adminforth 1.2.12 → 1.2.14

package/basePlugin.ts

@@ -11,11 +11,13 @@ export default class AdminForthPlugin implements IAdminForthPlugin {
   pluginDir: string;
   customFolderName: string = 'custom';
   pluginInstanceId: string;
+  customFolderPath: string;
 
   constructor(pluginOptions: any, metaUrl: string) {
     // set up plugin here
     this.pluginDir = currentFileDir(metaUrl);
     this.pluginInstanceId = uuidv4();
+    this.customFolderPath = path.join(this.pluginDir, this.customFolderName);
   }
 
   setupEndpoints(server: any) {
@@ -30,14 +32,12 @@ export default class AdminForthPlugin implements IAdminForthPlugin {
     const key = `@@/plugins/${this.constructor.name}/${componentFile}`;
     const componentName = getComponentNameFromPath(key);
 
-    const absSrcFolder = path.join(this.pluginDir, this.customFolderName);
-
-    if (!this.adminforth.codeInjector.srcFoldersToSync[absSrcFolder]) {
-      this.adminforth.codeInjector.srcFoldersToSync[absSrcFolder] = `./plugins/${this.constructor.name}/`;
+    if (!this.adminforth.codeInjector.srcFoldersToSync[this.customFolderPath]) {
+      this.adminforth.codeInjector.srcFoldersToSync[this.customFolderPath] = `./plugins/${this.constructor.name}/`;
     }
     
     if (!this.adminforth.codeInjector.allComponentNames[key]) {
-      const absSrcPath = path.join(absSrcFolder, componentFile);
+      const absSrcPath = path.join(this.customFolderPath, componentFile);
       if (!fs.existsSync(absSrcPath)) {
         throw new Error(`Plugin "${this.constructor.name}" tried to use file as component which does not exist at "${absSrcPath}"`);
       }

package/dist/basePlugin.js

@@ -9,6 +9,7 @@ export default class AdminForthPlugin {
         // set up plugin here
         this.pluginDir = currentFileDir(metaUrl);
         this.pluginInstanceId = uuidv4();
+        this.customFolderPath = path.join(this.pluginDir, this.customFolderName);
     }
     setupEndpoints(server) {
     }
@@ -18,12 +19,11 @@ export default class AdminForthPlugin {
     componentPath(componentFile) {
         const key = `@@/plugins/${this.constructor.name}/${componentFile}`;
         const componentName = getComponentNameFromPath(key);
-        const absSrcFolder = path.join(this.pluginDir, this.customFolderName);
-        if (!this.adminforth.codeInjector.srcFoldersToSync[absSrcFolder]) {
-            this.adminforth.codeInjector.srcFoldersToSync[absSrcFolder] = `./plugins/${this.constructor.name}/`;
+        if (!this.adminforth.codeInjector.srcFoldersToSync[this.customFolderPath]) {
+            this.adminforth.codeInjector.srcFoldersToSync[this.customFolderPath] = `./plugins/${this.constructor.name}/`;
         }
         if (!this.adminforth.codeInjector.allComponentNames[key]) {
-            const absSrcPath = path.join(absSrcFolder, componentFile);
+            const absSrcPath = path.join(this.customFolderPath, componentFile);
             if (!fs.existsSync(absSrcPath)) {
                 throw new Error(`Plugin "${this.constructor.name}" tried to use file as component which does not exist at "${absSrcPath}"`);
             }

package/dist/index.js

@@ -49,6 +49,7 @@ class AdminForth {
         console.log(`🚀 AdminForth v${ADMINFORTH_VERSION} starting up`);
     }
     activatePlugins() {
+        process.env.HEAVY_DEBUG && console.log('🔌🔌🔌 Activating plugins');
         for (let resource of this.config.resources) {
             for (let pluginInstance of resource.plugins || []) {
                 pluginInstance.modifyResourceConfig(this, resource);

