adminforth 1.1.13 → 1.1.14

package/auth.ts

@@ -2,6 +2,7 @@
 import jwt from 'jsonwebtoken';
 
 import crypto from 'crypto';
+import AdminForth from './index.js';
 
 // Function to generate a password hash using PBKDF2
 function calcPasswordHash(password, salt, iterations = 100000, keyLength = 64, digest = 'sha512') {
@@ -19,6 +20,11 @@ function generateSalt(length = 16) {
 }
 
 class AdminForthAuth {
+  adminforth: AdminForth;
+
+  constructor(adminforth) {
+    this.adminforth = adminforth;
+  }
 
   issueJWT(payload) {
     // read ADMINFORH_SECRET from environment if not drop error
@@ -32,16 +38,16 @@ class AdminForthAuth {
     return jwt.sign(payload, secret, { expiresIn });
   }
 
-  verify(jwtToken) {
+  async verify(jwtToken) {
     // read ADMINFORH_SECRET from environment if not drop error
     const secret = process.env.ADMINFORTH_SECRET;
     if (!secret) {
       throw new Error('ADMINFORTH_SECRET environment not set');
     }
+    let decoded;
     try {
       // verify JWT token
-      const decoded = jwt.verify(jwtToken, secret);
-      return decoded;
+      decoded = jwt.verify(jwtToken, secret);
     } catch (err) {
       if (err.name === 'TokenExpiredError') {
         console.error('Token expired:', err.message);
@@ -52,6 +58,14 @@ class AdminForthAuth {
       }
       return null;
     }
+    const { pk } = decoded;
+    if (pk === null) {
+      decoded.isRoot = true;
+    } else {
+      const dbUser = await this.adminforth.getUserByPk(pk);
+      decoded.dbUser = dbUser;
+    }
+    return decoded;
   }
 
   static async generatePasswordHash(password) {

package/dist/auth.js

@@ -24,6 +24,9 @@ function generateSalt(length = 16) {
     return crypto.randomBytes(length).toString('hex');
 }
 class AdminForthAuth {
+    constructor(adminforth) {
+        this.adminforth = adminforth;
+    }
     issueJWT(payload) {
         // read ADMINFORH_SECRET from environment if not drop error
         const secret = process.env.ADMINFORTH_SECRET;
@@ -35,28 +38,39 @@ class AdminForthAuth {
         return jwt.sign(payload, secret, { expiresIn });
     }
     verify(jwtToken) {
-        // read ADMINFORH_SECRET from environment if not drop error
-        const secret = process.env.ADMINFORTH_SECRET;
-        if (!secret) {
-            throw new Error('ADMINFORTH_SECRET environment not set');
-        }
-        try {
-            // verify JWT token
-            const decoded = jwt.verify(jwtToken, secret);
-            return decoded;
-        }
-        catch (err) {
-            if (err.name === 'TokenExpiredError') {
-                console.error('Token expired:', err.message);
+        return __awaiter(this, void 0, void 0, function* () {
+            // read ADMINFORH_SECRET from environment if not drop error
+            const secret = process.env.ADMINFORTH_SECRET;
+            if (!secret) {
+                throw new Error('ADMINFORTH_SECRET environment not set');
+            }
+            let decoded;
+            try {
+                // verify JWT token
+                decoded = jwt.verify(jwtToken, secret);
+            }
+            catch (err) {
+                if (err.name === 'TokenExpiredError') {
+                    console.error('Token expired:', err.message);
+                }
+                else if (err.name === 'JsonWebTokenError') {
+                    console.error('Token error:', err.message);
+                }
+                else {
+                    console.error('Failed to verify JWT token', err);
+                }
+                return null;
             }
-            else if (err.name === 'JsonWebTokenError') {
-                console.error('Token error:', err.message);
+            const { pk } = decoded;
+            if (pk === null) {
+                decoded.isRoot = true;
             }
             else {
-                console.error('Failed to verify JWT token', err);
+                const dbUser = yield this.adminforth.getUserByPk(pk);
+                decoded.dbUser = dbUser;
             }
-            return null;
-        }
+            return decoded;
+        });
     }
     static generatePasswordHash(password) {
         return __awaiter(this, void 0, void 0, function* () {

