adminizer 4.1.0-commit.3bf605e → 4.1.0-commit.d8a06d3

package/controllers/initUser.js

@@ -29,12 +29,11 @@ export default async function initUser(req, res) {
         }
         try {
             Adminizer.log.debug(`Created admin`);
-            let passwordHashed = generate(login + password);
+            let passwordHashed = generate(login + password + process.env.AP_PASSWORD_SALT);
             password = 'masked';
             // TODO refactor CRUD functions for DataAccessor usage
             await req.adminizer.modelHandler.model.get("UserAP")["_create"]({
                 login: login,
-                password: password,
                 passwordHashed: passwordHashed,
                 fullName: "Administrator",
                 isActive: true,

package/controllers/list.js

@@ -9,10 +9,10 @@ export default async function list(req, res) {
         return res.status(404).send({ error: 'Not Found' });
     }
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`read-${entity.name}-model`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`read-${entity.name}-model`, req.user)) {
             return res.sendStatus(403);
         }
     }
@@ -46,8 +46,8 @@ export default async function list(req, res) {
     const searchMap = new Map();
     for (let i = 0; i < searchColumns.length; i++) {
         const column = searchColumns[i];
-        const value = searchColumnValues[i] || ""; // Если нет значения, ставим пустую строку
-        searchMap.set(column, value); // Если column повторяется, перезаписываем
+        const value = searchColumnValues[i] || "";
+        searchMap.set(column, value);
     }
     const searchPairs = Array.from(searchMap.entries()).map(([column, value]) => ({
         column,

package/controllers/login.js

@@ -1,6 +1,9 @@
 import { POWCaptcha } from "../lib/v4/POWCaptcha";
 import passwordHash from "password-hash";
 import { inertiaLoginHelper } from "../helpers/inertiaAutHelper";
+import { Adminizer } from "../lib/Adminizer";
+import { signUser } from "../lib/v4/helper/jwt";
+import { serialize } from "cookie";
 export default async function login(req, res) {
     const powCaptcha = new POWCaptcha();
     if (req.originalUrl.indexOf("login") >= 0) {
@@ -11,11 +14,6 @@ export default async function login(req, res) {
             let login = req.body.login;
             let password = req.body.password;
             let captchaSolution = req.body.captchaSolution;
-            // Verify CAPTCHA solution
-            const isCaptchaValid = powCaptcha.check(captchaSolution, `login:${req.ip}`);
-            if (!isCaptchaValid) {
-                return inertiaAdminMessage(req, "Invalid CAPTCHA solution", 'captchaSolution');
-            }
             let user;
             try {
                 // TODO refactor CRUD functions for DataAccessor usage
@@ -28,11 +26,17 @@ export default async function login(req, res) {
                 if (!user) {
                     return res.sendStatus(404);
                 }
-                if (req.session.UserAP.isAdministrator) {
-                    req.session.adminPretender = req.session.UserAP;
-                    req.session.UserAP = user;
-                    return res.sendStatus(200);
+                if (req.user.isAdministrator) {
+                    req.session.userPretended = user;
+                    // return res.sendStatus(200);
+                    return req.Inertia.redirect(`${req.adminizer.config.routePrefix}`);
                 }
+                return req.Inertia.redirect(`${req.adminizer.config.routePrefix}/`);
+            }
+            // Verify CAPTCHA solution
+            const isCaptchaValid = powCaptcha.check(captchaSolution, `login:${req.ip}`);
+            if (!isCaptchaValid) {
+                return inertiaAdminMessage(req, "Invalid CAPTCHA solution", 'captchaSolution');
             }
             if (!user) {
                 return inertiaAdminMessage(req, "Wrong username", 'login');
@@ -42,12 +46,18 @@ export default async function login(req, res) {
                     //Here we use the captchaSolution key to output messages unrelated to the form fields.
                     return inertiaAdminMessage(req, "Profile is not confirmed, please contact to administrator", 'captchaSolution');
                 }
-                if (passwordHash.verify(login + password, user.passwordHashed)) {
+                if (passwordHash.verify(login + password + process.env.AP_PASSWORD_SALT, user.passwordHashed)) {
                     if (user.expires && Date.now() > Date.parse(user.expires)) {
                         //Here we use the captchaSolution key to output messages unrelated to the form fields.
                         return inertiaAdminMessage(req, "Profile expired, contact the administrator", 'captchaSolution');
                     }
-                    req.session.UserAP = user;
+                    const token = signUser(user, req.adminizer.jwtSecret);
+                    res.setHeader('Set-Cookie', serialize('adminizer_jwt', token, {
+                        httpOnly: true,
+                        sameSite: 'lax',
+                        path: '/',
+                        maxAge: 60 * 60 * 24 * 7 * 2,
+                    }));
                     return req.Inertia.redirect(`${req.adminizer.config.routePrefix}`);
                 }
                 else {
@@ -69,17 +79,23 @@ export default async function login(req, res) {
         }
     }
     else if (req.originalUrl.indexOf("logout") >= 0) {
-        if (req.session.adminPretender && req.session.adminPretender.id && req.session.UserAP && req.session.UserAP.id) {
-            req.session.UserAP = req.session.adminPretender;
-            req.session.adminPretender = {};
+        if (req.session.userPretended && req.session.userPretended.id && req.user && req.user.id) {
+            delete (req.session.userPretended);
             return req.Inertia.redirect(`${req.adminizer.config.routePrefix}/`);
         }
-        req.session.UserAP = undefined;
+        req.user = undefined;
+        res.setHeader('Set-Cookie', serialize('adminizer_jwt', '', {
+            httpOnly: true,
+            sameSite: 'lax',
+            path: '/',
+            expires: new Date(0),
+        }));
         req.Inertia.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
     }
     return res.status(404);
 }
 async function inertiaAdminMessage(req, message, messageType) {
+    Adminizer.log.warn(message);
     const powCaptcha = new POWCaptcha();
     const captchaTask = await powCaptcha.getJob(`login:${req.ip}`);
     let errors = {};

