adminizer 4.1.0-build.2 → 4.1.0-build.21

package/controllers/getAllWidgets.js

@@ -1,15 +1,15 @@
 export default async function getAllWidgets(req, res) {
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widgets`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`widgets`, req.user)) {
             return res.sendStatus(403);
         }
     }
     if (req.method.toUpperCase() === 'GET') {
         try {
-            return res.json({ widgets: await req.adminizer.widgetHandler.getAll(req.session.UserAP) });
+            return res.json({ widgets: await req.adminizer.widgetHandler.getAll(req.user, req.i18n) });
         }
         catch (e) {
             return res.status(500).send({ error: e.message || 'Internal Server Error' });

package/controllers/initUser.js

@@ -29,12 +29,11 @@ export default async function initUser(req, res) {
         }
         try {
             Adminizer.log.debug(`Created admin`);
-            let passwordHashed = generate(login + password);
+            let passwordHashed = generate(login + password + process.env.AP_PASSWORD_SALT);
             password = 'masked';
             // TODO refactor CRUD functions for DataAccessor usage
             await req.adminizer.modelHandler.model.get("UserAP")["_create"]({
                 login: login,
-                password: password,
                 passwordHashed: passwordHashed,
                 fullName: "Administrator",
                 isActive: true,

package/controllers/list.js

@@ -9,14 +9,14 @@ export default async function list(req, res) {
         return res.status(404).send({ error: 'Not Found' });
     }
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`read-${entity.name}-model`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`read-${entity.name}-model`, req.user)) {
             return res.sendStatus(403);
         }
     }
-    let dataAccessor = new DataAccessor(req, entity, "list");
+    let dataAccessor = new DataAccessor(req.adminizer, req.user, entity, "list");
     let fields = dataAccessor.getFieldsConfig();
     const header = inertiaListHelper(entity, req, fields);
     let start = "0";
@@ -46,8 +46,8 @@ export default async function list(req, res) {
     const searchMap = new Map();
     for (let i = 0; i < searchColumns.length; i++) {
         const column = searchColumns[i];
-        const value = searchColumnValues[i] || ""; // Если нет значения, ставим пустую строку
-        searchMap.set(column, value); // Если column повторяется, перезаписываем
+        const value = searchColumnValues[i] || "";
+        searchMap.set(column, value);
     }
     const searchPairs = Array.from(searchMap.entries()).map(([column, value]) => ({
         column,

