adminizer 4.6.0 → 4.7.0-build.221

package/controllers/filter-fields/savedFilters.js

@@ -0,0 +1,317 @@
+import { ControllerHelper } from "../../helpers/controllerHelper.js";
+import { FilterService } from "../../lib/filters/FilterService.js";
+import { Adminizer } from "../../lib/Adminizer.js";
+import { GROUP_FILTER_VISIBILITY_TOKEN } from "../../policies/permissionResolvers.js";
+/**
+ * POST /adminizer/model/:model/filter/apply
+ * Apply temporary filter (without saving) - stores filter in session keyed by model name
+ */
+export async function applyTemporaryFilter(req, res) {
+    const modelResource = ControllerHelper.findModelResource(req);
+    if (!modelResource.model) {
+        return res.status(404).send({ error: req.i18n.__('Model not found') });
+    }
+    const { name, conditions, columns } = req.body;
+    if (!conditions || !Array.isArray(conditions)) {
+        return res.status(400).send({ error: req.i18n.__('Conditions are required') });
+    }
+    // Store temporary filter in session keyed by model name
+    if (req.session) {
+        if (!req.session.temporaryFilters) {
+            req.session.temporaryFilters = {};
+        }
+        req.session.temporaryFilters[modelResource.name] = {
+            name: name || req.i18n.__('Temporary filter'),
+            conditions,
+            columns: columns || undefined
+        };
+    }
+    return res.json({
+        success: true,
+        filterId: 'temporary',
+        name: name || req.i18n.__('Temporary filter'),
+        conditionCount: conditions.length
+    });
+}
+/**
+ * GET /adminizer/model/:model/filter/temporary
+ * Returns temporary filter from server session.
+ */
+export async function getTemporaryFilter(req, res) {
+    const modelResource = ControllerHelper.findModelResource(req);
+    if (!modelResource.model) {
+        return res.status(404).send({ error: req.i18n.__('Model not found') });
+    }
+    const temporaryFilter = req.session?.temporaryFilters?.[modelResource.name];
+    if (!temporaryFilter) {
+        return res.status(404).send({ error: req.i18n.__('Temporary filter not found') });
+    }
+    return res.json({
+        filter: {
+            id: 'temporary',
+            name: temporaryFilter.name,
+            conditions: temporaryFilter.conditions || [],
+            columns: temporaryFilter.columns || undefined
+        }
+    });
+}
+/**
+ * GET /adminizer/model/:model/saved-filters
+ * Returns list of saved filters for the model
+ */
+export async function getSavedFilters(req, res) {
+    const modelResource = ControllerHelper.findModelResource(req);
+    if (!modelResource.model) {
+        return res.status(404).send({ error: req.i18n.__('Model not found') });
+    }
+    const filterService = new FilterService(req.adminizer);
+    // Get filters accessible by user (public filters for all users)
+    const filters = await filterService.getFiltersForModel(modelResource.name, req.user, {
+        includePublic: true,
+        includeSystem: false
+    });
+    // Load owner info for each filter
+    const userModel = req.adminizer.modelHandler.model.get('userap');
+    const filtersWithOwner = await Promise.all(filters.map(async (filter) => {
+        let ownerInfo = null;
+        if (userModel && filter.ownerId) {
+            try {
+                const owner = await userModel['_findOne']({ where: { id: filter.ownerId } });
+                if (owner) {
+                    ownerInfo = {
+                        id: owner.id,
+                        login: owner.login,
+                        fullName: owner.fullName
+                    };
+                }
+            }
+            catch (e) {
+                // Ignore errors loading owner
+            }
+        }
+        return {
+            ...filter,
+            ownerInfo
+        };
+    }));
+    // Get result count for each filter
+    const filtersWithCount = await Promise.all(filtersWithOwner.map(async (filter) => {
+        const count = await filterService.countFilterResults(filter, req.user);
+        return {
+            ...filter,
+            resultCount: count
+        };
+    }));
+    return res.json({
+        model: modelResource.name,
+        filters: filtersWithCount
+    });
+}
+/**
+ * POST /adminizer/model/:model/filter
+ * Create or update a saved filter
+ */
+export async function saveFilter(req, res) {
