meta,
+            userId: authCtx.user?.id ?? null,
+            user: authCtx.user ?? null,
+        });
+        if (result == null) {
+            return ctx.response.badRequest({ message: `Unknown action: ${action}` });
+        }
+        const message = result.message ??
+            `${meta.singularLabel} ${action}${records.length > 1 ? ` (${records.length})` : ''}`;
+        if (this.wantsJson(ctx, asJson)) {
+            return ctx.response.json({ message, count: records.length });
+        }
+        ctx.session.flash('success', message);
+        if (redirectId) {
+            return ctx.response.redirect(`${this.basePath}/${meta.slug}/${redirectId}`);
+        }
+        return ctx.response.redirect(`${this.basePath}/${meta.slug}`);
+    }
+    requireResource(ctx) {
+        return this.registry.require(ctx.params.slug);
+    }
+    withPolicyScope(authCtx, meta, query) {
+        const ResourceClass = this.registry.resourceClass(meta.slug);
+        if (!ResourceClass)
+            return query;
+        const scope = this.authorizer.listScope(authCtx, ResourceClass);
+        if (!scope)
+            return query;
+        return {
+            ...query,
+            scope: { ...(query.scope ?? {}), ...scope },
+        };
+    }
+    listQuery(ctx) {
+        return {
+            page: ctx.request.input('page'),
+            perPage: ctx.request.input('perPage'),
+            search: ctx.request.input('search'),
+            sort: ctx.request.input('sort'),
+            direction: ctx.request.input('direction'),
+            filters: ctx.request.input('filters'),
+            groupBy: ctx.request.input('groupBy'),
+            trashed: ctx.request.input('trashed'),
+        };
+    }
+    wantsJson(ctx, force = false) {
+        if (force) {
+            return true;
+        }
+        const accept = ctx.request.header('accept') ?? '';
+        return accept.includes('application/json');
+    }
+    isEmbed(ctx) {
+        const query = ctx.request.input('embed');
+        if (query === '1' || query === 1 || query === true)
+            return true;
+        const body = ctx.request.input('_shamar_embed');
+        return body === '1' || body === 1 || body === true;
+    }
+    redirectAfterSave(ctx, meta, recordId, action, options) {
+        if (this.isEmbed(ctx)) {
+            return ctx.response.redirect(`${this.basePath}/${meta.slug}/${recordId}?success=${action}&embed=1`);
+        }
+        if (options?.flashPlainText) {
+            ctx.session.flash('success', options.flashMessage ??
+                `${meta.singularLabel} created. Copy it now — it will not be shown again:\n${options.flashPlainText}`);
+            ctx.session.flash('apiKeyPlainText', options.flashPlainText);
+        }
+        else {
+            ctx.session.flash('success', options?.flashMessage ??
+                (action === 'created'
+                    ? `${meta.singularLabel} created`
+                    : `${meta.singularLabel} updated`));
+        }
+        const navQuery = recordNavQuery(this.listQuery(ctx));
+        // Create-once resources (canEdit false) land on show, not edit.
+        if (action === 'created' && options?.authCtx) {
+            const ResourceClass = this.registry.resourceClass(meta.slug);
+            const editable = !ResourceClass ||
+                ResourceClass.canEdit(options.authCtx.user ?? { id: '', name: '' });
+            if (!editable) {
+                return ctx.response.redirect(`${this.basePath}/${meta.slug}/${recordId}${navQuery}`);
+            }
+        }
+        // Stay on the edit form so Ctrl+S / continued editing keeps context.