package/controllers/media-manager/mediaManagerAdapter.js

@@ -123,7 +123,6 @@ export class MediaManagerAdapter {
             }
             try {
                 const item = await this.manager.upload(req.file, filename, origFileName, group);
-                console.log(item);
                 if (item) {
                     return res.send({
                         msg: "success",
@@ -150,7 +149,7 @@ export class MediaManagerAdapter {
             return;
         }
         catch (e) {
-            console.log(e);
+            console.error(e);
         }
     }
 }

package/controllers/media-manager/mediaManagerApi.js

@@ -4,10 +4,10 @@ export async function mediaManagerController(req, res) {
     const method = req.method.toUpperCase();
     let id = req.params.id ? req.params.id : '';
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`catalog-${id}`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`catalog-${id}`, req.user)) {
             return res.sendStatus(403);
         }
     }

package/controllers/navigation/edit.js

@@ -2,7 +2,7 @@ import { ControllerHelper } from "../../helpers/controllerHelper";
 import { DataAccessor } from "../../lib/v4/DataAccessor";
 export default async function edit(req, res) {
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
     }

package/controllers/processInstallFinalize.js

@@ -3,10 +3,10 @@ import { Adminizer } from "../lib/Adminizer";
 let installStepper = InstallStepper.getInstance();
 export default async function processInstallFinalize(req, res) {
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`process-install-step`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`process-install-step`, req.user)) {
             return res.sendStatus(403);
         }
     }

package/controllers/processInstallStep.d.ts

@@ -1 +0,0 @@
-export default function processInstallStep(req: ReqType, res: ResType): Promise<void>;

