adminizer 4.6.0 → 4.7.0-build.221

package/controllers/notifications/NotificationController.js

@@ -1,8 +1,9 @@
 import { Adminizer } from '../../lib/Adminizer.js';
-import { redirectToLogin } from '../../helpers/inertiaAutHelper.js';
+import { getUiTranslations } from "../../lib/ui-i18n/getUiTranslations.js";
+import { NOTIFICATION_UI_TRANSLATION_KEYS } from "../../lib/ui-i18n/uiTranslationKeys.js";
 export class NotificationController {
     static async search(req, res) {
-        if (!NotificationController.checkNotifPermission(req, res))
+        if (!NotificationController.checkNotifStatus(req, res))
             return;
         if (req.method.toUpperCase() === 'POST') {
             const { s, notificationClass } = req.body;
@@ -16,29 +17,14 @@ export class NotificationController {
         }
     }
     static async viewAll(req, res) {
-        const isUiRequest = req.method.toUpperCase() === 'GET';
-        if (!NotificationController.checkNotifPermission(req, res, isUiRequest))
+        if (!NotificationController.checkNotifStatus(req, res))
             return;
-        if (req.method.toUpperCase() === 'POST') {
-            const messages = {
-                "Make read": "",
-                "View All": "",
-                "Search": "",
-                "Make all read": "",
-                "Title": "",
-                "Message": "",
-                "Date": "",
-                "Diff": "",
-                "The end of the list has been reached": "",
-            };
-            res.json(Object.fromEntries(Object.keys(messages).map(key => [key, req.i18n.__(key)])));
-            return;
-        }
         if (req.method.toUpperCase() === 'GET') {
             req.Inertia.render({
                 component: 'notification',
                 props: {
                     title: req.i18n.__('Notifications'),
+                    i18nPage: getUiTranslations(req, NOTIFICATION_UI_TRANSLATION_KEYS),
                 }
             });
             return;
@@ -46,7 +32,7 @@ export class NotificationController {
         res.status(405).end();
     }
     static async getNotificationClasses(req, res) {
-        if (!NotificationController.checkNotifPermission(req, res))
+        if (!NotificationController.checkNotifStatus(req, res))
             return;
         if (req.adminizer.config.notifications.enabled === false) {
             Adminizer.log.warn('[Notifications] Notifications disabled in config');
@@ -70,7 +56,7 @@ export class NotificationController {
         });
     }
     static async getNotificationsStream(req, res) {
-        if (!NotificationController.checkNotifPermission(req, res))
+        if (!NotificationController.checkNotifStatus(req, res))
             return;
         res.setHeader('Content-Type', 'text/event-stream');
         res.setHeader('Cache-Control', 'no-cache, no-transform');
@@ -152,7 +138,7 @@ export class NotificationController {
     }
     // API for receiving class notifications
     static async getNotificationsByClass(req, res) {
-        if (!NotificationController.checkNotifPermission(req, res))
+        if (!NotificationController.checkNotifStatus(req, res))
             return;
         try {
             const { notificationClass } = req.params;
@@ -178,7 +164,7 @@ export class NotificationController {
     }
     // API for receiving all user notifications
     static async getUserNotifications(req, res) {
-        if (!NotificationController.checkNotifPermission(req, res))
+        if (!NotificationController.checkNotifStatus(req, res))
             return;
         const { limit = 4, skip = 0, unreadOnly = false } = req.query;
         try {
@@ -201,7 +187,7 @@ export class NotificationController {
     }
     // API for marking as read
     static async markAsRead(req, res) {
-        if (!NotificationController.checkNotifPermission(req, res))
+        if (!NotificationController.checkNotifStatus(req, res))
             return;
         try {
             const { notificationClass, id } = req.params;
@@ -215,7 +201,7 @@ export class NotificationController {
         }
     }
     static async markAllAsRead(req, res) {
-        if (!NotificationController.checkNotifPermission(req, res))
+        if (!NotificationController.checkNotifStatus(req, res))
             return;
         try {
             const services = req.adminizer.notificationHandler.getAllServices();
@@ -229,21 +215,11 @@ export class NotificationController {
             res.status(500).json({ error: 'Internal server error' });
         }
     }
-    static checkNotifPermission(req, res, shouldRedirectToLogin = false) {
+    static checkNotifStatus(req, res) {
         if (!req.adminizer?.notificationHandler) {
             res.status(500).json({ error: 'Notification system not initialized' });
             return false;
         }
-        // We use the redirect only for UI pages; API requests receive 401.
-        if (req.adminizer.config.auth.enable && !req.user) {
-            if (shouldRedirectToLogin) {
-                redirectToLogin(req, res);
-            }
-            else {
-                res.status(401).json({ error: 'Unauthorized' });
-            }
-            return false;
-        }
         return true;
     }
 }