package/controllers/login.js

@@ -1,6 +1,9 @@
 import { POWCaptcha } from "../lib/v4/POWCaptcha";
 import passwordHash from "password-hash";
 import { inertiaLoginHelper } from "../helpers/inertiaAutHelper";
+import { Adminizer } from "../lib/Adminizer";
+import { signUser } from "../lib/v4/helper/jwt";
+import { serialize } from "cookie";
 export default async function login(req, res) {
     const powCaptcha = new POWCaptcha();
     if (req.originalUrl.indexOf("login") >= 0) {
@@ -11,11 +14,6 @@ export default async function login(req, res) {
             let login = req.body.login;
             let password = req.body.password;
             let captchaSolution = req.body.captchaSolution;
-            // Verify CAPTCHA solution
-            const isCaptchaValid = powCaptcha.check(captchaSolution, `login:${req.ip}`);
-            if (!isCaptchaValid) {
-                return inertiaAdminMessage(req, "Invalid CAPTCHA solution", 'captchaSolution');
-            }
             let user;
             try {
                 // TODO refactor CRUD functions for DataAccessor usage
@@ -28,11 +26,17 @@ export default async function login(req, res) {
                 if (!user) {
                     return res.sendStatus(404);
                 }
-                if (req.session.UserAP.isAdministrator) {
-                    req.session.adminPretender = req.session.UserAP;
-                    req.session.UserAP = user;
-                    return res.sendStatus(200);
+                if (req.user.isAdministrator) {
+                    req.session.userPretended = user;
+                    // return res.sendStatus(200);
+                    return req.Inertia.redirect(`${req.adminizer.config.routePrefix}`);
                 }
+                return req.Inertia.redirect(`${req.adminizer.config.routePrefix}/`);
+            }
+            // Verify CAPTCHA solution
+            const isCaptchaValid = powCaptcha.check(captchaSolution, `login:${req.ip}`);
+            if (!isCaptchaValid) {
+                return inertiaAdminMessage(req, "Invalid CAPTCHA solution", 'captchaSolution');
             }
             if (!user) {
                 return inertiaAdminMessage(req, "Wrong username", 'login');
@@ -42,12 +46,18 @@ export default async function login(req, res) {
                     //Here we use the captchaSolution key to output messages unrelated to the form fields.
                     return inertiaAdminMessage(req, "Profile is not confirmed, please contact to administrator", 'captchaSolution');
                 }
-                if (passwordHash.verify(login + password, user.passwordHashed)) {
+                if (passwordHash.verify(login + password + process.env.AP_PASSWORD_SALT, user.passwordHashed)) {
                     if (user.expires && Date.now() > Date.parse(user.expires)) {
                         //Here we use the captchaSolution key to output messages unrelated to the form fields.
                         return inertiaAdminMessage(req, "Profile expired, contact the administrator", 'captchaSolution');
                     }
-                    req.session.UserAP = user;
+                    const token = signUser(user, req.adminizer.jwtSecret);
+                    res.setHeader('Set-Cookie', serialize('adminizer_jwt', token, {
+                        httpOnly: true,
+                        sameSite: 'lax',
+                        path: '/',
+                        maxAge: 60 * 60 * 24 * 7 * 2,
+                    }));
                     return req.Inertia.redirect(`${req.adminizer.config.routePrefix}`);
                 }
                 else {
@@ -69,17 +79,23 @@ export default async function login(req, res) {
         }
     }
     else if (req.originalUrl.indexOf("logout") >= 0) {
-        if (req.session.adminPretender && req.session.adminPretender.id && req.session.UserAP && req.session.UserAP.id) {
-            req.session.UserAP = req.session.adminPretender;
-            req.session.adminPretender = {};
+        if (req.session.userPretended && req.session.userPretended.id && req.user && req.user.id) {
+            delete (req.session.userPretended);
             return req.Inertia.redirect(`${req.adminizer.config.routePrefix}/`);
         }
-        req.session.UserAP = undefined;
+        req.user = undefined;
+        res.setHeader('Set-Cookie', serialize('adminizer_jwt', '', {
+            httpOnly: true,
+            sameSite: 'lax',
+            path: '/',
+            expires: new Date(0),
+        }));
         req.Inertia.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
     }
     return res.status(404);
 }
 async function inertiaAdminMessage(req, message, messageType) {
+    Adminizer.log.warn(message);
     const powCaptcha = new POWCaptcha();
     const captchaTask = await powCaptcha.getJob(`login:${req.ip}`);
     let errors = {};

package/controllers/media-manager/mediaManagerAdapter.js

@@ -123,7 +123,6 @@ export class MediaManagerAdapter {
             }
             try {
                 const item = await this.manager.upload(req.file, filename, origFileName, group);
-                console.log(item);
                 if (item) {
                     return res.send({
                         msg: "success",
@@ -150,7 +149,7 @@ export class MediaManagerAdapter {
             return;
         }
         catch (e) {
-            console.log(e);
+            console.error(e);
         }
     }
 }

package/controllers/media-manager/mediaManagerApi.js

@@ -4,10 +4,10 @@ export async function mediaManagerController(req, res) {
     const method = req.method.toUpperCase();
     let id = req.params.id ? req.params.id : '';
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`catalog-${id}`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`catalog-${id}`, req.user)) {
             return res.sendStatus(403);
         }
     }

package/controllers/navigation/edit.js

@@ -2,12 +2,12 @@ import { ControllerHelper } from "../../helpers/controllerHelper";
 import { DataAccessor } from "../../lib/v4/DataAccessor";
 export default async function edit(req, res) {
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
     }
     let entity = ControllerHelper.findEntityObject(req);
-    let dataAccessor = new DataAccessor(req, entity, "edit");
+    let dataAccessor = new DataAccessor(req.adminizer, req.user, entity, "edit");
     let record = await entity.model.findOne({ id: req.params.id }, dataAccessor);
     return res.redirect(`${req.adminizer.config.routePrefix}/catalog/navigation/${record.label}`);
 }