package/dist/index.js

@@ -13,7 +13,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
 var _a, _AdminForth_defaultConfig;
-import Auth from './auth.js';
+import AdminForthAuth from './auth.js';
 import MongoConnector from './dataConnectors/mongo.js';
 import PostgresConnector from './dataConnectors/postgres.js';
 import SQLiteConnector from './dataConnectors/sqlite.js';
@@ -22,9 +22,8 @@ import { guessLabelFromName } from './modules/utils.js';
 import ExpressServer from './servers/express.js';
 import { v1 as uuid } from 'uuid';
 import fs from 'fs';
-import { ADMINFORTH_VERSION } from './modules/utils.js';
+import { ADMINFORTH_VERSION, listify } from './modules/utils.js';
 import { AdminForthFilterOperators, AdminForthDataTypes, AdminForthResourcePages } from './types/AdminForthConfig.js';
-import { getFunctionList } from './modules/utils.js';
 import path from 'path';
 //get array from enum AdminForthResourcePages
 const DEFAULT_ALLOWED_ACTIONS = { create: true, edit: true, show: true, delete: true };
@@ -40,7 +39,7 @@ class AdminForth {
         this.activatePlugins();
         this.validateConfig(); // revalidate after plugins
         this.express = new ExpressServer(this);
-        this.auth = new Auth();
+        this.auth = new AdminForthAuth(this);
         this.connectors = {};
         this.statuses = {};
         console.log(`🚀 AdminForth v${ADMINFORTH_VERSION} starting up`);
@@ -254,6 +253,37 @@ class AdminForth {
                 else {
                     res.options.allowedActions = DEFAULT_ALLOWED_ACTIONS;
                 }
+                // transform all hooks Functions to array of functions
+                if (res.hooks) {
+                    for (const value of [res.hooks.show, res.hooks.list]) {
+                        if (value) {
+                            if (value.beforeDatasourceRequest) {
+                                if (!Array.isArray(value.beforeDatasourceRequest)) {
+                                    value.beforeDatasourceRequest = [value.beforeDatasourceRequest];
+                                }
+                            }
+                            if (value.afterDatasourceResponse) {
+                                if (!Array.isArray(value.afterDatasourceResponse)) {
+                                    value.afterDatasourceResponse = [value.afterDatasourceResponse];
+                                }
+                            }
+                        }
+                    }
+                    for (const value of [res.hooks.create, res.hooks.edit, res.hooks.delete]) {
+                        if (value) {
+                            if (value.beforeSave) {
+                                if (!Array.isArray(value.beforeSave)) {
+                                    value.beforeSave = [value.beforeSave];
+                                }
+                            }
+                            if (value.afterSave) {
+                                if (!Array.isArray(value.afterSave)) {
+                                    value.afterSave = [value.afterSave];
+                                }
+                            }
+                        }
+                    }
+                }
             });
             if (!this.config.menu) {
                 errors.push('No config.menu defined');
@@ -315,7 +345,6 @@ class AdminForth {
         for (const resource of this.config.resources) {
             for (const column of resource.columns) {
                 if (column.components) {
-                    console.log('🔧🔧🔧 Validating components for resource', column.components);
                     for (const [key, comp] of Object.entries(column.components)) {
                         let ignoreExistsCheck = false;
                         if (this.codeInjector.allComponentNames[comp.file]) {
@@ -393,6 +422,24 @@ class AdminForth {
             this.codeInjector.bundleNow({ hotReload, verbose });
         });
     }
