adminizer 4.1.0-build.14 → 4.1.0-build.16

package/controllers/add.js

@@ -21,7 +21,7 @@ export default async function add(req, res) {
             return res.sendStatus(403);
         }
     }
-    let dataAccessor = new DataAccessor(req, entity, "add");
+    let dataAccessor = new DataAccessor(req.adminizer, req.user, entity, "add");
     let fields = dataAccessor.getFieldsConfig();
     // add deprecated 'records' to config
     fields = await FieldsHelper.loadAssociations(req, fields, "add");

package/controllers/edit.js

@@ -30,7 +30,7 @@ export default async function edit(req, res) {
     let dataAccessor;
     try {
         const id = req.params.id;
-        dataAccessor = new DataAccessor(req, entity, "edit");
+        dataAccessor = new DataAccessor(req.adminizer, req.user, entity, "edit");
         record = await entity.model.findOne({ id: id }, dataAccessor);
         if (!record)
             return res.status(404).send("Adminpanel > Record not found");

package/controllers/list.js

@@ -16,7 +16,7 @@ export default async function list(req, res) {
             return res.sendStatus(403);
         }
     }
-    let dataAccessor = new DataAccessor(req, entity, "list");
+    let dataAccessor = new DataAccessor(req.adminizer, req.user, entity, "list");
     let fields = dataAccessor.getFieldsConfig();
     const header = inertiaListHelper(entity, req, fields);
     let start = "0";

package/controllers/navigation/edit.js

@@ -7,7 +7,7 @@ export default async function edit(req, res) {
         }
     }
     let entity = ControllerHelper.findEntityObject(req);
-    let dataAccessor = new DataAccessor(req, entity, "edit");
+    let dataAccessor = new DataAccessor(req.adminizer, req.user, entity, "edit");
     let record = await entity.model.findOne({ id: req.params.id }, dataAccessor);
     return res.redirect(`${req.adminizer.config.routePrefix}/catalog/navigation/${record.label}`);
 }

package/controllers/remove.js

@@ -31,7 +31,7 @@ export default async function remove(req, res) {
     let record;
     let dataAccessor;
     try {
-        dataAccessor = new DataAccessor(req, entity, "remove");
+        dataAccessor = new DataAccessor(req.adminizer, req.user, entity, "remove");
         record = await entity.model.findOne({ id: req.params.id }, dataAccessor);
     }
     catch (e) {

package/controllers/view.js

@@ -25,7 +25,7 @@ export default async function view(req, res) {
             return res.sendStatus(403);
         }
     }
-    let dataAccessor = new DataAccessor(req, entity, "view");
+    let dataAccessor = new DataAccessor(req.adminizer, req.user, entity, "view");
     let fields = dataAccessor.getFieldsConfig();
     let record;
     try {

package/helpers/accessRightsHelper.js

@@ -6,6 +6,7 @@ export class AccessRightsHelper {
         this.adminizer = adminizer;
     }
     registerToken(accessRightsToken) {
+        accessRightsToken.id = accessRightsToken.id.toLowerCase();
         if (!accessRightsToken.id || !accessRightsToken.name || !accessRightsToken.description || !accessRightsToken.department) {
             throw new Error("Adminpanel > Can not register token: Missed one or more required parameters");
         }
@@ -42,6 +43,11 @@ export class AccessRightsHelper {
         return tokens.some((token) => this.hasPermission(token, user));
     }
     hasPermission(tokenId, user) {
+        if (!tokenId) {
+            Adminizer.log.error(`AccessRightsHelper > hasPermission no tokenId: ${tokenId}`);
+            return false;
+        }
+        tokenId = tokenId.toLowerCase();
         if (!this.adminizer.config.auth.enable) {
             return true;
         }

package/helpers/fieldsHelper.js

@@ -42,7 +42,7 @@ export class FieldsHelper {
                     name: modelName, config: req.adminizer.config.models[modelName],
                     model: Model, uri: `${req.adminizer.config.routePrefix}/model/${modelName}`, type: "model"
                 };
-                let dataAccessor = new DataAccessor(req, entity, action);
+                let dataAccessor = new DataAccessor(req.adminizer, req.user, entity, action);
                 list = await Model.find({}, dataAccessor);
             }
             catch (e) {

package/interfaces/adminpanelConfig.d.ts

@@ -249,7 +249,7 @@ export interface ModelConfig {
      *  May be association or association-many to UserAP or GroupAP */
     userAccessRelation?: {
         field: string;
-        via: string;
+        via?: string;
     } | string;
     userAccessRelationCallback?: (userWithGroups: UserWithGroups, record: any) => boolean;
 }
@@ -390,7 +390,7 @@ export interface HrefConfig {
     /**
      * Only for view, controller still uses his own access rights token
      * */
-    accessRightsToken?: string;
+    accessRightsToken?: string | undefined;
     /**
      * For menu items only
      * */