+    const modelResource = ControllerHelper.findModelResource(req);
+    if (!modelResource.model) {
+        return res.status(404).send({ error: req.i18n.__('Model not found') });
+    }
+    const { name, description, conditions, sortField, sortDirection, icon, color, filterId, columns, visibility, groupIds } = req.body;
+    if (!name) {
+        return res.status(400).send({ error: req.i18n.__('Filter name is required') });
+    }
+    if (!conditions || !Array.isArray(conditions)) {
+        return res.status(400).send({ error: req.i18n.__('Filter conditions are required') });
+    }
+    // Determine visibility and groupIds
+    const isAdmin = req.user?.isAdministrator === true;
+    const canManageGroupVisibility = isAdmin || req.adminizer.accessRightsHelper.hasPermission(GROUP_FILTER_VISIBILITY_TOKEN, req.user);
+    let effectiveVisibility = 'private';
+    let effectiveGroupIds;
+    if (visibility === 'public' && isAdmin) {
+        effectiveVisibility = 'public';
+    }
+    else if (visibility === 'groups' && canManageGroupVisibility) {
+        // Groups visibility: only if groupIds provided and user has access to those groups
+        if (groupIds && Array.isArray(groupIds) && groupIds.length > 0) {
+            effectiveVisibility = 'groups';
+            effectiveGroupIds = groupIds;
+        }
+        else {
+            effectiveVisibility = 'private';
+        }
+    }
+    else {
+        effectiveVisibility = 'private';
+    }
+    const filterService = new FilterService(req.adminizer);
+    try {
+        // Check if filter with same name exists for this user
+        const existingFilters = await filterService.getFiltersForModel(modelResource.name, req.user, {
+            includePublic: false,
+            includeSystem: false
+        });
+        const existingFilter = existingFilters.find(f => f.name === name && f.ownerId === req.user.id);
+        if (existingFilter && !filterId) {
+            // Filter with same name exists, ask for confirmation
+            return res.status(409).json({
+                error: req.i18n.__('Filter with this name already exists'),
+                requiresConfirmation: true,
+                existingFilter: {
+                    id: existingFilter.id,
+                    name: existingFilter.name
+                }
+            });
+        }
+        let filter;
+        if (filterId && existingFilter && existingFilter.id === filterId) {
+            // Update own existing filter - allow changing visibility
+            const updateData = {
+                name,
+                description,
+                conditions,
+                sortField,
+                sortDirection,
+                icon,
+                color,
+                visibility: effectiveVisibility,
+                groupIds: effectiveGroupIds
+            };
+            // If visibility changed to non-private, disable API feed
+            const wasPrivate = existingFilter.visibility === 'private';
+            const isNowPrivate = effectiveVisibility === 'private';
+            if (wasPrivate && !isNowPrivate) {
+                // Changed from private to non-private - disable feed
+                updateData.apiEnabled = false;
+                updateData.apiKey = undefined;
+            }
+            else if (!isNowPrivate) {
+                // Not private - ensure feed is disabled
+                updateData.apiEnabled = false;
+                updateData.apiKey = undefined;
+            }
+            // Handle API access toggle - only allowed for private filters owned by current user
+            const apiEnabled = req.body.apiEnabled === true;
+            const isOwner = existingFilter.ownerId === req.user.id;
+            const isPrivate = effectiveVisibility === 'private';
+            // API feed can only be enabled for private filters owned by the current user
+            if (isPrivate && isOwner && apiEnabled) {
+                updateData.apiEnabled = true;
+                // Regenerate key if requested
+                if (req.body.regenerateApiKey) {
+                    updateData.apiKey = crypto.randomUUID();
+                }
+                else if (!existingFilter.apiKey) {
+                    // Generate key if enabling for first time
+                    updateData.apiKey = crypto.randomUUID();
+                }
+                else {