package/controllers/processInstallStep.js

@@ -1,132 +1,122 @@
-import { InstallStepper } from "../lib/installStepper/installStepper";
-import * as path from "path";
-import { Adminizer } from "../lib/Adminizer";
-export default async function processInstallStep(req, res) {
-    if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
-            res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
-            return;
-        }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`process-install-step`, req.session.UserAP)) {
-            res.sendStatus(403);
-            return;
-        }
-    }
-    if (req.method.toUpperCase() === 'GET') {
-        Adminizer.log.debug("GET REQUEST TO PROCESS INSTALL STEP");
-        let installStepper = InstallStepper.getStepper(req.params.id);
-        if (!installStepper) {
-            res.redirect(`${req.adminizer.config.routePrefix}/`);
-            return;
-        }
-        if (installStepper.hasUnprocessedSteps() || installStepper.hasUnfinalizedSteps()) {
-            let renderData = installStepper.render(req);
-            let renderer = renderData.currentStep.renderer;
-            // run onInit method before showing step to user
-            try {
-                await renderData.currentStep.onInit();
-            }
-            catch (e) {
-                console.log("ERROR IN PROCESS INSTALL STEP", e);
-                res.viewAdmin(`installer/error`, { error: e, stepperId: installStepper.id });
-                return;
-            }
-            res.viewAdmin(`installer/${renderer}`, { ...renderData, stepperId: installStepper.id });
-            return;
-        }
-        else {
-            res.redirect(`${req.adminizer.config.routePrefix}/`);
-            return;
-        }
-    }
-    if (req.method.toUpperCase() === 'POST') {
-        try {
-            Adminizer.log.debug("POST REQUEST TO PROCESS INSTALL STEP", JSON.stringify(req.body, null, 2));
-            let installStepper = InstallStepper.getStepper(req.params.id);
-            const currentStepId = req.body.currentStepId;
-            const filesCounter = req.body.filesCounter;
-            // upload files before processing other fields (filesCounter > 0 means that req contains files)
-            const uploadedFiles = await handleFileUploads(req, currentStepId, filesCounter);
-            if (req.body.action === 'next') {
-                const inputData = JSON.parse(req.body.inputData);
-                if (uploadedFiles.length) {
-                    inputData.uploadedFiles = uploadedFiles;
-                }
-                // trying to process step
-                await installStepper.processStep(currentStepId, inputData);
-            }
-            else if (req.body.action === 'skip') {
-                // trying to skip step
-                await installStepper.skipStep(currentStepId);
-            }
-            else {
-                res.status(400).send("Invalid action parameter");
-                return;
-            }
-            // go back to stepper if there are more unprocessed steps, otherwise go back to /admin
-            if (installStepper.hasUnprocessedSteps()) {
-                res.redirect(`${req.adminizer.config.routePrefix}/install/${installStepper.id}`);
-                return;
-            }
-            else {
-                res.redirect(`${req.adminizer.config.routePrefix}/`);
-                return;
-            }
-        }
-        catch (error) {
-            Adminizer.log.error("Error processing step:", error);
-            res.status(500).send("Error processing step");
-            return;
-        }
-    }
-    if (req.method.toUpperCase() === 'DELETE') {
-        Adminizer.log.debug("DELETE REQUEST TO PROCESS INSTALL STEP", req.body);
-        try {
-            InstallStepper.deleteStepper(req.params.id);
-            res.status(200).send("OK");
-            return;
-        }
-        catch (e) {
-            res.status(403).send(e);
-            return;
-        }
-    }
-    res.status(500).send("Invalid request method");
-    return;
-}
-;
-async function handleFileUploads(req, currentStepId, filesCounter) {
-    const uploadedFiles = [];
-    for (let i = 0; i < filesCounter; i++) {
-        const fieldName = `files_${i}`;
-        const uploadMiddleware = req.upload({
-            destination: "installStepper/uploadedImages",
-            filename: (file) => {
-                const extension = path.extname(file.originalname);
-                const baseName = path.basename(file.originalname, extension);
-                return `${currentStepId}_${baseName}_${Date.now()}${extension}`;
-            },
-        }).single(fieldName);
-        try {
-            await new Promise((resolve, reject) => {
-                uploadMiddleware(req, null, (err) => {
-                    if (err) {
-                        Adminizer.logger.error(`Error uploading file: ${fieldName}`, err);
-                        reject(err);
-                    }
-                    else {
-                        const uploadedFile = req.file?.path;
-                        if (uploadedFile) {