package/dist/modules/codeInjector.js

@@ -87,6 +87,45 @@ class CodeInjector {
             }
         });
     }
+    packagesFromNpm(dir) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const usersPackagePath = path.join(dir, 'package.json');
+            let packageContent = null;
+            let lockHash = '';
+            let packages = [];
+            try {
+                packageContent = JSON.parse(yield fs.promises.readFile(usersPackagePath, 'utf-8'));
+            }
+            catch (e) {
+                // user package.json does not exist, user does not have custom components
+            }
+            if (packageContent) {
+                const lockPath = path.join(dir, 'package-lock.json');
+                let lock = null;
+                try {
+                    lock = JSON.parse(yield fs.promises.readFile(lockPath, 'utf-8'));
+                }
+                catch (e) {
+                    throw new Error(`Custom package-lock.json does not exist in ${dir}, but package.json does. 
+          We can't determine version of packages without package-lock.json. Please run npm install in ${dir}`);
+                }
+                lockHash = hashify(lock);
+                packages = [
+                    ...Object.keys(packageContent.dependencies || []),
+                    ...Object.keys(packageContent.devDependencies || [])
+                ].reduce((acc, packageName) => {
+                    const pack = lock.packages[`node_modules/${packageName}`];
+                    if (!pack) {
+                        throw new Error(`Package ${packageName} is not in package-lock.json but is in package.json. Please run 'npm install' in ${dir}`);
+                    }
+                    const version = pack.version;
+                    acc.push(`${packageName}@${version}`);
+                    return acc;
+                }, []);
+            }
+            return [lockHash, packages];
+        });
+    }
     prepareSources(_a) {
         return __awaiter(this, arguments, void 0, function* ({ filesUpdated }) {
             var _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
@@ -358,30 +397,26 @@ class CodeInjector {
             const spaLockHash = hashify(spaPackageLock);
             /* customPackageLock */
             let usersLockHash = '';
-            let usersLock = null;
-            let usersPackage = null;
+            let usersPackages = [];
             if ((_m = this.adminforth.config.customization) === null || _m === void 0 ? void 0 : _m.customComponentsDir) {
-                const usersPackagePath = path.join(this.adminforth.config.customization.customComponentsDir, 'package.json');
-                try {
-                    usersPackage = JSON.parse(yield fs.promises.readFile(usersPackagePath, 'utf-8'));
-                }
-                catch (e) {
-                    // user package.json does not exist, user does not have custom components
-                }
-                if (usersPackage) {
-                    const usersLockPath = path.join(this.adminforth.config.customization.customComponentsDir, 'package-lock.json');
-                    try {
-                        usersLock = JSON.parse(yield fs.promises.readFile(usersLockPath, 'utf-8'));
-                    }
-                    catch (e) {
-                        throw new Error(`Custom package-lock.json does not exist in ${this.adminforth.config.customization.customComponentsDir}, but package.json does. 
-            We can't determine version of packages without package-lock.json. Please run npm install in ${this.adminforth.config.customization.customComponentsDir}`);
-                    }
-                    usersLockHash = hashify(usersLock);
+                [usersLockHash, usersPackages] = yield this.packagesFromNpm(this.adminforth.config.customization.customComponentsDir);
+            }
+            const pluginPackages = [];
+            // for every installed plugin generate packages
+            for (const plugin of this.adminforth.activatedPlugins) {
+                const [lockHash, packages] = yield this.packagesFromNpm(plugin.customFolderPath);
+                if (packages.length) {
+                    pluginPackages.push({
+                        pluginName: plugin.constructor.name,
+                        lockHash,
+                        packages,
+                    });
                 }
             }
+            // form string "pluginName:lockHash::pLugin2Name:lockHash"
+            const pluginsLockHash = pluginPackages.map(({ pluginName, lockHash }) => `${pluginName}>${lockHash}`).join('::');
             const iconPackagesNamesHash = hashify(iconPackageNames);
-            const fullHash = `${spaLockHash}::${iconPackagesNamesHash}::${usersLockHash}`;
+            const fullHash = `spa>${spaLockHash}::icons>${iconPackagesNamesHash}::user/custom>${usersLockHash}::${pluginsLockHash}`;
             const hashPath = path.join(CodeInjector.SPA_TMP_PATH, 'node_modules', '.adminforth_hash');
             try {
                 const existingHash = yield fs.promises.readFile(hashPath, 'utf-8');
@@ -398,19 +433,12 @@ class CodeInjector {
                 process.env.HEAVY_DEBUG && console.log('🪲Hash file does not exist, proceeding with npm ci/install');
             }
             yield this.runNpmShell({ command: 'ci', cwd: CodeInjector.SPA_TMP_PATH });
-            let customPackgeNames = [];
-            if (usersPackage && usersLock) {
-                customPackgeNames = [
-                    ...Object.keys(usersPackage.dependencies || []),
-                    ...Object.keys(usersPackage.devDependencies || [])
-                ].reduce((acc, packageName) => {
-                    const version = usersLock.packages[`node_modules/${packageName}`].version;
-                    acc.push(`${packageName}@${version}`);
-                    return acc;
-                }, []);
-            }
             if (iconPackageNames.length) {
-                const npmInstallCommand = `install ${[...iconPackageNames, ...customPackgeNames].join(' ')}`;
+                const npmInstallCommand = `install ${[
+                    ...iconPackageNames,
+                    ...usersPackages,
+                    ...pluginPackages.map(({ packages }) => packages)
+                ].join(' ')}`;
                 yield this.runNpmShell({ command: npmInstallCommand, cwd: CodeInjector.SPA_TMP_PATH });
             }
             yield fs.promises.writeFile(hashPath, fullHash);
@@ -466,6 +494,9 @@ class CodeInjector {
             const directories = [];
             const files = [];
             const collectDirectories = (dir) => __awaiter(this, void 0, void 0, function* () {
+                if (['node_modules', 'dist'].includes(path.basename(dir))) {
+                    return;
+                }
                 directories.push(dir);
                 const filesAndDirs = yield fs.promises.readdir(dir, { withFileTypes: true });
                 yield Promise.all(filesAndDirs.map((file) => __awaiter(this, void 0, void 0, function* () {

