adminizer 4.6.0-build.203 → 4.6.0-build.205

package/helpers/accessRightsHelper.d.ts

@@ -7,6 +7,7 @@ export declare class AccessRightsHelper {
     constructor(adminizer: Adminizer);
     registerToken(accessRightsToken: AccessRightsToken): void;
     registerTokens(accessRightsTokens: AccessRightsToken[]): void;
+    registerModelTokens(modelName: string, department?: string): void;
     getTokens(): AccessRightsToken[];
     getTokensByDepartment(department: string): AccessRightsToken[];
     getAllDepartments(): string[];

package/helpers/accessRightsHelper.js

@@ -23,6 +23,13 @@ export class AccessRightsHelper {
             this.registerToken(token);
         }
     }
+    registerModelTokens(modelName, department) {
+        department = department ?? `Model ${modelName}`;
+        this.registerToken({ id: `create-${modelName}-model`, name: "Create", description: "Access to creating record in database", department });
+        this.registerToken({ id: `read-${modelName}-model`, name: "Read", description: "Access to reading records in database", department });
+        this.registerToken({ id: `update-${modelName}-model`, name: "Update", description: "Access to updating records in database", department });
+        this.registerToken({ id: `delete-${modelName}-model`, name: "Delete", description: "Access to deleting records in database", department });
+    }
     getTokens() {
         return this._tokens;
     }

package/interfaces/adminpanelConfig.d.ts

@@ -54,9 +54,7 @@ export interface AdminpanelConfig {
         };
     };
     /**
-     * @alpha
      * Models configuration
-     * reference upload contoroller ~50 line
      * */
     models: {
         [key: string]: ModelConfig;