package/controllers/register.js

@@ -5,7 +5,6 @@ export default async function register(req, res) {
         return res.redirect(`${req.adminizer.config.routePrefix}/`);
     }
     if (req.method.toUpperCase() === "POST") {
-        // console.log("req.body", req.body);
         for (const key of ["login", "fullName", "password"]) {
             if (!req.body[key]) {
                 let errors = {};
@@ -40,12 +39,11 @@ export default async function register(req, res) {
         }
         else {
             try {
-                let passwordHashed = generate(req.body.login + req.body.password);
+                let passwordHashed = generate(req.body.login + req.body.password + process.env.AP_PASSWORD_SALT);
                 let password = 'masked';
                 // TODO refactor CRUD functions for DataAccessor usage
                 let userap = await req.adminizer.modelHandler.model.get("UserAP")["_create"]({
                     login: req.body.login,
-                    password: password,
                     passwordHashed: passwordHashed,
                     fullName: req.body.fullName,
                     email: req.body.email,
@@ -53,7 +51,6 @@ export default async function register(req, res) {
                 });
                 // TODO refactor CRUD functions for DataAccessor usage
                 let defaultUserGroup = await req.adminizer.modelHandler.model.get("GroupAP")["_findOne"]({ name: req.adminizer.config.registration.defaultUserGroup });
-                console.log(userap);
                 // TODO refactor CRUD functions for DataAccessor usage
                 await req.adminizer.modelHandler.model.get("UserAP")["_updateOne"]({ id: userap.id }, {
                     groups: [defaultUserGroup.id]

package/controllers/remove.js

@@ -18,10 +18,10 @@ export default async function remove(req, res) {
         return res.redirect(`${req.adminizer.config.routePrefix}/${entity.uri}`);
     }
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`delete-${entity.name}-model`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`delete-${entity.name}-model`, req.user)) {
             return res.sendStatus(403);
         }
     }
@@ -31,7 +31,7 @@ export default async function remove(req, res) {
     let record;
     let dataAccessor;
     try {
-        dataAccessor = new DataAccessor(req, entity, "remove");
+        dataAccessor = new DataAccessor(req.adminizer, req.user, entity, "remove");
         record = await entity.model.findOne({ id: req.params.id }, dataAccessor);
     }
     catch (e) {

package/controllers/timezones.js

@@ -1,6 +1,6 @@
 export default async function timezones(req, res) {
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
     }

package/controllers/view.js

@@ -18,14 +18,14 @@ export default async function view(req, res) {
         return res.status(404).send({ error: 'Not Found' });
     }
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`read-${entity.name}-model`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`read-${entity.name}-model`, req.user)) {
             return res.sendStatus(403);
         }
     }
-    let dataAccessor = new DataAccessor(req, entity, "view");
+    let dataAccessor = new DataAccessor(req.adminizer, req.user, entity, "view");
     let fields = dataAccessor.getFieldsConfig();
     let record;
     try {

package/controllers/welcome.js

@@ -2,7 +2,7 @@
  * Welcome text
  */
 export default function welcome(req, res) {
-    if (req.adminizer.config.auth.enable && !req.session.UserAP) {
+    if (!req.user) {
         return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
     }
     let text = '';

package/controllers/widgets/Action.js

@@ -4,10 +4,10 @@ export async function widgetActionController(req, res) {
         return res.status(404).send({ error: 'Not Found' });
     }
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.user)) {
             return res.sendStatus(403);
         }
     }

package/controllers/widgets/Custom.js

@@ -4,10 +4,10 @@ export async function widgetCustomController(req, res) {
         return res.status(404).send({ error: 'Not Found' });
     }
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.user)) {
             return res.sendStatus(403);
         }
     }

package/controllers/widgets/Info.js

@@ -4,10 +4,10 @@ export async function widgetInfoController(req, res) {
         return res.status(404).send({ error: 'Not Found' });
     }
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.user)) {
             return res.sendStatus(403);
         }
     }

package/controllers/widgets/switch.js

@@ -4,10 +4,10 @@ export async function widgetSwitchController(req, res) {
         return res.status(404).send({ error: 'Not Found' });
     }
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.user)) {
             return res.sendStatus(403);
         }
     }

package/controllers/widgetsDB.js

@@ -2,17 +2,17 @@ export default async function widgetsDB(req, res) {
     let id = 0;
     let auth = req.adminizer.config.auth.enable;
     if (auth) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widgets`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`widgets`, req.user)) {
             return res.sendStatus(403);
         }
-        id = req.session.UserAP.id;
+        id = req.user.id;
     }
     if (req.method.toUpperCase() === 'GET') {
         try {
-            let widgets = await req.adminizer.widgetHandler.getWidgetsDB(id, auth);
+            let widgets = await req.adminizer.widgetHandler.getWidgetsDB(id, auth, req.i18n);
             return res.json({ widgetsDB: widgets });
         }
         catch (e) {
@@ -25,7 +25,7 @@ export default async function widgetsDB(req, res) {
         }
         try {
             return res.json({
-                userID: await req.adminizer.widgetHandler.setWidgetsDB(id, req.body.widgets, auth),
+                userID: await req.adminizer.widgetHandler.setWidgetsDB(id, req.body, auth),
                 status: 'ok'
             });
         }