package/lib/v4/DataAccessor.d.ts

@@ -4,6 +4,7 @@
 import { Entity } from "../../interfaces/types";
 import { ActionType } from "../../interfaces/adminpanelConfig";
 import { Fields } from "../../helpers/fieldsHelper";
+import { Adminizer } from "../Adminizer";
 import { UserAP } from "models/UserAP";
 export declare class DataAccessor {
     private readonly adminizer;
@@ -11,7 +12,8 @@ export declare class DataAccessor {
     entity: Entity;
     action: ActionType;
     private fields;
-    constructor(req: ReqType, entity: Entity, action: ActionType);
+    private actionVerb;
+    constructor(adminizer: Adminizer, user: UserAP, entity: Entity, action: ActionType);
     /**
      * Retrieves the fields for the given entity based on action type,
      * taking into account access rights and configuration settings.

package/lib/v4/DataAccessor.js

@@ -6,12 +6,14 @@ export class DataAccessor {
     entity;
     action;
     fields = null;
+    actionVerb;
     // TODO: change req to adminizr + user
-    constructor(req, entity, action) {
-        this.adminizer = req.adminizer;
-        this.user = req.user;
+    constructor(adminizer, user, entity, action) {
+        this.adminizer = adminizer;
+        this.user = user;
         this.entity = entity;
         this.action = action;
+        this.actionVerb = getTokenAction(this.action);
     }
     /**
      * Retrieves the fields for the given entity based on action type,
@@ -29,6 +31,11 @@ export class DataAccessor {
         const actionConfig = ControllerHelper.findActionConfig(this.entity, this.action);
         const fieldsConfig = this.entity.config?.fields || {};
         const modelAttributes = this.entity.model.attributes;
+        const tokenId = `${this.actionVerb}-${this.entity.model.modelname}-${this.entity.type}`;
+        if (!this.adminizer.accessRightsHelper.hasPermission(tokenId, this.user)) {
+            Adminizer.log.debug(`No access rights to ${this.entity.type}: ${this.entity.model.modelname}`);
+            return undefined;
+        }
         const result = {};
         Object.entries(modelAttributes).forEach(([key, modelField]) => {
             // Checks for short type in Waterline: fieldName: 'string'
@@ -67,6 +74,12 @@ export class DataAccessor {
             let populatedModelFieldsConfig = {};
             if (modelField.type === "association" || modelField.type === "association-many") {
                 const modelName = modelField.model || modelField.collection;
+                // Todo: test > hide relation without model token
+                const tokenId = `${this.actionVerb}-${modelName}-${this.entity.type}`;
+                if (!this.adminizer.accessRightsHelper.hasPermission(tokenId, this.user)) {
+                    Adminizer.log.silly(`No access rights to ${this.entity.type}: ${this.entity.model.modelname}`);
+                    return undefined;
+                }
                 if (modelName) {
                     const model = this.adminizer.modelHandler.model.get(modelName);
                     if (model) {
@@ -95,10 +108,9 @@ export class DataAccessor {
             return undefined;
         }
         // Check if user has access to the associated model
-        const actionVerb = getTokenAction(this.action);
-        const tokenId = `${actionVerb}-${modelName}-${this.entity.type}`;
+        const tokenId = `${this.actionVerb}-${modelName}-${this.entity.type}`;
         if (!this.adminizer.accessRightsHelper.hasPermission(tokenId, this.user)) {
-            Adminizer.log.warn(`No access rights to ${this.entity.type}: ${modelName}`);
+            Adminizer.log.debug(`No access rights to ${this.entity.type}: ${modelName}`);
             return undefined;
         }
         const associatedFields = {};

package/lib/v4/I18n.js

@@ -104,7 +104,9 @@ export class I18n {
             return;
         const file = this.locateFile(locale);
         const tmpFile = `${file}.tmp`;
+        const dir = path.dirname(file);
         try {
+            fs.mkdirSync(dir, { recursive: true });
             fs.writeFileSync(tmpFile, JSON.stringify(I18n.locales[locale], null, this.indent), "utf8");
             fs.renameSync(tmpFile, file);
         }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "adminizer",
   "type": "module",
-  "version": "4.1.0-build.14",
+  "version": "4.1.0-build.16",
   "main": "index.js",
   "scripts": {
     "test": "vitest --reporter verbose",