package/dist/modules/configValidator.js

@@ -134,7 +134,7 @@ export default class ConfigValidator {
         }
         if (this.config.resources) {
             this.config.resources.forEach((res) => {
-                var _a, _b, _c;
+                var _a;
                 if (!res.table) {
                     errors.push(`Resource "${res.dataSource}" is missing table`);
                 }
@@ -240,12 +240,13 @@ export default class ConfigValidator {
                     errors.push(`Resource "${res.resourceId}" bulkActions must be an array`);
                     bulkActions = [];
                 }
-                if (((_c = (_b = res.options) === null || _b === void 0 ? void 0 : _b.allowedActions) === null || _c === void 0 ? void 0 : _c.delete) && !bulkActions.find((action) => action.label === 'Delete checked')) {
+                if (!bulkActions.find((action) => action.label === 'Delete checked')) {
                     bulkActions.push({
                         label: `Delete checked`,
                         state: 'danger',
                         icon: 'flowbite:trash-bin-outline',
-                        action: (_d) => __awaiter(this, [_d], void 0, function* ({ selectedIds }) {
+                        allowed: (_b) => __awaiter(this, [_b], void 0, function* ({ resource, adminUser, allowedActions }) { return allowedActions.delete; }),
+                        action: (_c) => __awaiter(this, [_c], void 0, function* ({ selectedIds }) {
                             const connector = this.adminforth.connectors[res.dataSource];
                             yield Promise.all(selectedIds.map((recordId) => __awaiter(this, void 0, void 0, function* () {
                                 yield connector.deleteRecord({ resource: res, recordId });

package/dist/modules/restApi.js

@@ -242,9 +242,19 @@ export default class AdminForthRestAPI {
                     return { error: `Resource ${resourceId} not found` };
                 }
                 const { allowedActions } = yield interpretResource(adminUser, resource, {}, ActionCheckSource.DisplayButtons);
+                const allowedBulkActions = [];
+                yield Promise.all(resource.options.bulkActions.map((action) => __awaiter(this, void 0, void 0, function* () {
+                    if (action.allowed) {
+                        const res = yield action.allowed({ adminUser, resource, allowedActions });
+                        console.log('🪲🪲🪲🪲checking for allowedActions', allowedActions, 'res', res);
+                        if (res) {
+                            allowedBulkActions.push(action);
+                        }
+                    }
+                })));
                 // exclude "plugins" key
                 return {
-                    resource: Object.assign(Object.assign({}, resource), { plugins: undefined, options: Object.assign(Object.assign({}, resource.options), { allowedActions }) })
+                    resource: Object.assign(Object.assign({}, resource), { plugins: undefined, options: Object.assign(Object.assign({}, resource.options), { bulkActions: allowedBulkActions, allowedActions }) })
                 };
             }),
         });
@@ -598,18 +608,21 @@ export default class AdminForthRestAPI {
             method: 'POST',
             path: '/start_bulk_action',
             handler: (_11) => __awaiter(this, [_11], void 0, function* ({ body }) {
-                const { resourceId, actionId, recordIds } = body;
+                const { resourceId, actionId, recordIds, adminUser } = body;
                 const resource = this.adminforth.config.resources.find((res) => res.resourceId == resourceId);
                 if (!resource) {
                     return { error: `Resource '${resourceId}' not found` };
                 }
+                const { allowedActions } = yield interpretResource(adminUser, resource, { requestBody: body }, ActionCheckSource.BulkActionRequest);
                 const action = resource.options.bulkActions.find((act) => act.id == actionId);
                 if (!action) {
                     return { error: `Action '${actionId}' not found` };
                 }
-                else {
-                    yield action.action({ selectedIds: recordIds });
+                const execAllowed = yield action.allowed({ adminUser, resource, recordIds, allowedActions });
+                if (!execAllowed) {
+                    return { error: `Action '${actionId}' is not allowed` };
                 }
+                yield action.action({ selectedIds: recordIds });
                 return {
                     actionId,
                     recordIds,