package/controllers/register.js

@@ -1,9 +1,13 @@
 import { generate } from "password-hash";
 import { inertiaRegisterHelper } from "../helpers/inertiaAutHelper.js";
+import { generateUserApiKey } from "../helpers/apiKeyHelper.js";
 export default async function register(req, res) {
     if (!req.adminizer.config.auth.enable || req.adminizer.config.registration?.enable !== true) {
         return res.redirect(`${req.adminizer.config.routePrefix}/`);
     }
+    const authModels = req.adminizer.modelHandler.internal("auth");
+    const userModel = authModels.get("UserAP");
+    const groupModel = authModels.get("GroupAP");
     if (req.method.toUpperCase() === "POST") {
         for (const key of ["login", "fullName", "password"]) {
             if (!req.body[key]) {
@@ -20,8 +24,7 @@ export default async function register(req, res) {
         }
         let user;
         try {
-            // TODO refactor CRUD functions for DataAccessor usage
-            user = await req.adminizer.modelHandler.model.get("UserAP")["_findOne"]({ login: req.body.login });
+            user = await userModel.findOne({ where: { login: req.body.login } });
         }
         catch (e) {
             return res.status(500).send({ error: e.message || 'Internal Server Error' });
@@ -41,18 +44,16 @@ export default async function register(req, res) {
             try {
                 let passwordHashed = generate(req.body.login + req.body.password + process.env.AP_PASSWORD_SALT);
                 let password = 'masked';
-                // TODO refactor CRUD functions for DataAccessor usage
-                let userap = await req.adminizer.modelHandler.model.get("UserAP")["_create"]({
+                let userap = await userModel.create({
                     login: req.body.login,
                     passwordHashed: passwordHashed,
                     fullName: req.body.fullName,
                     email: req.body.email,
-                    locale: req.body.locale
+                    locale: req.body.locale,
+                    apiKey: generateUserApiKey()
                 });
-                // TODO refactor CRUD functions for DataAccessor usage
-                let defaultUserGroup = await req.adminizer.modelHandler.model.get("GroupAP")["_findOne"]({ name: req.adminizer.config.registration.defaultUserGroup });
-                // TODO refactor CRUD functions for DataAccessor usage
-                await req.adminizer.modelHandler.model.get("UserAP")["_updateOne"]({ id: userap.id }, {
+                let defaultUserGroup = await groupModel.findOne({ where: { name: req.adminizer.config.registration.defaultUserGroup } });
+                await userModel.updateOne({ where: { id: userap.id } }, {
                     groups: [defaultUserGroup.id]
                 }); // instead of UserAP.addToCollection;
                 return req.Inertia.redirect(`${req.adminizer.config.routePrefix}`);