-                            uploadedFiles.push(uploadedFile);
-                        }
-                        resolve();
-                    }
-                });
-            });
-        }
-        catch (err) {
-            Adminizer.logger.error(`Failed to upload file: ${fieldName}`, err);
-        }
-    }
-    return uploadedFiles;
-}
+"use strict";
+// import {InstallStepper} from "../lib/installStepper/installStepper";
+// import * as path from "path";
+// import {Adminizer} from "../lib/Adminizer";
+// export default async function processInstallStep(req: ReqType, res: ResType): Promise<void> {
+// 	if (req.adminizer.config.auth.enable) {
+// 		if (!req.user) {
+// 			res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
+// 			return
+// 		} else if (!req.adminizer.accessRightsHelper.hasPermission(`process-install-step`, req.user)) {
+// 			res.sendStatus(403);
+// 			return
+// 		}
+// 	}
+// 	if (req.method.toUpperCase() === 'GET') {
+// 		Adminizer.log.debug("GET REQUEST TO PROCESS INSTALL STEP")
+// 		let installStepper = InstallStepper.getStepper(req.params.id);
+// 		if (!installStepper) {
+// 			res.redirect(`${req.adminizer.config.routePrefix}/`);
+// 			return
+// 		}
+// 		if (installStepper.hasUnprocessedSteps() || installStepper.hasUnfinalizedSteps()) {
+// 			let renderData = installStepper.render(req);
+// 			let renderer = renderData.currentStep.renderer;
+// 			// run onInit method before showing step to user
+// 			try {
+// 				await renderData.currentStep.onInit();
+// 			} catch (e) {
+// 				console.log("ERROR IN PROCESS INSTALL STEP", e)
+// 				res.viewAdmin(`installer/error`, {error: e, stepperId: installStepper.id});
+// 				return
+// 			}
+// 			res.viewAdmin(`installer/${renderer}`, {...renderData, stepperId: installStepper.id});
+// 			return
+// 		} else {
+// 			res.redirect(`${req.adminizer.config.routePrefix}/`);
+// 			return
+// 		}
+// 	}
+// 	if (req.method.toUpperCase() === 'POST') {
+// 		try {
+// 			Adminizer.log.debug("POST REQUEST TO PROCESS INSTALL STEP", JSON.stringify(req.body, null, 2))
+// 			let installStepper = InstallStepper.getStepper(req.params.id);
+// 			const currentStepId = req.body.currentStepId;
+// 			const filesCounter = req.body.filesCounter;
+// 			// upload files before processing other fields (filesCounter > 0 means that req contains files)
+// 			const uploadedFiles = await handleFileUploads(req, currentStepId, filesCounter);
+// 			if (req.body.action === 'next') {
+// 				const inputData = JSON.parse(req.body.inputData);
+// 				if (uploadedFiles.length) {
+// 					inputData.uploadedFiles = uploadedFiles;
+// 				}
+// 				// trying to process step
+// 				await installStepper.processStep(currentStepId, inputData);
+// 			} else if (req.body.action === 'skip') {
+// 				// trying to skip step
+// 				await installStepper.skipStep(currentStepId);
+// 			} else {
+// 				res.status(400).send("Invalid action parameter");
+// 				return
+// 			}
+// 			// go back to stepper if there are more unprocessed steps, otherwise go back to /admin
+// 			if (installStepper.hasUnprocessedSteps()) {
+// 				res.redirect(`${req.adminizer.config.routePrefix}/install/${installStepper.id}`);
+// 				return
+// 			} else {
+// 				res.redirect(`${req.adminizer.config.routePrefix}/`);
+// 				return
+// 			}
+// 		} catch (error) {
+// 			Adminizer.log.error("Error processing step:", error);
+// 			res.status(500).send("Error processing step");
+// 			return
+// 		}
+// 	}
+// 	if (req.method.toUpperCase() === 'DELETE') {
+// 		Adminizer.log.debug("DELETE REQUEST TO PROCESS INSTALL STEP", req.body)
+// 		try {
+// 			InstallStepper.deleteStepper(req.params.id);
+// 			res.status(200).send("OK")
+// 			return
+// 		} catch (e) {
+// 			res.status(403).send(e);
+// 			return
+// 		}
+// 	}
+// 	res.status(500).send("Invalid request method")
+// 	return
+// };
+// async function handleFileUploads(req: ReqType, currentStepId: string | number, filesCounter: number): Promise<string[]> {
+// 	const uploadedFiles: string[] = [];
+// 	for (let i = 0; i < filesCounter; i++) {
+// 		const fieldName = `files_${i}`;
+// 		const uploadMiddleware = req.upload({
+// 			destination: "installStepper/uploadedImages",
+// 			filename: (file) => {
+// 				const extension = path.extname(file.originalname);
+// 				const baseName = path.basename(file.originalname, extension);
+// 				return `${currentStepId}_${baseName}_${Date.now()}${extension}`;
+// 			},
+// 		}).single(fieldName);
+// 		try {
+// 			await new Promise<void>((resolve, reject) => {
+// 				uploadMiddleware(req, null, (err) => {
+// 					if (err) {
+// 						Adminizer.logger.error(`Error uploading file: ${fieldName}`, err);
+// 						reject(err);
+// 					} else {
+// 						const uploadedFile = (req.file as Express.Multer.File)?.path;
+// 						if (uploadedFile) {
+// 							uploadedFiles.push(uploadedFile);
+// 						}
+// 						resolve();
+// 					}
+// 				});
+// 			});
+// 		} catch (err) {
+// 			Adminizer.logger.error(`Failed to upload file: ${fieldName}`, err);
+// 		}
+// 	}
+// 	return uploadedFiles;
+// }