package/dist/types/AdminForthConfig.js

@@ -70,6 +70,7 @@ export var ActionCheckSource;
     ActionCheckSource["EditRequest"] = "editRequest";
     ActionCheckSource["CreateRequest"] = "createRequest";
     ActionCheckSource["DeleteRequest"] = "deleteRequest";
+    ActionCheckSource["BulkActionRequest"] = "bulkActionRequest";
 })(ActionCheckSource || (ActionCheckSource = {}));
 export var AdminForthDataTypes;
 (function (AdminForthDataTypes) {

package/index.ts

@@ -77,6 +77,7 @@ class AdminForth implements IAdminForth {
   }
 
   activatePlugins() {
+    process.env.HEAVY_DEBUG && console.log('🔌🔌🔌 Activating plugins');
     for (let resource of this.config.resources) {
       for (let pluginInstance of resource.plugins || []) {
         pluginInstance.modifyResourceConfig(this, resource);

package/modules/codeInjector.ts

@@ -11,6 +11,7 @@ import { ADMIN_FORTH_ABSOLUTE_PATH, getComponentNameFromPath, transformObject, d
 import { styles } from './styles.js'
 import { AdminForthComponentDeclaration, ICodeInjector } from '../types/AdminForthConfig.js';
 import { StylesGenerator } from './styleGenerator.js';
+import { string } from 'zod';
 
 
 
@@ -103,6 +104,47 @@ class CodeInjector implements ICodeInjector {
     }
   }
 
+  async packagesFromNpm(dir: string): Promise<[string, string[]]> {
+    const usersPackagePath = path.join(dir, 'package.json');
+    let packageContent: { dependencies: any, devDependencies: any } = null;
+    let lockHash: string = '';
+    let packages: string[] = [];
+    try {
+      packageContent = JSON.parse(await fs.promises.readFile(usersPackagePath, 'utf-8'));
+    } catch (e) {
+      // user package.json does not exist, user does not have custom components
+    }
+    if (packageContent) {
+      const lockPath = path.join(dir, 'package-lock.json');
+      let lock = null;
+      try {
+        lock = JSON.parse(await fs.promises.readFile(lockPath, 'utf-8'));
+      } catch (e) {
+        throw new Error(`Custom package-lock.json does not exist in ${dir}, but package.json does. 
+          We can't determine version of packages without package-lock.json. Please run npm install in ${dir}`);
+      }
+      lockHash = hashify(lock);
+
+      packages = [
+        ...Object.keys(packageContent.dependencies || []),
+        ...Object.keys(packageContent.devDependencies || [])
+      ].reduce(
+          (acc, packageName) => {
+            const pack = lock.packages[`node_modules/${packageName}`];
+            if (!pack) {
+              throw new Error(`Package ${packageName} is not in package-lock.json but is in package.json. Please run 'npm install' in ${dir}`);
+            }
+            const version = pack.version;
+
+            acc.push(`${packageName}@${version}`);
+            return acc;
+          }, []
+      );
+      
+    }
+    return [lockHash, packages];
+  }
+
   async prepareSources({ filesUpdated }: { filesUpdated?: string[] }) {
     // check SPA_TMP_PATH exists and create if not
     try {
@@ -251,8 +293,6 @@ class CodeInjector implements ICodeInjector {
       }
     }
 
-
-
     //collect all 'icon' fields from resources bulkActions
     this.adminforth.config.resources.forEach((resource) => {
       if (resource.options?.bulkActions) {
@@ -409,32 +449,37 @@ class CodeInjector implements ICodeInjector {
     const spaLockHash = hashify(spaPackageLock);
 