+                    // Keep existing key
+                    updateData.apiKey = existingFilter.apiKey;
+                }
+            }
+            filter = await filterService.updateFilter(filterId, updateData, req.user);
+        }
+        else if (filterId) {
+            // Update someone else's filter - preserve original visibility
+            // First get the original filter to preserve its visibility settings
+            const originalFilter = await filterService.getFilterById(filterId, req.user);
+            if (!originalFilter) {
+                return res.status(404).json({ error: req.i18n.__('Filter not found') });
+            }
+            filter = await filterService.updateFilter(filterId, {
+                name,
+                description,
+                conditions,
+                sortField,
+                sortDirection,
+                icon,
+                color,
+                // Preserve original visibility - don't allow changing someone else's filter visibility
+                visibility: originalFilter.visibility,
+                groupIds: originalFilter.groupIds
+            }, req.user);
+        }
+        else {
+            // Create new filter
+            filter = await filterService.createFilter({
+                id: crypto.randomUUID(),
+                name,
+                description,
+                modelName: modelResource.name,
+                conditions,
+                sortField,
+                sortDirection,
+                icon,
+                color,
+                visibility: effectiveVisibility,
+                groupIds: effectiveGroupIds,
+                ownerId: req.user.id,
+                apiEnabled: false,
+                version: 1
+            }, req.user);
+        }
+        // Save columns if provided
+        if (columns && Array.isArray(columns)) {
+            const filterColumns = columns.map((col, index) => ({
+                fieldName: col.fieldName,
+                order: col.order !== undefined ? col.order : index
+            }));
+            await filterService.updateFilterColumns(filter.id, filterColumns, req.user);
+        }
+        // Get result count
+        const count = await filterService.countFilterResults(filter, req.user);
+        return res.json({
+            success: true,
+            filter: {
+                ...filter,
+                resultCount: count
+            }
+        });
+    }
+    catch (error) {
+        Adminizer.log.error('Error saving filter:', error);
+        return res.status(500).json({
+            error: req.i18n.__('Failed to save filter'),
+            message: error.message
+        });
+    }
+}
+/**
+ * DELETE /adminizer/model/:model/filter/:id
+ * Delete a saved filter
+ */
+export async function deleteFilter(req, res) {
+    const modelResource = ControllerHelper.findModelResource(req);
+    if (!modelResource.model) {
+        return res.status(404).send({ error: req.i18n.__('Model not found') });
+    }
+    const filterId = Array.isArray(req.params.id) ? req.params.id[0] : String(req.params.id);
+    if (!filterId || filterId === 'undefined' || filterId === 'null') {
+        return res.status(400).send({ error: req.i18n.__('Filter ID is required') });
+    }
+    const filterService = new FilterService(req.adminizer);
+    try {
+        Adminizer.log.debug(`Deleting filter: ${filterId}`);
+        await filterService.deleteFilter(filterId, req.user);
+        // Return identical response to prevent filter existence/ownership enumeration.
+        return res.status(204).send();
+    }
+    catch (error) {
+        const errorMessage = typeof error?.message === 'string'
+            ? error.message.toLowerCase()
+            : '';
+        const isNotFound = errorMessage.includes('not found');
+        const isAccessDenied = errorMessage.includes('access denied');
+        // Fail closed without disclosing whether the filter exists or belongs to another user.
+        if (isNotFound || isAccessDenied) {
+            Adminizer.log.debug(`Filter delete suppressed for id=${filterId}: not found or access denied`);
+            return res.status(204).send();
+        }
+        Adminizer.log.error('Error deleting filter:', error);
+        return res.status(500).json({
+            error: req.i18n.__('Failed to delete filter'),
+            message: error.message
+        });
+    }
+}