package/helpers/accessRightsHelper.d.ts

@@ -1,3 +1,4 @@
+import { UserAP } from "models/UserAP";
 import { AccessRightsToken } from "../interfaces/types";
 import { Adminizer } from "../lib/Adminizer";
 export declare class AccessRightsHelper {
@@ -9,6 +10,9 @@ export declare class AccessRightsHelper {
     getTokens(): AccessRightsToken[];
     getTokensByDepartment(department: string): AccessRightsToken[];
     getAllDepartments(): string[];
-    enoughPermissions(tokens: string[], user: ModelsAP["UserAP"]): boolean;
-    hasPermission(tokenId: string, user: ModelsAP["UserAP"]): boolean;
+    enoughPermissions(tokens: string[], user: UserAP): boolean;
+    hasPermission(tokenId: string, user: UserAP): boolean;
+}
+export declare class GroupsAccessRightsHelper {
+    static hasAccess(user: UserAP, groupsAccessRights?: string[]): boolean;
 }

package/helpers/accessRightsHelper.js

@@ -6,12 +6,13 @@ export class AccessRightsHelper {
         this.adminizer = adminizer;
     }
     registerToken(accessRightsToken) {
+        accessRightsToken.id = accessRightsToken.id.toLowerCase();
         if (!accessRightsToken.id || !accessRightsToken.name || !accessRightsToken.description || !accessRightsToken.department) {
             throw new Error("Adminpanel > Can not register token: Missed one or more required parameters");
         }
         for (let token of this._tokens) {
             if (token.id === accessRightsToken.id) {
-                throw new Error("Adminpanel > Can not register token: Token with this id already registered");
+                throw new Error(`Adminpanel > Can not register token: Token with this id ["${token.id}"] already registered`);
             }
         }
         this._tokens.push(accessRightsToken);
@@ -42,6 +43,11 @@ export class AccessRightsHelper {
         return tokens.some((token) => this.hasPermission(token, user));
     }
     hasPermission(tokenId, user) {
+        if (!tokenId) {
+            Adminizer.log.error(`AccessRightsHelper > hasPermission no tokenId: ${tokenId}`);
+            return false;
+        }
+        tokenId = tokenId.toLowerCase();
         if (!this.adminizer.config.auth.enable) {
             return true;
         }
@@ -50,9 +56,21 @@ export class AccessRightsHelper {
         }
         const tokenIsValid = this._tokens.some((token) => token.id === tokenId);
         if (!tokenIsValid) {
-            Adminizer.log.error("Adminpanel > Token is not valid");
+            Adminizer.log.error("Adminpanel > Token is not valid", tokenId, user.login);
             return false;
         }
-        return user.groups.some((group) => group.tokens.includes(tokenId));
+        return user.groups.some((group) => group.tokens?.includes(tokenId));
+    }
+}
+export class GroupsAccessRightsHelper {
+    static hasAccess(user, groupsAccessRights) {
+        const userGroups = user.groups?.map(group => group.name.toLowerCase());
+        if (groupsAccessRights) {
+            const allowedGroups = groupsAccessRights.map(item => item.toLowerCase());
+            return userGroups?.some(group => allowedGroups.includes(group)) ?? false;
+        }
+        else {
+            return true;
+        }
     }
 }

package/helpers/configHelper.js

@@ -77,7 +77,7 @@ export class ConfigHelper {
         }
         // Boolean notation: `true` means field is visible; `false` means field is hidden.
         if (typeof config === "boolean") {
-            return config ? { title: key } : false;
+            return config ? { title: key } : { visible: false };
         }
         // String notation: Interpreted as the field title.
         if (typeof config === "string") {
@@ -86,6 +86,7 @@ export class ConfigHelper {
         // Object notation: Allows full customization of the field.
         if (typeof config === "object" && config !== null) {
             config.title = config.title || key;
+            config.visible = config.visible === undefined ? true : Boolean(config.visible);
             // For association types, determine display field by checking model attributes.
             if (["association", "association-many"].includes(config.type)) {
                 let associatedModelAttributes = {};

package/helpers/controllerHelper.js

@@ -84,7 +84,7 @@ export class ControllerHelper {
         const entityType = req.params.entityType;
         if (!entityType) {
             const extractedEntityType = req.originalUrl.split('/')[2];
-            if (["form", "model", "wizard"].includes(extractedEntityType)) {
+            if (["form", "model"].includes(extractedEntityType)) {
                 return extractedEntityType;
             }
             else {