     /* customPackageLock */
-    let usersLockHash = '';
-    let usersLock = null;
-    let usersPackage = null;
+    let usersLockHash: string = '';
+    let usersPackages: string[] = [];
+
 
     if (this.adminforth.config.customization?.customComponentsDir) {
-      const usersPackagePath = path.join(this.adminforth.config.customization.customComponentsDir, 'package.json');
-      try {
-        usersPackage = JSON.parse(await fs.promises.readFile(usersPackagePath, 'utf-8'));
-      } catch (e) {
-        // user package.json does not exist, user does not have custom components
-      }
-      if (usersPackage) {
-        const usersLockPath = path.join(this.adminforth.config.customization.customComponentsDir, 'package-lock.json');
-        try {
-          usersLock = JSON.parse(await fs.promises.readFile(usersLockPath, 'utf-8'));
-        } catch (e) {
-          throw new Error(`Custom package-lock.json does not exist in ${this.adminforth.config.customization.customComponentsDir}, but package.json does. 
-            We can't determine version of packages without package-lock.json. Please run npm install in ${this.adminforth.config.customization.customComponentsDir}`);
-        }
-        usersLockHash = hashify(usersLock);
+      [usersLockHash, usersPackages] = await this.packagesFromNpm(this.adminforth.config.customization.customComponentsDir);
+    }
+
+    const pluginPackages: {
+        pluginName: string,
+        lockHash: string,
+        packages: string[],
+    }[] = [];
+
+    // for every installed plugin generate packages
+    for (const plugin of this.adminforth.activatedPlugins) {
+      const [lockHash, packages] = await this.packagesFromNpm(plugin.customFolderPath);
+      if (packages.length) {
+        pluginPackages.push({
+          pluginName: plugin.constructor.name,
+          lockHash,
+          packages,
+        });
       }
     }
+    // form string "pluginName:lockHash::pLugin2Name:lockHash"
+    const pluginsLockHash = pluginPackages.map(({ pluginName, lockHash }) => `${pluginName}>${lockHash}`).join('::');
 
     const iconPackagesNamesHash = hashify(iconPackageNames);
 
-    const fullHash = `${spaLockHash}::${iconPackagesNamesHash}::${usersLockHash}`;
+    const fullHash = `spa>${spaLockHash}::icons>${iconPackagesNamesHash}::user/custom>${usersLockHash}::${pluginsLockHash}`;
     const hashPath = path.join(CodeInjector.SPA_TMP_PATH, 'node_modules', '.adminforth_hash');
 
     try {
@@ -452,29 +497,20 @@ class CodeInjector implements ICodeInjector {
 
     await this.runNpmShell({command: 'ci', cwd: CodeInjector.SPA_TMP_PATH});
 
-    let customPackgeNames = [];
-    if (usersPackage && usersLock) {
-      customPackgeNames = [
-        ...Object.keys(usersPackage.dependencies || []),
-        ...Object.keys(usersPackage.devDependencies || [])
-      ].reduce(
-          (acc, packageName) => {
-            const version = usersLock.packages[`node_modules/${packageName}`].version;
-            acc.push(`${packageName}@${version}`);
-            return acc;
-          }, []
-      );
-    }
-
+    
     if (iconPackageNames.length) {
-      const npmInstallCommand = `install ${[...iconPackageNames, ...customPackgeNames].join(' ')}`;
+      const npmInstallCommand = `install ${[
+        ...iconPackageNames,
+        ...usersPackages, 
+        ...pluginPackages.map(({ packages }) => packages)
+      ].join(' ')}`;
       await this.runNpmShell({command: npmInstallCommand, cwd: CodeInjector.SPA_TMP_PATH});
     }
 
     await fs.promises.writeFile(hashPath, fullHash);
   }
 
-async watchForReprepare({}) {
+  async watchForReprepare({}) {
     const spaPath = path.join(ADMIN_FORTH_ABSOLUTE_PATH, 'spa');
     // get list of all subdirectories in spa recursively
     const directories = [];
@@ -528,6 +564,9 @@ async watchForReprepare({}) {
     const directories = [];
     const files = []
     const collectDirectories = async (dir) => {
+      if (['node_modules', 'dist'].includes(path.basename(dir))) {
+        return;
+      }
       directories.push(dir);
 
       const filesAndDirs = await fs.promises.readdir(dir, { withFileTypes: true });

package/modules/configValidator.ts

@@ -260,11 +260,12 @@ export default class ConfigValidator implements IConfigValidator {
           bulkActions = [];
         }
 