package/controllers/getAllWidgets.d.ts

@@ -1 +1 @@
-export default function getAllWidgets(req: ReqType, res: ResType): Promise<void | ResType>;
+export default function getAllWidgets(req: ReqType, res: ResType): Promise<ResType>;

package/controllers/getAllWidgets.js

@@ -1,13 +1,4 @@
-import { redirectToLogin } from '../helpers/inertiaAutHelper.js';
 export default async function getAllWidgets(req, res) {
-    if (req.adminizer.config.auth.enable) {
-        if (!req.user) {
-            return redirectToLogin(req, res);
-        }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widgets`, req.user)) {
-            return res.sendStatus(403);
-        }
-    }
     if (req.method.toUpperCase() === 'GET') {
         try {
             return res.json({ widgets: await req.adminizer.widgetHandler.getAll(req.user, req.i18n) });
@@ -16,4 +7,5 @@ export default async function getAllWidgets(req, res) {
             return res.status(500).send({ error: e.message || 'Internal Server Error' });
         }
     }
+    return res.status(405).end();
 }

package/controllers/history-actions/HistoryController.js

@@ -1,9 +1,9 @@
 import { Adminizer } from "../../lib/Adminizer.js";
-import { redirectToLogin } from '../../helpers/inertiaAutHelper.js';
+import { getUiTranslations } from "../../lib/ui-i18n/getUiTranslations.js";
+import { HISTORY_UI_TRANSLATION_KEYS } from "../../lib/ui-i18n/uiTranslationKeys.js";
 export class HistoryController {
     static async index(req, res) {
-        const isUiRequest = req.method.toUpperCase() === 'GET';
-        if (!HistoryController.checkHistoryPermission(req, res, isUiRequest))
+        if (!HistoryController.checkHistoryPermission(req, res))
             return;
         const adapter = HistoryController.getAdapter(req);
         if (req.method.toUpperCase() === 'GET') {
@@ -29,21 +29,7 @@ export class HistoryController {
                     title
                 };
             });
-            const messages = {
-                "Models": "",
-                "All": "",
-                "Users": "",
-                "Date": "",
-                "Pick a date": "",
-                "Search": "",
-                "Reset": "",
-                "Model": "",
-                "Name": "",
-                "Event": "",
-                "User": "",
-                "The end of the list has been reached": "",
-                "There are no records to display": "",
-            };
+            const i18nPage = getUiTranslations(req, HISTORY_UI_TRANSLATION_KEYS);
             return req.Inertia.render({
                 component: 'history',
                 props: {
@@ -52,7 +38,7 @@ export class HistoryController {
                     users: users.map((user) => ({
                         name: user.login
                     })),
-                    messages: Object.fromEntries(Object.keys(messages).map(key => [key, req.i18n.__(key)]))
+                    i18nPage
                 }
             });
         }
@@ -117,22 +103,11 @@ export class HistoryController {
         const adapter = req.adminizer.config.history?.adapter ?? 'default';
         return req.adminizer.historyHandler.get(adapter);
     }
-    static checkHistoryPermission(req, res, shouldRedirectToLogin = false) {
+    static checkHistoryPermission(req, res) {
         if (!req.adminizer?.historyHandler) {
             res.status(401).json({ error: 'History system not initialized' });
             return false;
         }
-        if (req.adminizer.config.auth.enable) {
-            if (!req.user) {
-                if (shouldRedirectToLogin) {
-                    redirectToLogin(req, res);
-                }
-                else {
-                    res.status(401).json({ error: 'Unauthorized' });
-                }
-                return false;
-            }
-        }
         const hasPermission = req.adminizer.accessRightsHelper.hasPermission(`history-${req.adminizer.config.history?.adapter ?? 'default'}`, req.user);
         if (!hasPermission) {
             res.sendStatus(403);