+        return ctx.response.redirect(`${this.basePath}/${meta.slug}/${recordId}/edit${navQuery}`);
+    }
+    async handleFormValidationError(ctx, meta, error, options) {
+        if (!isValidationException(error)) {
+            throw error;
+        }
+        if (this.wantsJson(ctx, options.asJson)) {
+            return ctx.response.status(422).json({
+                message: error.message,
+                errors: error.errors,
+            });
+        }
+        const authCtx = options.authCtx ?? (await this.resolveAuth(ctx));
+        return this.renderForm(ctx, meta, {
+            mode: options.mode,
+            record: options.record,
+            authCtx,
+            formErrors: error.errors,
+            formInitialState: {
+                ...this.initialFormState(meta, options.record, options.mode),
+                ...options.data,
+            },
+        });
+    }
+    async renderForm(ctx, meta, options) {
+        const authCtx = options.authCtx ?? (await this.resolveAuth(ctx));
+        const embed = this.isEmbed(ctx);
+        const title = options.mode === 'create'
+            ? `New ${meta.singularLabel}`
+            : `Edit ${recordTitle(meta, options.record ?? {})}`;
+        const navQuery = recordNavQuery(this.listQuery(ctx));
+        const recordId = options.record?.id;
+        const policy = resourcePolicyFlags(this.authorizer, authCtx, this.registry, meta, options.record);
+        const shell = this.shellOpts(ctx, authCtx, {
+            meta,
+            record: options.record,
+            pageTitle: title,
+            showDeleteButton: options.mode === 'edit' ? policy.delete : undefined,
+            showBackToList: false,
+            recordBreadcrumb: options.mode === 'create'
+                ? { mode: 'create' }
+                : {
+                    mode: 'edit',
+                    recordTitle: recordTitle(meta, options.record ?? {}),
+                    recordHref: recordId != null
+                        ? `${this.basePath}/${meta.slug}/${recordId}${navQuery}`
+                        : undefined,
+                },
+        });
+        const formInitialState = options.formInitialState ??
+            this.initialFormState(meta, options.record, options.mode);
+        const relationUi = await this.buildRelationUiMap(meta, options.record, options.mode, formInitialState);
+        return ctx.view.render('shamar::form', {
+            ...shell,
+            meta,
+            resource: meta,
+            record: options.record,
+            id: options.record?.id,
+            mode: options.mode,
+            embed,
+            /** Create-once resources (canEdit false) redirect to show after AJAX create. */
+            redirectAfterCreateToShow: options.mode === 'create' && !policy.update,
+            formSchema: formSchemaTree(meta),
+            formSections: formSections(meta),
+            formLiveFields: formClientFields(meta, {
+                state: formInitialState,
+                record: options.record,
+                operation: options.mode,
+            }),
+            formStateEndpoint: `${this.basePath}/${meta.slug}/form-state`,
+            formInitialState,
+            formErrors: options.formErrors ?? {},
+            relationUi,
+            recordPager: !embed && options.mode === 'edit' && options.record?.id != null
+                ? await this.resolveRecordPager(ctx, meta, String(options.record.id), 'edit')
+                : null,
+            resolveGridItemStyle,
+        });
+    }
+    async resolveRecordPager(ctx, meta, recordId, mode) {
+        const raw = this.listQuery(ctx);
+        const navQuery = recordNavQuery(raw);
+        const listQuery = normalizeListQuery({
+            search: raw.search,
+            sort: raw.sort,
+            direction: raw.direction,
+            page: 1,
+            perPage: RECORD_NAV_CAP,
+        });
+        // Bypass the list UI cap so neighbors follow the full filtered set.
+        listQuery.perPage = RECORD_NAV_CAP;
+        try {
+            const result = await this.panel.adapter.list(meta, listQuery);
+            const ids = result.items
+                .map((item) => (item.id != null ? String(item.id) : ''))
+                .filter(Boolean);
+            return buildRecordPager({
+                basePath: this.basePath,
+                slug: meta.slug,
+                recordId,
+                mode,
+                ids,
+                navQuery,
+            });
+        }
+        catch {
+            return null;
+        }
+    }
+    applyCreateQueryDefaults(ctx, meta, state) {
+        const qs = ctx.request.qs();
+        for (const field of meta.fields) {
+            if (!(field.name in qs))
+                continue;
+            const raw = qs[field.name];
+            if (raw == null || raw === '')
+                continue;
+            state[field.name] = toFormControlValue(raw, field);
+        }
+        // Create & Edit often passes `?name=` for the title attribute.
+        if ('name' in qs && qs.name != null && qs.name !== '') {
+            const titleField = meta.recordTitleField ??
+                meta.fields.find((field) => field.name === 'name')?.name ??
+                null;
+            if (titleField && (state[titleField] === '' || state[titleField] == null)) {
+                state[titleField] = String(qs.name);
+            }
+        }
+    }
+    initialFormState(meta, record, operation) {
+        const state = {};
+        for (const field of meta.fields) {
+            if (record && field.name in record) {
+                state[field.name] = toFormControlValue(record[field.name], field);
+            }
+            else if (field.default !== undefined && typeof field.default !== 'function') {
+                state[field.name] = toFormControlValue(field.default, field);
+            }
+            else if (field.type === 'boolean' || field.type === 'checkbox') {
+                state[field.name] = false;
+            }
+            else if (field.type === 'color') {
+                state[field.name] = '#000000';
+            }
+            else if (field.type === 'relation' && field.relation?.kind === 'belongsTo') {
+                // BelongsTo values are owned by the M2O combobox widget, not form state.
