adminforth 1.2.13 → 1.2.15

package/dist/modules/restApi.js

@@ -608,18 +608,21 @@ export default class AdminForthRestAPI {
             method: 'POST',
             path: '/start_bulk_action',
             handler: (_11) => __awaiter(this, [_11], void 0, function* ({ body }) {
-                const { resourceId, actionId, recordIds } = body;
+                const { resourceId, actionId, recordIds, adminUser } = body;
                 const resource = this.adminforth.config.resources.find((res) => res.resourceId == resourceId);
                 if (!resource) {
                     return { error: `Resource '${resourceId}' not found` };
                 }
+                const { allowedActions } = yield interpretResource(adminUser, resource, { requestBody: body }, ActionCheckSource.BulkActionRequest);
                 const action = resource.options.bulkActions.find((act) => act.id == actionId);
                 if (!action) {
                     return { error: `Action '${actionId}' not found` };
                 }
-                else {
-                    yield action.action({ selectedIds: recordIds });
+                const execAllowed = yield action.allowed({ adminUser, resource, recordIds, allowedActions });
+                if (!execAllowed) {
+                    return { error: `Action '${actionId}' is not allowed` };
                 }
+                yield action.action({ selectedIds: recordIds });
                 return {
                     actionId,
                     recordIds,

package/dist/types/AdminForthConfig.js

@@ -70,6 +70,7 @@ export var ActionCheckSource;
     ActionCheckSource["EditRequest"] = "editRequest";
     ActionCheckSource["CreateRequest"] = "createRequest";
     ActionCheckSource["DeleteRequest"] = "deleteRequest";
+    ActionCheckSource["BulkActionRequest"] = "bulkActionRequest";
 })(ActionCheckSource || (ActionCheckSource = {}));
 export var AdminForthDataTypes;
 (function (AdminForthDataTypes) {

package/modules/restApi.ts

@@ -696,24 +696,29 @@ export default class AdminForthRestAPI {
         method: 'POST',
         path: '/start_bulk_action',
         handler: async ({ body }) => {
-            const { resourceId, actionId, recordIds } = body;
+            const { resourceId, actionId, recordIds, adminUser } = body;
             const resource = this.adminforth.config.resources.find((res) => res.resourceId == resourceId);
             if (!resource) {
                 return { error: `Resource '${resourceId}' not found` };
             }
+            const { allowedActions } = await interpretResource(adminUser, resource, { requestBody: body }, ActionCheckSource.BulkActionRequest);
+
             const action = resource.options.bulkActions.find((act) => act.id == actionId);
             if (!action) {
-                return { error: `Action '${actionId}' not found` };
-            } else{
-              await action.action({selectedIds:recordIds})
-
+              return { error: `Action '${actionId}' not found` };
+            } 
+            
+            const execAllowed = await action.allowed({ adminUser, resource, recordIds, allowedActions });
+            if (!execAllowed) {
+              return { error: `Action '${actionId}' is not allowed` };
             }
+            await action.action({selectedIds:recordIds})
+            
             return {
               actionId,
               recordIds,
               resourceId,
-              status:'success'
-              
+              status: 'success'
             }
         }
     })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "adminforth",
-  "version": "1.2.13",
+  "version": "1.2.15",
   "description": "OpenSource Vue3 powered forth-generation admin panel",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/types/AdminForthConfig.ts

@@ -740,11 +740,13 @@ export type AdminForthResource = {
        * Example:
        * 
        * ```ts
+       * import { AdminForthSortDirections } from 'adminforth';
+       * 
+       * ...
+       * 
        * defaultSort: {
        *   columnName: 'created_at',
        *   direction: AdminForthSortDirections.ASC, 
-       *   // or
-       *   // direction: 'asc' // if you are using non-typescript
        * }
        * ```
        * 
@@ -761,6 +763,10 @@ export type AdminForthResource = {
          */
         direction: AdminForthSortDirections | string,
       }
+
+      /**
+       * Custom bulk actions list
+       */
       bulkActions?: Array<{
         id?: string,
         label: string,
@@ -768,12 +774,87 @@ export type AdminForthResource = {
         icon?: string,
         action: Function,
         confirm?: string,
-        allowed?: ({ resource, adminUser }: { 
-          resource: AdminForthResource, 
+
+        /**
+         * Allowed callback called to check whether action is allowed for user.
+         * 1. It called first time when user goes to list view. If callback returns false, action button will be hidden on list view.
+         * 2. This same callback called second time when user clicks an action button. If callback returns false, action will not be executed.
+         * In second time recordIds will be passed to callback (because checkbox for items are selected), so you can use this to make additional 
+         * checks ( for example to check if user has permission for certain records ).
+         * 
+         * Example:
+         * 
+         * ```ts
+         * allowed: async ({ resource, adminUser, recordIds }) => {
+         *   if (adminUser.isRoot || adminUser.dbUser.role !== 'superadmin') {
+         *    return false;
+         *   } 
+         *   return true;
+         * }
+         * ```
+         * 
+         */
+        allowed?: ({ resource, adminUser, recordIds }: {
+
+          /**
+           * recordIds will be passed only once user tries to perform bulk action by clicking on button
+           */
+          recordIds?: Array<any>,
+          resource: AdminForthResource,
+
+          /**
+           * Admin user object
+           */
           adminUser: AdminUser,
+
+          /**
+           * Allowed standard actions for current user resolved by calling allowedActions callbacks if they are passed.
+           * You can use this variable to rely on standard actions permissions. E.g. if you have custom actions "Mark as read", you 
+           * might want to allow it only for users who have "edit" action allowed:
+           * 
+           * Example:
+           * 
+           * ```ts
+           * 
+           * options: {
+           *   bulkActions: [
+           *     {
+           *       label: 'Mark as read',
+           *       action: async ({ resource, recordIds }) => {
+           *         await markAsRead(recordIds);
+           *       },
+           *       allowed: ({ allowedActions }) => allowedActions.edit,
+           *     }
+           *   ],
+           *   allowedActions: {
+           *     edit: ({ resource, adminUser, recordIds }) => {
+           *       return adminUser.isRoot || adminUser.dbUser.role === 'superadmin';
+           *     }
+           *   }
+           * }
+           * ```
+           * 
+           */
           allowedActions: AllowedActionsResolved,
          }) => Promise<boolean>,
       }>,
+
+      /**
+       * Allowed actions for resource.
+       * 
+       * Example: 
+       * 
+       * ```ts
+       * allowedActions: {
+       *  create: ({ resource, adminUser }) => {
+       *    // Allow only superadmin or root user to create records
+       *    return adminUser.isRoot || adminUser.dbUser.role === 'superadmin';
+       *  },
+       *  delete: false, // disable delete action for all users
+       * }
+       * ```
+       * 
+       */
       allowedActions?: AllowedActions,
 
       /** 
@@ -1133,6 +1214,7 @@ export enum ActionCheckSource {
   EditRequest = 'editRequest',
   CreateRequest = 'createRequest',
   DeleteRequest = 'deleteRequest',
+  BulkActionRequest = 'bulkActionRequest',
 }
 
 /**