package/controllers/register.js

@@ -5,7 +5,6 @@ export default async function register(req, res) {
         return res.redirect(`${req.adminizer.config.routePrefix}/`);
     }
     if (req.method.toUpperCase() === "POST") {
-        // console.log("req.body", req.body);
         for (const key of ["login", "fullName", "password"]) {
             if (!req.body[key]) {
                 let errors = {};
@@ -40,12 +39,11 @@ export default async function register(req, res) {
         }
         else {
             try {
-                let passwordHashed = generate(req.body.login + req.body.password);
+                let passwordHashed = generate(req.body.login + req.body.password + process.env.AP_PASSWORD_SALT);
                 let password = 'masked';
                 // TODO refactor CRUD functions for DataAccessor usage
                 let userap = await req.adminizer.modelHandler.model.get("UserAP")["_create"]({
                     login: req.body.login,
-                    password: password,
                     passwordHashed: passwordHashed,
                     fullName: req.body.fullName,
                     email: req.body.email,
@@ -53,7 +51,6 @@ export default async function register(req, res) {
                 });
                 // TODO refactor CRUD functions for DataAccessor usage
                 let defaultUserGroup = await req.adminizer.modelHandler.model.get("GroupAP")["_findOne"]({ name: req.adminizer.config.registration.defaultUserGroup });
-                console.log(userap);
                 // TODO refactor CRUD functions for DataAccessor usage
                 await req.adminizer.modelHandler.model.get("UserAP")["_updateOne"]({ id: userap.id }, {
                     groups: [defaultUserGroup.id]

package/controllers/remove.js

@@ -18,10 +18,10 @@ export default async function remove(req, res) {
         return res.redirect(`${req.adminizer.config.routePrefix}/${entity.uri}`);
     }
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`delete-${entity.name}-model`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`delete-${entity.name}-model`, req.user)) {
             return res.sendStatus(403);
         }
     }