+    getUserByPk(pk) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const resource = this.config.resources.find((res) => res.resourceId === this.config.auth.resourceId);
+            if (!resource) {
+                throw new Error('No auth resource found');
+            }
+            const users = yield this.connectors[resource.dataSource].getData({
+                resource,
+                filters: [
+                    { field: resource.columns.find((col) => col.primaryKey).name, operator: AdminForthFilterOperators.EQ, value: pk },
+                ],
+                limit: 1,
+                offset: 0,
+                sort: [],
+            });
+            return users.data[0] || null;
+        });
+    }
     setupEndpoints(server) {
         server.endpoint({
             noAuth: true,
@@ -436,7 +483,7 @@ class AdminForth {
                     }
                     const passwordHash = userRecord[this.config.auth.passwordHashField];
                     console.log('User record', userRecord, passwordHash); // why does it has no hash?
-                    const valid = yield Auth.verifyPassword(password, passwordHash);
+                    const valid = yield AdminForthAuth.verifyPassword(password, passwordHash);
                     if (valid) {
                         token = this.auth.issueJWT({
                             username, pk: userRecord[userResource.columns.find((col) => col.primaryKey).name]
@@ -450,11 +497,18 @@ class AdminForth {
                 return { ok: true };
             }),
         });
+        server.endpoint({
+            method: 'POST',
+            path: '/check_auth',
+            handler: (_d) => __awaiter(this, [_d], void 0, function* ({ adminUser }) {
+                return { ok: true };
+            }),
+        });
         server.endpoint({
             noAuth: true,
             method: 'POST',
             path: '/logout',
-            handler: (_d) => __awaiter(this, [_d], void 0, function* ({ response }) {
+            handler: (_e) => __awaiter(this, [_e], void 0, function* ({ response }) {
                 response.setHeader('Set-Cookie', `adminforth_jwt=; Path=${this.config.baseUrl || '/'}; HttpOnly; SameSite=Strict; Expires=Thu, 01 Jan 1970 00:00:00 GMT`);
                 return { ok: true };
             }),
@@ -463,8 +517,8 @@ class AdminForth {
             noAuth: true,
             method: 'GET',
             path: '/get_public_config',
-            handler: (_e) => __awaiter(this, [_e], void 0, function* ({ body }) {
-                var _f;
+            handler: (_f) => __awaiter(this, [_f], void 0, function* ({ body }) {
+                var _g;
                 // find resource
                 if (!this.config.auth) {
                     throw new Error('No config.auth defined');
@@ -476,37 +530,24 @@ class AdminForth {
                     brandName: this.config.customization.brandName,
                     usernameFieldName: usernameColumn.label,
                     loginBackgroundImage: this.config.auth.loginBackgroundImage,
-                    title: (_f = this.config.customization) === null || _f === void 0 ? void 0 : _f.title,
+                    title: (_g = this.config.customization) === null || _g === void 0 ? void 0 : _g.title,
                 };
             }),
         });
         server.endpoint({
             method: 'GET',
             path: '/get_base_config',
-            handler: (_g) => __awaiter(this, [_g], void 0, function* ({ input, adminUser, cookies }) {
-                var _h, _j;
-                const cookieParsed = this.auth.verify(cookies['adminforth_jwt']);
+            handler: (_h) => __awaiter(this, [_h], void 0, function* ({ input, adminUser, cookies }) {
+                var _j, _k;
                 let username = '';
                 let userFullName = '';
-                if (cookieParsed['pk'] == null) {
+                if (adminUser.isRoot) {
                     username = this.config.rootUser.username;
                 }
                 else {