package/helpers/fieldsHelper.d.ts

@@ -10,7 +10,7 @@ export type Field = {
         type?: FieldsTypes;
         groupsAccessRights?: string[];
     } | string | boolean;
-    /** for populated fields' configs */
+    /** For render associalitons fields */
     populated: {
         [key: string]: Field;
     } | undefined;

package/helpers/fieldsHelper.js

@@ -42,7 +42,7 @@ export class FieldsHelper {
                     name: modelName, config: req.adminizer.config.models[modelName],
                     model: Model, uri: `${req.adminizer.config.routePrefix}/model/${modelName}`, type: "model"
                 };
-                let dataAccessor = new DataAccessor(req, entity, action);
+                let dataAccessor = new DataAccessor(req.adminizer, req.user, entity, action);
                 list = await Model.find({}, dataAccessor);
             }
             catch (e) {

package/helpers/inertiaActionsHelper.js

@@ -4,7 +4,7 @@ export default function inertiaActionsHelper(actionType, entity, req) {
         const actions = req.adminizer.menuHelper.getGlobalActions(entity.config, actionType);
         if (actions && actions.length > 0) {
             actions.forEach(function (action) {
-                if (req.adminizer.accessRightsHelper.hasPermission(action.accessRightsToken, req.session.UserAP)) {
+                if (req.adminizer.accessRightsHelper.hasPermission(action.accessRightsToken, req.user)) {
                     resActions.push({
                         link: action.link,
                         id: action.id,

package/helpers/inertiaAddHelper.d.ts

@@ -436,7 +436,7 @@ export declare function getControlsOptions(fieldConfig: BaseFieldConfig, req: Re
     };
     path: {};
 };
-export declare function inputText(type: string, isIn: string[]): "email" | "password" | "number" | "date" | "time" | "color" | "month" | "week" | "range" | "text" | "select" | "datetime-local";
+export declare function inputText(type: string, isIn: string[]): "email" | "password" | "date" | "time" | "number" | "color" | "month" | "week" | "range" | "text" | "select" | "datetime-local";
 export declare function getControl(req: ReqType, type: ControlType, name: string | undefined, defaultControlName: string): AbstractControls;
 export declare function setSelectMany(isIn: string[], value: string[] | undefined): {
     initOptions: {

package/helpers/inertiaAddHelper.js

@@ -25,6 +25,8 @@ export default function inertiaAddHelper(req, entity, fields, record, view = fal
             continue;
         let field = fields[key];
         let fieldConfig = field.config;
+        if (!!fieldConfig.visible === false)
+            continue;
         const type = (fieldConfig.type || fieldConfig.type).toLowerCase();
         //@ts-ignore TODO: fix model validations
         const isIn = typeof fieldConfig.isIn === 'object' ? fieldConfig.isIn : (field.model && typeof { ...field.model.validations }.isIn === 'object' ? { ...field.model.validations }.isIn : []);

package/helpers/inertiaFromHelper.js

@@ -9,6 +9,8 @@ export default function inertiaFormHelper(req, postLink, formData) {
     };
     for (const key of Object.keys(formData)) {
         let field = formData[key];
+        if (field.visible === false)
+            continue;
         const type = (field.type || field.type).toLowerCase();
         const isIn = field.isIn ?? [];
         let label = field.title ?? '';

package/helpers/inertiaGroupHelper.d.ts

@@ -1,3 +1,5 @@
+import { GroupAP } from "models/GroupAP";
+import { UserAP } from "models/UserAP";
 import { AccessRightsToken, Entity, PropsField } from "../interfaces/types";
 interface groupedTokens {
     header: string;
@@ -20,7 +22,7 @@ interface listProps extends Record<string | number | symbol, unknown> {
     users: PropsField[];
     groupedTokens: groupedTokens[];
 }
-export declare function inertiaGroupHelper(entity: Entity, req: ReqType, users: ModelsAP["UserAP"][], groupedTokens: {
+export declare function inertiaGroupHelper(entity: Entity, req: ReqType, users: UserAP[], groupedTokens: {
     [key: string]: AccessRightsToken[];
-}, group?: ModelsAP["GroupAP"], view?: boolean): listProps;
+}, group?: GroupAP, view?: boolean): listProps;
 export {};