+            }
+            else if (field.multiple ||
+                field.type === 'tags' ||
+                field.type === 'checkboxList' ||
+                field.type === 'relationTable' ||
+                (field.type === 'relation' && field.relation?.kind !== 'belongsTo')) {
+                state[field.name] = [];
+            }
+            else if (field.type === 'select' && field.multiple) {
+                state[field.name] = [];
+            }
+            else {
+                state[field.name] = '';
+            }
+        }
+        void operation;
+        return state;
+    }
+    async buildRelationUiMap(meta, record, operation, state) {
+        const map = {};
+        for (const field of meta.fields) {
+            if (!isRelationField(field) || !field.relation)
+                continue;
+            const related = resolveRelatedMeta(this.registry, field.relation);
+            const titleAttribute = relationTitleAttribute(field.relation);
+            const widget = field.relation.widget ?? 'combobox';
+            let initialItems = [];
+            if (field.relation.kind === 'hasMany' && record?.id != null && field.relation.foreignKey) {
+                initialItems = await this.panel.adapter.search(related, {
+                    titleAttribute,
+                    limit: field.relation.preloadLimit ?? 100,
+                    scope: { [field.relation.foreignKey]: String(record.id) },
+                });
+            }
+            else {
+                const ids = collectRelationIds(field, {
+                    ...(record ?? {}),
+                    ...state,
+                });
+                if (ids.length > 0) {
+                    initialItems = await this.panel.adapter.search(related, {
+                        ids,
+                        titleAttribute,
+                        limit: Math.max(ids.length, 25),
+                    });
+                }
+            }
+            let preloadedOptions;
+            if (widget === 'radio' || widget === 'checkboxList') {
+                preloadedOptions = await this.panel.adapter.search(related, {
+                    titleAttribute,
+                    limit: field.relation.preloadLimit ?? 100,
+                    q: '',
+                });
+                // Ensure selected items appear in the option list.
+                const seen = new Set(preloadedOptions.map((item) => item.id));
+                for (const item of initialItems) {
+                    if (!seen.has(item.id)) {
+                        preloadedOptions = [item, ...preloadedOptions];
+                    }
+                }
+            }
+            map[field.name] = buildRelationUiConfig({
+                field,
+                parentMeta: meta,
+                relatedMeta: related,
+                basePath: this.basePath,
+                record,
+                initialItems,
+                preloadedOptions,
+                operation,
+            });
+        }
+        return map;
+    }
+    resourcePayload(meta, ctx, action) {
+        const input = ctx.request.all();
+        const data = {};
+        for (const field of meta.fields) {
+            if (field.hiddenOnForm)
+                continue;
+            if (field.dehydrated === false)
+                continue;
+            if (action === 'update' && field.createOnly)
+                continue;
+            if (field.type === 'boolean' || field.type === 'checkbox') {
+                data[field.name] =
+                    input[field.name] === true ||
+                        input[field.name] === '1' ||
+                        input[field.name] === 'on' ||
+                        input[field.name] === 'true';
+                continue;
+            }
+            if (field.currency) {
+                const raw = field.name in input ? input[field.name] : undefined;
+                if (raw !== undefined) {
+                    data[field.name] = parseCurrencyInput(raw);
+                }
+                continue;
+            }
+            if (field.type === 'tags' ||
+                field.type === 'checkboxList' ||
+                (field.relation &&
+                    (field.relation.kind === 'manyToMany' || field.multiple))) {
+                const raw = input[field.name] ?? input[`${field.name}[]`];
+                if (Array.isArray(raw)) {
+                    data[field.name] = raw.map((item) => String(item)).filter(Boolean);
+                }
+                else if (typeof raw === 'string' && raw.trim()) {
+                    data[field.name] =
+                        field.type === 'tags'
+                            ? raw.split(',').map((item) => item.trim()).filter(Boolean)
+                            : [raw.trim()];
+                }
+                else if (field.name in input || `${field.name}[]` in input) {
+                    data[field.name] = [];
+                }
+                continue;
+            }
+            if (field.name in input) {
+                data[field.name] = input[field.name];
+            }
+            else if (`${field.name}[]` in input) {
+                data[field.name] = input[`${field.name}[]`];
+            }
+        }
+        return data;
+    }
+}
+//# sourceMappingURL=admin_controller.js.map