-                    const userResource = this.config.resources.find((res) => res.resourceId === this.config.auth.resourceId);
-                    const user = yield this.connectors[userResource.dataSource].getData({
-                        resource: userResource,
-                        filters: [
-                            { field: userResource.columns.find((col) => col.primaryKey).name, operator: AdminForthFilterOperators.EQ, value: cookieParsed['pk'] },
-                        ],
-                        limit: 1,
-                        offset: 0,
-                        sort: [],
-                    });
-                    if (!user.data.length) {
-                        return { error: 'Unauthorized' };
-                    }
-                    username = user.data[0][this.config.auth.usernameField];
-                    userFullName = user.data[0][this.config.auth.userFullNameField];
+                    const dbUser = adminUser.dbUser;
+                    username = dbUser[this.config.auth.usernameField];
+                    userFullName = dbUser[this.config.auth.userFullNameField];
                 }
                 const userData = {
                     [this.config.auth.usernameField]: username,
@@ -526,8 +567,8 @@ class AdminForth {
                         deleteConfirmation: this.config.deleteConfirmation,
                         auth: this.config.auth,
                         usernameField: this.config.auth.usernameField,
-                        title: (_h = this.config.customization) === null || _h === void 0 ? void 0 : _h.title,
-                        emptyFieldPlaceholder: (_j = this.config.customization) === null || _j === void 0 ? void 0 : _j.emptyFieldPlaceholder,
+                        title: (_j = this.config.customization) === null || _j === void 0 ? void 0 : _j.title,
+                        emptyFieldPlaceholder: (_k = this.config.customization) === null || _k === void 0 ? void 0 : _k.emptyFieldPlaceholder,
                     },
                     adminUser,
                     version: ADMINFORTH_VERSION,
@@ -537,7 +578,7 @@ class AdminForth {
         server.endpoint({
             method: 'POST',
             path: '/get_resource',
-            handler: (_k) => __awaiter(this, [_k], void 0, function* ({ body }) {
+            handler: (_l) => __awaiter(this, [_l], void 0, function* ({ body }) {
                 const { resourceId } = body;
                 if (!this.statuses.dbDiscover) {
                     return { error: 'Database discovery not started' };
@@ -556,8 +597,8 @@ class AdminForth {
         server.endpoint({
             method: 'POST',
             path: '/get_resource_data',
-            handler: (_l) => __awaiter(this, [_l], void 0, function* ({ body, adminUser }) {
-                var _m, _o, _p, _q;
+            handler: (_m) => __awaiter(this, [_m], void 0, function* ({ body, adminUser }) {
+                var _o, _p, _q, _r;
                 const { resourceId, source } = body;
                 if (['show', 'list'].includes(source) === false) {
                     return { error: 'Invalid source, should be list or show' };
@@ -572,7 +613,7 @@ class AdminForth {
                 if (!resource) {
                     return { error: `Resource ${resourceId} not found` };
                 }
-                for (const hook of getFunctionList((_o = (_m = resource.hooks) === null || _m === void 0 ? void 0 : _m[source]) === null || _o === void 0 ? void 0 : _o.beforeDatasourceRequest)) {
+                for (const hook of listify((_p = (_o = resource.hooks) === null || _o === void 0 ? void 0 : _o[source]) === null || _p === void 0 ? void 0 : _p.beforeDatasourceRequest)) {
                     const resp = yield hook({ resource, query: body, adminUser });
                     if (!resp || (!resp.ok && !resp.error)) {
                         throw new Error(`Hook must return object with {ok: true} or { error: 'Error' } `);
@@ -639,7 +680,7 @@ class AdminForth {