package/controllers/initUser.js

@@ -1,12 +1,13 @@
 import { Adminizer } from "../lib/Adminizer.js";
 import { generate } from "password-hash";
 import { inertiaInitUserHelper } from "../helpers/inertiaAutHelper.js";
+import { generateUserApiKey } from "../helpers/apiKeyHelper.js";
 export default async function initUser(req, res) {
     if (!req.adminizer.config.auth.enable) {
         return res.redirect(`${req.adminizer.config.routePrefix}/`);
     }
-    // TODO refactor CRUD functions for DataAccessor usage
-    let admins = await req.adminizer.modelHandler.model.get("UserAP")["_find"]({ isAdministrator: true });
+    const userModel = req.adminizer.modelHandler.internal("auth").get("UserAP");
+    let admins = await userModel.find({ where: { isAdministrator: true } });
     if (admins.length) {
         res.redirect(`${req.adminizer.config.routePrefix}/model/userap/login`);
     }
@@ -31,14 +32,14 @@ export default async function initUser(req, res) {
             Adminizer.log.debug(`Created admin`);
             let passwordHashed = generate(login + password + process.env.AP_PASSWORD_SALT);
             password = 'masked';
-            // TODO refactor CRUD functions for DataAccessor usage
-            await req.adminizer.modelHandler.model.get("UserAP")["_create"]({
+            await userModel.create({
                 login: login,
                 passwordHashed: passwordHashed,
                 fullName: "Administrator",
                 isActive: true,
                 ...(locale !== undefined && { locale }),
-                isAdministrator: true
+                isAdministrator: true,
+                apiKey: generateUserApiKey()
             });
         }
         catch (e) {

package/controllers/inlineUpdate.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Inline update controller for list view
+ * PATCH /adminizer/model/:name/inline/:id
+ *
+ * Body: { field: string, value: any }
+ */
+export default function inlineUpdate(req: ReqType, res: ResType): Promise<ResType>;