-        if (res.options?.allowedActions?.delete && !bulkActions.find((action) => action.label === 'Delete checked')) {
+        if (!bulkActions.find((action) => action.label === 'Delete checked')) {
           bulkActions.push({
             label: `Delete checked`,
             state: 'danger',
             icon: 'flowbite:trash-bin-outline',
+            allowed: async ({ resource, adminUser, allowedActions }) => { return allowedActions.delete },
             action: async ({ selectedIds }) => {
               const connector = this.adminforth.connectors[res.dataSource];
               await Promise.all(selectedIds.map(async (recordId) => {

package/modules/restApi.ts

@@ -12,7 +12,8 @@ import {
   BeforeSaveFunction,
   AfterDataSourceResponseFunction,
   BeforeDataSourceRequestFunction,
-  AfterSaveFunction
+  AfterSaveFunction,
+  AllowedActionsResolved
 
 } from "../types/AdminForthConfig.js";
 
@@ -223,7 +224,7 @@ export default class AdminForthRestAPI {
       },
     });
 
-    async function interpretResource(adminUser: AdminUser, resource: AdminForthResource, meta: any, source: ActionCheckSource): Promise<{allowedActions: AllowedActions}> {
+    async function interpretResource(adminUser: AdminUser, resource: AdminForthResource, meta: any, source: ActionCheckSource): Promise<{allowedActions: AllowedActionsResolved}> {
       if (process.env.HEAVY_DEBUG) {
         console.log('🪲Interpreting resource', resource.resourceId, source);
       }
@@ -274,13 +275,28 @@ export default class AdminForthRestAPI {
 
         const { allowedActions } = await interpretResource(adminUser, resource, {}, ActionCheckSource.DisplayButtons);
 
+
+        const allowedBulkActions = [];
+        await Promise.all(
+          resource.options.bulkActions.map(async (action) => {
+            if (action.allowed) {
+              const res = await action.allowed({ adminUser, resource, allowedActions });
+              console.log('🪲🪲🪲🪲checking for allowedActions', allowedActions, 'res', res);
+              if (res) {
+                allowedBulkActions.push(action);
+              }
+            }
+          })
+        );
+
         // exclude "plugins" key
         return { 
           resource: { 
-            ...resource, 
+            ...resource,
             plugins: undefined, 
             options: {
               ...resource.options,
+              bulkActions: allowedBulkActions,
               allowedActions,
             } 
           }
@@ -680,24 +696,29 @@ export default class AdminForthRestAPI {
         method: 'POST',
         path: '/start_bulk_action',
         handler: async ({ body }) => {
-            const { resourceId, actionId, recordIds } = body;
+            const { resourceId, actionId, recordIds, adminUser } = body;
             const resource = this.adminforth.config.resources.find((res) => res.resourceId == resourceId);
             if (!resource) {
                 return { error: `Resource '${resourceId}' not found` };
             }
+            const { allowedActions } = await interpretResource(adminUser, resource, { requestBody: body }, ActionCheckSource.BulkActionRequest);
+
             const action = resource.options.bulkActions.find((act) => act.id == actionId);
             if (!action) {
-                return { error: `Action '${actionId}' not found` };
-            } else{
-              await action.action({selectedIds:recordIds})
-
+              return { error: `Action '${actionId}' not found` };
+            } 
+            
+            const execAllowed = await action.allowed({ adminUser, resource, recordIds, allowedActions });
+            if (!execAllowed) {
+              return { error: `Action '${actionId}' is not allowed` };
             }
+            await action.action({selectedIds:recordIds})
+            
             return {
               actionId,
               recordIds,
               resourceId,
-              status:'success'
-              
+              status: 'success'
             }
         }
     })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "adminforth",
-  "version": "1.2.12",
+  "version": "1.2.14",
   "description": "OpenSource Vue3 powered forth-generation admin panel",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/types/AdminForthConfig.ts

@@ -271,6 +271,7 @@ export interface IAdminForthPlugin {
   pluginDir: string;
   customFolderName: string;
   pluginInstanceId: string;
+  customFolderPath: string;
 