                         item[col.name] = targetDataMap[item[col.name]];
                     });
                 })));
-                for (const hook of getFunctionList((_q = (_p = resource.hooks) === null || _p === void 0 ? void 0 : _p[source]) === null || _q === void 0 ? void 0 : _q.afterDatasourceResponse)) {
+                for (const hook of listify((_r = (_q = resource.hooks) === null || _q === void 0 ? void 0 : _q[source]) === null || _r === void 0 ? void 0 : _r.afterDatasourceResponse)) {
                     const resp = yield hook({ resource, response: data.data, adminUser });
                     if (!resp || (!resp.ok && !resp.error)) {
                         throw new Error(`Hook must return object with {ok: true} or { error: 'Error' } `);
@@ -665,8 +706,8 @@ class AdminForth {
         server.endpoint({
             method: 'POST',
             path: '/get_resource_foreign_data',
-            handler: (_r) => __awaiter(this, [_r], void 0, function* ({ body, adminUser }) {
-                var _s, _t, _u, _v;
+            handler: (_s) => __awaiter(this, [_s], void 0, function* ({ body, adminUser }) {
+                var _t, _u, _v, _w;
                 const { resourceId, column } = body;
                 if (!this.statuses.dbDiscover) {
                     return { error: 'Database discovery not started' };
@@ -687,8 +728,8 @@ class AdminForth {
                 }
                 const targetResourceId = columnConfig.foreignResource.resourceId;
                 const targetResource = this.config.resources.find((res) => res.resourceId == targetResourceId);
-                for (const hook of getFunctionList((_t = (_s = columnConfig.foreignResource.hooks) === null || _s === void 0 ? void 0 : _s.dropdownList) === null || _t === void 0 ? void 0 : _t.beforeDatasourceRequest)) {
-                    const resp = yield hook({ query: body, adminUser });
+                for (const hook of listify((_u = (_t = columnConfig.foreignResource.hooks) === null || _t === void 0 ? void 0 : _t.dropdownList) === null || _u === void 0 ? void 0 : _u.beforeDatasourceRequest)) {
+                    const resp = yield hook({ query: body, adminUser, resource: targetResource });
                     if (!resp || (!resp.ok && !resp.error)) {
                         throw new Error(`Hook must return object with {ok: true} or { error: 'Error' } `);
                     }
@@ -716,8 +757,8 @@ class AdminForth {
                 const response = {
                     items
                 };
-                for (const hook of getFunctionList((_v = (_u = columnConfig.foreignResource.hooks) === null || _u === void 0 ? void 0 : _u.dropdownList) === null || _v === void 0 ? void 0 : _v.afterDatasourceResponse)) {
-                    const resp = yield hook({ response, adminUser });
+                for (const hook of listify((_w = (_v = columnConfig.foreignResource.hooks) === null || _v === void 0 ? void 0 : _v.dropdownList) === null || _w === void 0 ? void 0 : _w.afterDatasourceResponse)) {
+                    const resp = yield hook({ response, adminUser, resource: targetResource });
                     if (!resp || (!resp.ok && !resp.error)) {
                         throw new Error(`Hook must return object with {ok: true} or { error: 'Error' } `);
                     }
@@ -731,7 +772,7 @@ class AdminForth {
         server.endpoint({
             method: 'POST',
             path: '/get_min_max_for_columns',
-            handler: (_w) => __awaiter(this, [_w], void 0, function* ({ body }) {
+            handler: (_x) => __awaiter(this, [_x], void 0, function* ({ body }) {
                 const { resourceId } = body;
                 if (!this.statuses.dbDiscover) {
                     return { error: 'Database discovery not started' };
@@ -760,8 +801,8 @@ class AdminForth {
         server.endpoint({
             method: 'POST',
             path: '/create_record',
-            handler: (_x) => __awaiter(this, [_x], void 0, function* ({ body, adminUser }) {