package/controllers/timezones.js

@@ -1,6 +1,6 @@
 export default async function timezones(req, res) {
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
     }

package/controllers/view.js

@@ -18,10 +18,10 @@ export default async function view(req, res) {
         return res.status(404).send({ error: 'Not Found' });
     }
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`read-${entity.name}-model`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`read-${entity.name}-model`, req.user)) {
             return res.sendStatus(403);
         }
     }

package/controllers/welcome.js

@@ -2,7 +2,7 @@
  * Welcome text
  */
 export default function welcome(req, res) {
-    if (req.adminizer.config.auth.enable && !req.session.UserAP) {
+    if (!req.user) {
         return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
     }
     let text = '';

package/controllers/widgets/Action.js

@@ -4,10 +4,10 @@ export async function widgetActionController(req, res) {
         return res.status(404).send({ error: 'Not Found' });
     }
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.user)) {
             return res.sendStatus(403);
         }
     }

package/controllers/widgets/Custom.js

@@ -4,10 +4,10 @@ export async function widgetCustomController(req, res) {
         return res.status(404).send({ error: 'Not Found' });
     }
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.user)) {
             return res.sendStatus(403);
         }
     }

package/controllers/widgets/Info.js

@@ -4,10 +4,10 @@ export async function widgetInfoController(req, res) {
         return res.status(404).send({ error: 'Not Found' });
     }
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.user)) {
             return res.sendStatus(403);
         }
     }

package/controllers/widgets/switch.js

@@ -4,10 +4,10 @@ export async function widgetSwitchController(req, res) {
         return res.status(404).send({ error: 'Not Found' });
     }
     if (req.adminizer.config.auth.enable) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.user)) {
             return res.sendStatus(403);
         }
     }

package/controllers/widgetsDB.js

@@ -2,17 +2,17 @@ export default async function widgetsDB(req, res) {
     let id = 0;
     let auth = req.adminizer.config.auth.enable;
     if (auth) {
-        if (!req.session.UserAP) {
+        if (!req.user) {
             return res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
         }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widgets`, req.session.UserAP)) {
+        else if (!req.adminizer.accessRightsHelper.hasPermission(`widgets`, req.user)) {
             return res.sendStatus(403);
         }
-        id = req.session.UserAP.id;
+        id = req.user.id;
     }
     if (req.method.toUpperCase() === 'GET') {
         try {
-            let widgets = await req.adminizer.widgetHandler.getWidgetsDB(id, auth);
+            let widgets = await req.adminizer.widgetHandler.getWidgetsDB(id, auth, req.i18n);
             return res.json({ widgetsDB: widgets });
         }
         catch (e) {
@@ -25,7 +25,7 @@ export default async function widgetsDB(req, res) {
         }
         try {
             return res.json({
-                userID: await req.adminizer.widgetHandler.setWidgetsDB(id, req.body.widgets, auth),
+                userID: await req.adminizer.widgetHandler.setWidgetsDB(id, req.body, auth),
                 status: 'ok'
             });
         }

package/helpers/accessRightsHelper.d.ts

@@ -1,3 +1,4 @@
+import { UserAP } from "models/UserAP";
 import { AccessRightsToken } from "../interfaces/types";
 import { Adminizer } from "../lib/Adminizer";
 export declare class AccessRightsHelper {
@@ -9,6 +10,6 @@ export declare class AccessRightsHelper {
     getTokens(): AccessRightsToken[];
     getTokensByDepartment(department: string): AccessRightsToken[];
     getAllDepartments(): string[];
-    enoughPermissions(tokens: string[], user: ModelsAP["UserAP"]): boolean;
-    hasPermission(tokenId: string, user: ModelsAP["UserAP"]): boolean;
+    enoughPermissions(tokens: string[], user: UserAP): boolean;
+    hasPermission(tokenId: string, user: UserAP): boolean;
 }