   /**
    * AdminForth plugins concept is based on modification of full AdminForth configuration
@@ -728,11 +729,44 @@ export type AdminForthResource = {
         afterSave?: BeforeSaveFunction | Array<BeforeSaveFunction>,
       },
     },
+
+    /**
+     * General options for resource.
+     */
     options?: {
+
+      /**
+       * Default sort for list view.
+       * Example:
+       * 
+       * ```ts
+       * import { AdminForthSortDirections } from 'adminforth';
+       * 
+       * ...
+       * 
+       * defaultSort: {
+       *   columnName: 'created_at',
+       *   direction: AdminForthSortDirections.ASC, 
+       * }
+       * ```
+       * 
+       */
       defaultSort?: {
+
+        /**
+         * Column name which will be used to sort records.
+         */
         columnName: string,
+
+        /**
+         * Direction of sorting. Can be 'asc' or 'desc'.
+         */
         direction: AdminForthSortDirections | string,
       }
+
+      /**
+       * Custom bulk actions list
+       */
       bulkActions?: Array<{
         id?: string,
         label: string,
@@ -740,7 +774,87 @@ export type AdminForthResource = {
         icon?: string,
         action: Function,
         confirm?: string,
+
+        /**
+         * Allowed callback called to check whether action is allowed for user.
+         * 1. It called first time when user goes to list view. If callback returns false, action button will be hidden on list view.
+         * 2. This same callback called second time when user clicks an action button. If callback returns false, action will not be executed.
+         * In second time recordIds will be passed to callback (because checkbox for items are selected), so you can use this to make additional 
+         * checks ( for example to check if user has permission for certain records ).
+         * 
+         * Example:
+         * 
+         * ```ts
+         * allowed: async ({ resource, adminUser, recordIds }) => {
+         *   if (adminUser.isRoot || adminUser.dbUser.role !== 'superadmin') {
+         *    return false;
+         *   } 
+         *   return true;
+         * }
+         * ```
+         * 
+         */
+        allowed?: ({ resource, adminUser, recordIds }: {
+
+          /**
+           * recordIds will be passed only once user tries to perform bulk action by clicking on button
+           */
+          recordIds?: Array<any>,
+          resource: AdminForthResource,
+
+          /**
+           * Admin user object
+           */
+          adminUser: AdminUser,
+
+          /**
+           * Allowed standard actions for current user resolved by calling allowedActions callbacks if they are passed.
+           * You can use this variable to rely on standard actions permissions. E.g. if you have custom actions "Mark as read", you 
+           * might want to allow it only for users who have "edit" action allowed:
+           * 
+           * Example:
+           * 
+           * ```ts
+           * 
+           * options: {
+           *   bulkActions: [
+           *     {
+           *       label: 'Mark as read',
+           *       action: async ({ resource, recordIds }) => {
+           *         await markAsRead(recordIds);
+           *       },
+           *       allowed: ({ allowedActions }) => allowedActions.edit,
+           *     }
+           *   ],
+           *   allowedActions: {
+           *     edit: ({ resource, adminUser, recordIds }) => {
+           *       return adminUser.isRoot || adminUser.dbUser.role === 'superadmin';
+           *     }
+           *   }
+           * }
+           * ```
+           * 
+           */
+          allowedActions: AllowedActionsResolved,
+         }) => Promise<boolean>,
       }>,
+
+      /**
+       * Allowed actions for resource.
+       * 
+       * Example: 
+       * 
+       * ```ts
+       * allowedActions: {
+       *  create: ({ resource, adminUser }) => {
+       *    // Allow only superadmin or root user to create records
+       *    return adminUser.isRoot || adminUser.dbUser.role === 'superadmin';
+       *  },
+       *  delete: false, // disable delete action for all users
+       * }
+       * ```
+       * 
+       */
       allowedActions?: AllowedActions,
 
       /** 
@@ -1100,6 +1214,7 @@ export enum ActionCheckSource {
   EditRequest = 'editRequest',
   CreateRequest = 'createRequest',
   DeleteRequest = 'deleteRequest',
+  BulkActionRequest = 'bulkActionRequest',
 }
 
 /**
@@ -1111,6 +1226,10 @@ export type AllowedActions = {
   all?: AllowedActionValue;
 }
   
+export type AllowedActionsResolved = {
+  [key in AllowedActionsEnum]?: boolean
+}
+
 export type ValidationObject = {
     /**
      * Should be pure string (not RegExp string)