-                var _y, _z, _0, _1, _2;
+            handler: (_y) => __awaiter(this, [_y], void 0, function* ({ body, adminUser }) {
+                var _z, _0, _1, _2, _3;
                 console.log('create_record', body, this.config.resources);
                 const resource = this.config.resources.find((res) => res.resourceId == body['resourceId']);
                 if (!resource) {
@@ -769,7 +810,7 @@ class AdminForth {
                 }
                 const record = body['record'];
                 // execute hook if needed
-                for (const hook of getFunctionList((_z = (_y = resource.hooks) === null || _y === void 0 ? void 0 : _y.create) === null || _z === void 0 ? void 0 : _z.beforeSave)) {
+                for (const hook of listify((_0 = (_z = resource.hooks) === null || _z === void 0 ? void 0 : _z.create) === null || _0 === void 0 ? void 0 : _0.beforeSave)) {
                     const resp = yield hook({ resource, record, adminUser });
                     if (!resp || (!resp.ok && !resp.error)) {
                         throw new Error(`Hook beforeSave must return object with {ok: true} or { error: 'Error' } `);
@@ -786,7 +827,7 @@ class AdminForth {
                             });
                         }
                     }
-                    if (((_0 = column.required) === null || _0 === void 0 ? void 0 : _0.create) && body['record'][column.name] === undefined) {
+                    if (((_1 = column.required) === null || _1 === void 0 ? void 0 : _1.create) && body['record'][column.name] === undefined) {
                         return { error: `Column '${column.name}' is required` };
                     }
                     if (column.isUnique) {
@@ -811,7 +852,7 @@ class AdminForth {
                 const connector = this.connectors[resource.dataSource];
                 yield connector.createRecord({ resource, record });
                 // execute hook if needed
-                for (const hook of getFunctionList((_2 = (_1 = resource.hooks) === null || _1 === void 0 ? void 0 : _1.create) === null || _2 === void 0 ? void 0 : _2.afterSave)) {
+                for (const hook of listify((_3 = (_2 = resource.hooks) === null || _2 === void 0 ? void 0 : _2.create) === null || _3 === void 0 ? void 0 : _3.afterSave)) {
                     const resp = yield hook({ resource, record, adminUser });
                     if (!resp || (!resp.ok && !resp.error)) {
                         throw new Error(`Hook afterSave must return object with {ok: true} or { error: 'Error' } `);
@@ -828,8 +869,8 @@ class AdminForth {
         server.endpoint({
             method: 'POST',
             path: '/update_record',
-            handler: (_3) => __awaiter(this, [_3], void 0, function* ({ body, adminUser }) {
-                var _4, _5, _6, _7;
+            handler: (_4) => __awaiter(this, [_4], void 0, function* ({ body, adminUser }) {
+                var _5, _6, _7, _8;
                 const resource = this.config.resources.find((res) => res.resourceId == body['resourceId']);
                 if (!resource) {
                     return { error: `Resource '${body['resourceId']}' not found` };
@@ -843,7 +884,7 @@ class AdminForth {
                 }
                 const record = body['record'];
                 // execute hook if needed
-                for (const hook of getFunctionList((_5 = (_4 = resource.hooks) === null || _4 === void 0 ? void 0 : _4.edit) === null || _5 === void 0 ? void 0 : _5.beforeSave)) {
+                for (const hook of listify((_6 = (_5 = resource.hooks) === null || _5 === void 0 ? void 0 : _5.edit) === null || _6 === void 0 ? void 0 : _6.beforeSave)) {
                     const resp = yield hook({ resource, record, adminUser });
                     if (!resp || (!resp.ok && !resp.error)) {
                         throw new Error(`Hook beforeSave must return object with {ok: true} or { error: 'Error' } `);
@@ -871,7 +912,7 @@ class AdminForth {