package/controllers/inlineUpdate.js

@@ -0,0 +1,148 @@
+import { ControllerHelper } from "../helpers/controllerHelper.js";
+import { Adminizer } from "../lib/Adminizer.js";
+import { DataAccessor } from "../lib/DataAccessor.js";
+/**
+ * Inline update controller for list view
+ * PATCH /adminizer/model/:name/inline/:id
+ *
+ * Body: { field: string, value: any }
+ */
+export default async function inlineUpdate(req, res) {
+    const allowedFieldTypes = new Set(['string', 'integer', 'number', 'range', 'boolean', 'float', 'email']);
+    // Check ID
+    if (!req.params.id) {
+        return res.status(400).json({ error: 'Record ID is required' });
+    }
+    // Check field
+    if (!req.body.field) {
+        return res.status(400).json({ error: 'Field name is required' });
+    }
+    const modelResource = ControllerHelper.findModelResource(req);
+    if (!modelResource.model) {
+        return res.status(404).json({ error: 'Model not found' });
+    }
+    const fieldName = req.body.field;
+    const newValue = req.body.value;
+    // Get field config
+    const dataAccessor = new DataAccessor(req.adminizer, req.user, modelResource, "edit");
+    const fields = dataAccessor.getFieldsConfig();
+    const fieldConfig = fields[fieldName];
+    if (!fieldConfig) {
+        return res.status(400).json({ error: `Field '${fieldName}' not found` });
+    }
+    const identifierField = modelResource.config.identifierField ||
+        req.adminizer.config.identifierField ||
+        modelResource.model.primaryKey ||
+        'id';
+    const blockedInlineFields = new Set(['id', 'createdat', 'updatedat']);
+    if (blockedInlineFields.has(fieldName.toLowerCase()) || fieldName === identifierField) {
+        return res.status(403).json({ error: `Field '${fieldName}' cannot be edited inline` });
+    }
+    // Check if inline edit is explicitly disabled for this field
+    const baseConfig = fieldConfig.config;
+    if (baseConfig.inlineEditable === false) {
+        return res.status(403).json({ error: `Field '${fieldName}' is not inline editable` });
+    }
+    // Check if field has displayModifier (should not be editable)
+    if (baseConfig.displayModifier) {
+        return res.status(403).json({ error: `Field '${fieldName}' has displayModifier and cannot be edited` });
+    }
+    // Check if field type supports inline editing.
+    // Prefer explicit field config type, fallback to model metadata type.
+    const fieldType = (baseConfig.type || fieldConfig.model?.type || '').toLowerCase();
+    if (!fieldType || !allowedFieldTypes.has(fieldType)) {
+        return res.status(403).json({ error: `Field '${fieldName}' type does not support inline editing` });
+    }
+    // Validate value
+    const validationError = validateInlineValue(newValue, baseConfig, fieldType);
+    if (validationError) {
+        return res.status(400).json({ error: validationError });
+    }
+    // Convert value based on field type
+    const convertedValue = convertInlineValue(newValue, fieldType);
+    // Update record
+    const id = req.params.id;
+    const params = {};
+    params[modelResource.config.identifierField || req.adminizer.config.identifierField] = id;
+    try {
+        await modelResource.model.update(params, { [fieldName]: convertedValue }, dataAccessor);
+        return res.json({
+            success: true,
+            data: {
+                id,
+                field: fieldName,
+                value: convertedValue
+            }
+        });
+    }
+    catch (error) {
+        Adminizer.log.error('Inline update error:', error);
+        return res.status(500).json({ error: 'Failed to update record' });
+    }
+}
+/**
+ * Validate value according to inline validation rules
+ */
+function validateInlineValue(value, config, fieldType) {
+    const validation = config.inlineValidation;
+    // String validations
+    if (typeof value === 'string') {
+        if (validation?.minLength && value.length < validation.minLength) {
+            return `Value must be at least ${validation.minLength} characters`;
+        }
+        if (validation?.maxLength && value.length > validation.maxLength) {
+            return `Value must be at most ${validation.maxLength} characters`;
+        }
+        if (validation?.pattern && !new RegExp(validation.pattern).test(value)) {
+            return `Value does not match required pattern`;
+        }
+    }
+    // Number validations
+    if (typeof value === 'number' || ['integer', 'number', 'float', 'range'].includes(fieldType || '')) {
+        const numValue = Number(value);
+        if (isNaN(numValue)) {
+            return 'Invalid number';
+        }
+        if (validation?.min !== undefined && numValue < validation.min) {
+            return `Value must be at least ${validation.min}`;
+        }
+        if (validation?.max !== undefined && numValue > validation.max) {
+            return `Value must be at most ${validation.max}`;
+        }
+    }
+    // Custom validation
+    if (validation?.validate) {
+        const result = validation.validate(value);
+        if (typeof result === 'string') {
+            return result;
+        }
+        if (result === false) {
+            return 'Invalid value';
+        }
+    }
+    return null;
+}
+/**
+ * Convert value to appropriate type
+ */
+function convertInlineValue(value, fieldType) {
+    if (value === null || value === undefined) {
+        return value;
+    }
+    switch (fieldType) {
+        case 'boolean':
+            return Boolean(value);
+        case 'integer':
+            return parseInt(value, 10);
+        case 'number':
+        case 'float':
+            return parseFloat(value);
+        case 'range':
+            return typeof value === 'string' ? parseFloat(value) : Number(value);
+        case 'email':
+        case 'string':
+        case 'text':
+        default:
+            return typeof value === 'string' ? value : String(value);
+    }
+}

package/controllers/list.d.ts

@@ -1 +1 @@
-export default function list(req: ReqType, res: ResType): Promise<void | ResType>;
+export default function list(req: ReqType, res: ResType): Promise<import("express").Response<any, Record<string, any>>>;