package/lib/DataAccessor.js

@@ -351,20 +351,11 @@ export class DataAccessor {
                     throw new Error(`Unsupported or invalid via field "${via}" in intermediate model "${intermediateRelation.model}". ` +
                         `Currently, only relations to "userap" are supported`);
                 }
-                // Fetch the intermediate record associated with the user
-                // TODO refactor CRUD functions for DataAccessor usage
-                const intermediateRecord = await intermediateModel["_findOne"]({ [via]: this.user.id });
-                if (!intermediateRecord) {
-                    throw new Error(`No intermediate record found in model "${intermediateRelation.model}" associated with user ID "${this.user.id}"`);
-                }
-                // Ensure there is only one associated intermediate record
-                const intermediateRecordCount = await intermediateModel.count({ [via]: this.user.id }, this);
-                if (intermediateRecordCount > 1) {
-                    throw new Error(`Multiple intermediate records found in model "${intermediateRelation.model}" associated with user ID "${this.user.id}". ` +
-                        `Expected only one`);
-                }
-                // Add the intermediate record ID to the criteria
-                sanitizedCriteria = { ...sanitizedCriteria, [field]: intermediateRecord.id };
+                // Fetch all intermediate records associated with the user
+                const intermediateRecords = await intermediateModel["_find"]({ [via]: this.user.id });
+                const intermediateIds = (intermediateRecords || []).map((r) => r.id);
+                // Filter main model by all matching intermediate record IDs
+                sanitizedCriteria = { ...sanitizedCriteria, [field]: { in: intermediateIds } };
             }
         }
         // TODO fix types when deleting waterline (temporary decision here)
@@ -412,42 +403,36 @@ export class DataAccessor {
             else if (typeof userAccessRelation === 'object' && userAccessRelation !== null) {
                 // If userAccessRelation is an object
                 const { field, via } = userAccessRelation;
-                // only admin can set user access relation manually
+                // For non-admins: validate that the chosen intermediate record belongs to the user
                 if (updatedRecord[field] && !this.user.isAdministrator) {
-                    delete updatedRecord[field];
-                }
-                // Get attributes of the current model and validate the intermediate relation
-                const modelAttributes = this.entity.model.attributes;
-                const intermediateRelation = modelAttributes[field];
-                if (!intermediateRelation || !intermediateRelation.model) {
-                    throw new Error(`Invalid intermediate relation configuration for field "${field}" in model ${this.entity.model.modelname}`);
-                }
-                // Retrieve the intermediate model
-                const intermediateModel = this.adminizer.modelHandler.model.get(intermediateRelation.model.toLowerCase());
-                if (!intermediateModel) {
-                    throw new Error(`Intermediate model "${intermediateRelation.model}" not found`);
-                }
-                // Validate the `via` field in the intermediate model
-                const intermediateAttributes = intermediateModel.attributes;
-                const viaRelation = intermediateAttributes[via];
-                if (!viaRelation || viaRelation.model.toLowerCase() !== 'userap') {
-                    throw new Error(`Unsupported or invalid via field "${via}" in intermediate model "${intermediateRelation.model}". ` +
-                        `Currently, only relations to "userap" are supported`);
-                }
-                // Find an existing intermediate record linking the user to the main record
-                // TODO refactor CRUD functions for DataAccessor usage
-                const intermediateRecord = await intermediateModel["_findOne"]({ [via]: this.user.id });
-                if (!intermediateRecord) {
-                    throw new Error(`No intermediate record found in model "${intermediateRelation.model}" linking user "${this.user.id}" to the main record`);
-                }
-                // Ensure there is only one associated intermediate record
-                const intermediateRecordCount = await intermediateModel.count({ [via]: this.user.id }, this);
-                if (intermediateRecordCount > 1) {
-                    throw new Error(`Multiple intermediate records found in model "${intermediateRelation.model}" associated with user ID "${this.user.id}". ` +
-                        `Expected only one`);
+                    if (!via) {
+                        throw new Error(`Invalid userAccessRelation configuration: "via" is required`);
+                    }
+                    const modelAttributes = this.entity.model.attributes;
+                    const intermediateRelation = modelAttributes[field];
+                    if (!intermediateRelation || !intermediateRelation.model) {
+                        throw new Error(`Invalid intermediate relation configuration for field "${field}" in model ${this.entity.model.modelname}`);
+                    }
+                    const intermediateModel = this.adminizer.modelHandler.model.get(intermediateRelation.model.toLowerCase());
+                    if (!intermediateModel) {
+                        throw new Error(`Intermediate model "${intermediateRelation.model}" not found`);
+                    }
+                    // Validate the `via` field in the intermediate model
+                    const intermediateAttributes = intermediateModel.attributes;
+                    const viaRelation = intermediateAttributes[via];
+                    if (!viaRelation || !viaRelation.model || viaRelation.model.toLowerCase() !== 'userap') {
+                        throw new Error(`Unsupported or invalid via field "${via}" in intermediate model "${intermediateRelation.model}". ` +
+                            `Currently, only relations to "userap" are supported`);
+                    }
+                    const intermediatePk = (intermediateModel.primaryKey ?? 'id');
+                    const chosenId = typeof updatedRecord[field] === 'object'
+                        ? updatedRecord[field][intermediatePk]
+                        : updatedRecord[field];
+                    const record = await intermediateModel["_findOne"]({ [intermediatePk]: chosenId, [via]: this.user.id });
+                    if (!record) {
+                        throw new Error(`Access denied: "${field}" does not belong to the current user`);
+                    }
                 }
-                // Set the ID of the intermediate record to the main record's field
-                updatedRecord[field] = intermediateRecord.id;
             }
         }
         return updatedRecord;

package/lib/model/ModelHandler.d.ts

@@ -1,4 +1,13 @@
 import { AbstractModel } from "./AbstractModel";
+/**
+ * Central registry (service locator) for all AbstractModel instances in the application.
+ * A single instance is created in Adminizer and shared across the entire app via `req.adminizer.modelHandler`.
+ *
+ * Models are registered at startup via `bindModels`, then looked up by name from controllers,
+ * services, helpers, and system utilities — without importing each model directly.
+ *
+ * Lookup is case-insensitive: `"UserAP"`, `"userap"`, and `"USERAP"` all resolve to the same model.
+ */
 export declare class ModelHandler {
     private models;
     add<T>(modelName: string, modelInstance: AbstractModel<T>): void;

package/lib/model/ModelHandler.js

@@ -1,4 +1,13 @@
 import { Adminizer } from "../Adminizer.js";
+/**
+ * Central registry (service locator) for all AbstractModel instances in the application.
+ * A single instance is created in Adminizer and shared across the entire app via `req.adminizer.modelHandler`.
+ *
+ * Models are registered at startup via `bindModels`, then looked up by name from controllers,
+ * services, helpers, and system utilities — without importing each model directly.
+ *
+ * Lookup is case-insensitive: `"UserAP"`, `"userap"`, and `"USERAP"` all resolve to the same model.
+ */
 export class ModelHandler {
     models = new Map();
     add(modelName, modelInstance) {