                     yield connector.updateRecord({ resource, recordId, record, newValues });
                 }
                 // execute hook if needed
-                for (const hook of getFunctionList((_7 = (_6 = resource.hooks) === null || _6 === void 0 ? void 0 : _6.edit) === null || _7 === void 0 ? void 0 : _7.afterSave)) {
+                for (const hook of listify((_8 = (_7 = resource.hooks) === null || _7 === void 0 ? void 0 : _7.edit) === null || _8 === void 0 ? void 0 : _8.afterSave)) {
                     const resp = yield hook({ resource, record, adminUser });
                     if (!resp || (!resp.ok && !resp.error)) {
                         throw new Error(`Hook afterSave must return object with {ok: true} or { error: 'Error' } `);
@@ -888,8 +929,8 @@ class AdminForth {
         server.endpoint({
             method: 'POST',
             path: '/delete_record',
-            handler: (_8) => __awaiter(this, [_8], void 0, function* ({ body, adminUser }) {
-                var _9, _10, _11, _12;
+            handler: (_9) => __awaiter(this, [_9], void 0, function* ({ body, adminUser }) {
+                var _10, _11, _12, _13;
                 const resource = this.config.resources.find((res) => res.resourceId == body['resourceId']);
                 const record = yield this.connectors[resource.dataSource].getRecordByPrimaryKey(resource, body['primaryKey']);
                 if (!resource) {
@@ -902,7 +943,7 @@ class AdminForth {
                     return { error: `Resource '${resource.resourceId}' does not allow delete action` };
                 }
                 // execute hook if needed
-                for (const hook of getFunctionList((_10 = (_9 = resource.hooks) === null || _9 === void 0 ? void 0 : _9.delete) === null || _10 === void 0 ? void 0 : _10.beforeSave)) {
+                for (const hook of listify((_11 = (_10 = resource.hooks) === null || _10 === void 0 ? void 0 : _10.delete) === null || _11 === void 0 ? void 0 : _11.beforeSave)) {
                     const resp = yield hook({ resource, record, adminUser });
                     if (!resp || (!resp.ok && !resp.error)) {
                         throw new Error(`Hook beforeSave must return object with {ok: true} or { error: 'Error' } `);
@@ -914,7 +955,7 @@ class AdminForth {
                 const connector = this.connectors[resource.dataSource];
                 yield connector.deleteRecord({ resource, recordId: body['primaryKey'] });
                 // execute hook if needed
-                for (const hook of getFunctionList((_12 = (_11 = resource.hooks) === null || _11 === void 0 ? void 0 : _11.delete) === null || _12 === void 0 ? void 0 : _12.afterSave)) {
+                for (const hook of listify((_13 = (_12 = resource.hooks) === null || _12 === void 0 ? void 0 : _12.delete) === null || _13 === void 0 ? void 0 : _13.afterSave)) {
                     const resp = yield hook({ resource, record, adminUser });
                     if (!resp || (!resp.ok && !resp.error)) {
                         throw new Error(`Hook afterSave must return object with {ok: true} or { error: 'Error' } `);
@@ -931,7 +972,7 @@ class AdminForth {
         server.endpoint({
             method: 'POST',
             path: '/start_bulk_action',
-            handler: (_13) => __awaiter(this, [_13], void 0, function* ({ body }) {
+            handler: (_14) => __awaiter(this, [_14], void 0, function* ({ body }) {
                 const { resourceId, actionId, recordIds } = body;
                 const resource = this.config.resources.find((res) => res.resourceId == resourceId);
                 if (!resource) {
@@ -962,7 +1003,7 @@ _a = AdminForth, _AdminForth_defaultConfig = new WeakMap();
 AdminForth.Types = AdminForthDataTypes;
 AdminForth.Utils = {
     generatePasswordHash: (password) => __awaiter(void 0, void 0, void 0, function* () {
-        return yield Auth.generatePasswordHash(password);
+        return yield AdminForthAuth.generatePasswordHash(password);
     })
 };
 export default AdminForth;