package/helpers/inertiaGroupHelper.js

@@ -55,7 +55,7 @@ export function inertiaGroupHelper(entity, req, users, groupedTokens, group, vie
                     label: token.name,
                     tooltip: token.description,
                     name: `token-checkbox-${token.id}`,
-                    value: group ? (group.tokens && group.tokens.includes(token.id)) : false,
+                    value: group ? (group.tokens && group.tokens?.includes(token.id)) : false,
                     type: 'checkbox'
                 });
             }

package/helpers/inertiaListHelper.js

@@ -24,22 +24,22 @@ export function inertiaListHelper(entity, req, fields) {
         searchBtn: req.i18n.__('Search'),
         resetBtn: req.i18n.__('Reset'),
     };
-    if (entity.config.add && req.adminizer.accessRightsHelper.hasPermission(`create-${entity.name}-model`, req.session.UserAP)) {
+    if (entity.config.add && req.adminizer.accessRightsHelper.hasPermission(`create-${entity.name}-model`, req.user)) {
         props.crudActions.createTitle = req.i18n.__('create');
     }
-    if (req.adminizer.accessRightsHelper.hasPermission(`update-${entity.name}-model`, req.session.UserAP)) {
+    if (req.adminizer.accessRightsHelper.hasPermission(`update-${entity.name}-model`, req.user)) {
         props.crudActions.editTitle = req.i18n.__('Edit');
     }
-    if (req.adminizer.accessRightsHelper.hasPermission(`read-${entity.name}-model`, req.session.UserAP)) {
+    if (req.adminizer.accessRightsHelper.hasPermission(`read-${entity.name}-model`, req.user)) {
         props.crudActions.viewsTitle = req.i18n.__('View');
     }
-    if (req.adminizer.accessRightsHelper.hasPermission(`delete-${entity.name}-model`, req.session.UserAP)) {
+    if (req.adminizer.accessRightsHelper.hasPermission(`delete-${entity.name}-model`, req.user)) {
         props.crudActions.deleteTitle = req.i18n.__('Delete');
     }
     props.actions = inertiaActionsHelper(actionType, entity, req);
     if (req.adminizer.menuHelper.hasInlineActions(entity.config, 'list')) {
         for (const inlineAction of req.adminizer.menuHelper.getInlineActions(entity.config, 'list')) {
-            if (req.adminizer.accessRightsHelper.hasPermission(inlineAction.accessRightsToken, req.session.UserAP)) {
+            if (req.adminizer.accessRightsHelper.hasPermission(inlineAction.accessRightsToken, req.user)) {
                 props.inlineActions.push({
                     icon: inlineAction.icon,
                     id: inlineAction.id,

package/helpers/inertiaMenuHelper.js

@@ -5,7 +5,7 @@ export class InertiaMenuHelper {
     }
     getMenuItems(req) {
         let menu = [];
-        for (const menuItem of this.adminizer.menuHelper.getMenuItems()) {
+        for (const menuItem of this.adminizer.menuHelper.getMenuItems(req.user)) {
             const menuItemTokens = menuItem.actions ? menuItem.actions.map(item => {
                 return item.accessRightsToken;
             }).filter(item => {
@@ -13,7 +13,7 @@ export class InertiaMenuHelper {
             }) : [];
             if (menuItem.accessRightsToken)
                 menuItemTokens.push(menuItem.accessRightsToken);
-            if (this.adminizer.accessRightsHelper.enoughPermissions(menuItemTokens, req.session.UserAP)) {
+            if (this.adminizer.accessRightsHelper.enoughPermissions(menuItemTokens, req.user)) {
                 menu.push(menuItem);
             }
         }

package/helpers/inertiaUserHelper.d.ts

@@ -1,3 +1,5 @@
+import { GroupAP } from "models/GroupAP";
+import { UserAP } from "models/UserAP";
 import { Entity, PropsField } from "../interfaces/types";
 interface listProps extends Record<string | number | symbol, unknown> {
     edit: boolean;
@@ -16,6 +18,10 @@ interface listProps extends Record<string | number | symbol, unknown> {
     fields: PropsField[];
     groups: PropsField[];
     locales: Record<string, string>[];
+    userPretend: {
+        label: string;
+        postLink: string;
+    };
 }
-export declare function inertiaUserHelper(entity: Entity, req: ReqType, groups: ModelsAP["GroupAP"][], user?: ModelsAP["UserAP"], view?: boolean): listProps;
+export declare function inertiaUserHelper(entity: Entity, req: ReqType, groups: GroupAP[], user?: UserAP, view?: boolean): listProps;
 export {};