package/lib/model/adapter/sequelize.js

@@ -275,18 +275,26 @@ export class SequelizeModel extends AbstractModel {
         const assocNames = Object.keys(this.model.associations);
         const plainData = {};
         const assocData = {};
-        // console.debug(">> _create: input data:", data);
-        // console.debug(">> Available associations:", assocNames);
         for (const [key, val] of Object.entries(data)) {
             if (assocNames.includes(key)) {
-                assocData[key] = val;
+                const assoc = this.model.associations[key];
+                // For BelongsTo, set the FK directly in plainData so NOT NULL constraints are satisfied
+                if (assoc && assoc.associationType === 'BelongsTo') {
+                    const fk = assoc.foreignKey;
+                    if (val !== null && val !== undefined) {
+                        plainData[fk] = typeof val === 'object' ? val[assoc.target.primaryKeyAttribute] : val;
+                    }
+                }
+                else {
+                    assocData[key] = val;
+                }
             }
             else {
                 plainData[key] = val;
             }
         }
-        // console.debug(">> Normal fields for create():", plainData);
-        // console.debug(">> Association data:", assocData);
+        console.debug(">> Normal fields for create():", JSON.stringify(plainData));
+        console.debug(">> Association data:", JSON.stringify(assocData));
         let instance;
         try {
             instance = await this.model.create(plainData);
@@ -415,7 +423,16 @@ export class SequelizeModel extends AbstractModel {
         const assocData = {};
         for (const [key, val] of Object.entries(data)) {
             if (assocNames.includes(key)) {
-                assocData[key] = val;
+                const assoc = this.model.associations[key];
+                if (assoc && assoc.associationType === 'BelongsTo') {
+                    const fk = assoc.foreignKey;
+                    if (val !== null && val !== undefined) {
+                        plainData[fk] = typeof val === 'object' ? val[assoc.target.primaryKeyAttribute] : val;
+                    }
+                }
+                else {
+                    assocData[key] = val;
+                }
             }
             else {
                 plainData[key] = val;
@@ -434,7 +451,16 @@ export class SequelizeModel extends AbstractModel {
         const assocData = {};
         for (const [key, val] of Object.entries(data)) {
             if (assocNames.includes(key)) {
-                assocData[key] = val;
+                const assoc = this.model.associations[key];
+                if (assoc && assoc.associationType === 'BelongsTo') {
+                    const fk = assoc.foreignKey;
+                    if (val !== null && val !== undefined) {
+                        plainData[fk] = typeof val === 'object' ? val[assoc.target.primaryKeyAttribute] : val;
+                    }
+                }
+                else {
+                    assocData[key] = val;
+                }
             }
             else {
                 plainData[key] = val;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "adminizer",
   "type": "module",
-  "version": "4.6.0-build.203",
+  "version": "4.6.0-build.205",
   "main": "index.js",
   "exports": {
     ".": "./index.js",

package/system/Router.js

@@ -194,7 +194,7 @@ export default class Router {
             register(`${prefix}/edit/:id`, _edit);
             register(`${prefix}/remove/:id`, _remove);
         }
-        else if (typeof modelConfig !== "boolean") {
+        else if (modelConfig !== undefined && typeof modelConfig !== "boolean") {
             Adminizer.log.debug(`Adminpanel create CRUD routes for \`${model}\` by ModelConfig`);
             /**
              * Create new record

package/system/bindAccessRights.js

@@ -4,28 +4,7 @@ export default async function bindAccessRights(adminizer) {
         for (let key of Object.keys(models)) {
             const model = models[key];
             if (typeof model !== "boolean") {
-                let modelName = model.model;
-                let department = `Model ${key}`;
-                // create
-                adminizer.accessRightsHelper.registerToken({
-                    id: `create-${modelName}-model`, name: "Create",
-                    description: "Access to creating record in database", department: department
-                });
-                // read
-                adminizer.accessRightsHelper.registerToken({
-                    id: `read-${modelName}-model`, name: "Read",
-                    description: "Access to reading records in database", department: department
-                });
-                // update
-                adminizer.accessRightsHelper.registerToken({
-                    id: `update-${modelName}-model`, name: "Update",
-                    description: "Access to updating records in database", department: department
-                });
-                // delete
-                adminizer.accessRightsHelper.registerToken({
-                    id: `delete-${modelName}-model`, name: "Delete",
-                    description: "Access to deleting records in database", department: department
-                });
+                adminizer.accessRightsHelper.registerModelTokens(model.model);
             }
         }
     }