package/dist/modules/codeInjector.js

@@ -254,7 +254,6 @@ class CodeInjector {
                     });
                 });
             });
-            console.log('🔧 🔧 Injecting code into Vue sources...', customResourceComponents);
             customResourceComponents.forEach((filePath) => {
                 const componentName = getComponentNameFromPath(filePath);
                 this.allComponentNames[filePath] = componentName;

package/dist/modules/utils.js

@@ -28,16 +28,6 @@ export const ADMINFORTH_VERSION = package_json.version;
 export function getComponentNameFromPath(filePath) {
     return filePath.replace(/@/g, '').replace(/\./g, '').replace(/\//g, '');
 }
-export function getFunctionList(param) {
-    if (param) {
-        if (Array.isArray(param)) {
-            return param;
-        }
-        else {
-            return [param];
-        }
-    }
-    else {
-        return [];
-    }
+export function listify(param) {
+    return param || [];
 }

package/dist/plugins/AccessControl/index.js

@@ -0,0 +1,66 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { AllowedActionsEnum } from "../../types/AdminForthConfig.js";
+import AdminForthPlugin from "../base.js";
+class AccessControlPlugin extends AdminForthPlugin {
+    constructor(options) {
+        super(options, import.meta.url);
+        this.options = options;
+    }
+    modifyResourceConfig(adminforth, resourceConfig) {
+        super.modifyResourceConfig(adminforth, resourceConfig);
+        this.adminforth = adminforth;
+        if (!resourceConfig.hooks) {
+            resourceConfig.hooks = {};
+        }
+        const checkAccess = (adminUser, action, meta) => __awaiter(this, void 0, void 0, function* () {
+            const hasAccessOrError = yield this.options.hasAccess(adminUser, action, meta);
+            if (hasAccessOrError === true) {
+                return { ok: true };
+            }
+            else {
+                return { ok: false, error: hasAccessOrError || AccessControlPlugin.defaultError };
+            }
+        });
+        const bindHookCheck = (action, hookName) => {
+            if (!resourceConfig.hooks[action]) {
+                resourceConfig.hooks[action] = {};
+            }
+            if (!resourceConfig.hooks[action][hookName]) {
+                resourceConfig.hooks[action][hookName] = [];
+            }
+            if (hookName === 'beforeDatasourceRequest') {
+                resourceConfig.hooks[action][hookName].unshift((_a) => __awaiter(this, [_a], void 0, function* ({ adminUser, query }) {
+                    return checkAccess(adminUser, action, { query });
+                }));
+            }
+            else {
+                resourceConfig.hooks[action][hookName].unshift((_b) => __awaiter(this, [_b], void 0, function* ({ adminUser, record }) {
+                    return checkAccess(adminUser, action, { record });
+                }));
+            }
+        };
+        // List check
+        bindHookCheck(AllowedActionsEnum.list, 'beforeDatasourceRequest');
+        // Show check
+        bindHookCheck(AllowedActionsEnum.show, 'beforeDatasourceRequest');
+        // Edit check
+        bindHookCheck(AllowedActionsEnum.edit, 'beforeDatasourceRequest');
+        // create check
+        bindHookCheck(AllowedActionsEnum.create, 'beforeSave');
+        // edit check
+        bindHookCheck(AllowedActionsEnum.edit, 'beforeSave');
+        // delete check
+        bindHookCheck(AllowedActionsEnum.delete, 'beforeSave');
+        console.log('resourceConfig', resourceConfig);
+    }
+}
+AccessControlPlugin.defaultError = 'Sorry, you do not have access to this resource.';
+export default AccessControlPlugin;

package/dist/plugins/AccessControl/types.js

@@ -0,0 +1 @@
+export {};

package/dist/plugins/ForeignInlineListPlugin/index.js

@@ -24,7 +24,7 @@ export default class ForeignInlineListPlugin extends AdminForthPlugin {
                     return { error: `Resource ${this.options.foreignResourceId} not found` };
                 }
                 // exclude "plugins" key
-                const resourceCopy = Object.assign(Object.assign({}, resource), { plugins: undefined });
+                const resourceCopy = JSON.parse(JSON.stringify(Object.assign(Object.assign({}, resource), { plugins: undefined })));
                 if (this.options.modifyTableResourceConfig) {
                     this.options.modifyTableResourceConfig(resourceCopy);
                 }

package/dist/servers/express.js

@@ -149,7 +149,7 @@ class ExpressServer {
                 res.status(401).send('Unauthorized by AdminForth');
                 return;
             }
-            const adminforthUser = this.adminforth.auth.verify(jwt);
+            const adminforthUser = yield this.adminforth.auth.verify(jwt);
             if (!adminforthUser) {
                 res.status(401).send('Unauthorized by AdminForth');
             }
@@ -191,7 +191,7 @@ class ExpressServer {
                     this.message = message;
                 }
             };
-            const input = { body, query, headers, cookies, response, _raw_express_req: req, _raw_express_res: res };
+            const input = { body, query, headers, cookies, adminUser, response, _raw_express_req: req, _raw_express_res: res };
             let output;
             try {
                 output = yield handler(input);