package/controllers/remove.js

@@ -2,7 +2,6 @@ import { ControllerHelper } from "../helpers/controllerHelper.js";
 import { deleteRelationsMediaManager } from "../lib/media-manager/helpers/MediaManagerHelper.js";
 import { DataAccessor } from "../lib/DataAccessor.js";
 import { Adminizer } from "../lib/Adminizer.js";
-import { redirectToLogin } from '../helpers/inertiaAutHelper.js';
 export default async function remove(req, res) {
     // Checking id of the record
     if (!req.params.id) {
@@ -10,21 +9,13 @@ export default async function remove(req, res) {
         return res.status(404).send({ error: 'Not Found' });
     }
     let referTo = decodeURIComponent(req.query.referTo);
-    let entity = ControllerHelper.findEntityObject(req);
-    if (!entity.model) {
+    let modelResource = ControllerHelper.findModelResource(req);
+    if (!modelResource.model) {
         Adminizer.log.error(new Error('Admin panel: no model found'));
         return res.status(404).send({ error: 'Not Found' });
     }
-    if (!entity.config.remove) {
-        return res.redirect(`${req.adminizer.config.routePrefix}/${entity.uri}`);
-    }
-    if (req.adminizer.config.auth.enable) {
-        if (!req.user) {
-            return redirectToLogin(req, res);
-        }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`delete-${entity.name}-model`, req.user)) {
-            return res.sendStatus(403);
-        }
+    if (!modelResource.config.remove) {
+        return res.redirect(`${req.adminizer.config.routePrefix}/${modelResource.uri}`);
     }
     /**
      * Searching for record by model
@@ -32,8 +23,8 @@ export default async function remove(req, res) {
     let record;
     let dataAccessor;
     try {
-        dataAccessor = new DataAccessor(req.adminizer, req.user, entity, "remove");
-        record = await entity.model.findOne({ id: req.params.id }, dataAccessor);
+        dataAccessor = new DataAccessor(req.adminizer, req.user, modelResource, "remove");
+        record = await modelResource.model.findOne({ where: { id: req.params.id } }, dataAccessor);
     }
     catch (e) {
         if (req.accepts('json')) {
@@ -57,13 +48,13 @@ export default async function remove(req, res) {
     // adminizer.log.debug('admin > remove > record > ', record);
     let destroyedRecord;
     try {
-        const fieldId = entity.config.identifierField ?? req.adminizer.config.identifierField;
+        const fieldId = modelResource.config.identifierField ?? req.adminizer.config.identifierField;
         const q = {};
         q[fieldId] = record[fieldId];
-        destroyedRecord = await entity.model.destroy(q, dataAccessor);
+        destroyedRecord = await modelResource.model.destroy(q, dataAccessor);
         console.log(destroyedRecord[0]);
         // delete relations media manager
-        await deleteRelationsMediaManager(req.adminizer, entity.name, destroyedRecord);
+        await deleteRelationsMediaManager(req.adminizer, modelResource.name, destroyedRecord);
     }
     catch (e) {
         Adminizer.log.error('adminpanel > error', e);
@@ -74,7 +65,7 @@ export default async function remove(req, res) {
     else {
         req.flash.setFlashMessage('error', req.i18n.__('Record was not removed'));
     }
-    let referToUrl = referTo ? `${entity.uri}${referTo}` : `${entity.uri}`;
+    let referToUrl = referTo ? `${modelResource.uri}${referTo}` : `${modelResource.uri}`;
     return req.Inertia.redirect(`${referToUrl}`);
 }
 ;

package/controllers/timezones.d.ts

@@ -1 +1 @@
-export default function timezones(req: ReqType, res: ResType): Promise<void | ResType>;
+export default function timezones(req: ReqType, res: ResType): Promise<ResType>;

package/controllers/timezones.js

@@ -1,10 +1,4 @@
-import { redirectToLogin } from '../helpers/inertiaAutHelper.js';
 export default async function timezones(req, res) {
-    if (req.adminizer.config.auth.enable) {
-        if (!req.user) {
-            return redirectToLogin(req, res);
-        }
-    }
     let timezones = [];
     for (let timezone of req.adminizer.config.timezones) {
         timezones.push({

package/controllers/userApiKey.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Controller for managing user API key.
+ * GET /adminizer/api/user-key — returns current user's API key
+ * POST /adminizer/api/user-key/regenerate — regenerates the API key
+ */
+export declare function getUserApiKey(req: ReqType, res: ResType): Promise<ResType>;
+export declare function regenerateUserApiKey(req: ReqType, res: ResType): Promise<ResType>;

package/controllers/userApiKey.js

@@ -0,0 +1,36 @@
+import { generateUserApiKey } from "../helpers/apiKeyHelper.js";
+import { Adminizer } from "../lib/Adminizer.js";
+/**
+ * Controller for managing user API key.
+ * GET /adminizer/api/user-key — returns current user's API key
+ * POST /adminizer/api/user-key/regenerate — regenerates the API key
+ */
+export async function getUserApiKey(req, res) {
+    // If user doesn't have an API key yet, generate one
+    if (!req.user.apiKey) {
+        const newKey = generateUserApiKey();
+        try {
+            const userModel = req.adminizer.modelHandler.internal("auth").get("UserAP");
+            await userModel.updateOne({ where: { id: req.user.id } }, { apiKey: newKey });
+            req.user.apiKey = newKey;
+        }
+        catch (e) {
+            Adminizer.log.error('Error generating user API key:', e);
+            return res.status(500).json({ error: 'Failed to generate API key' });
+        }
+    }
+    return res.json({ apiKey: req.user.apiKey });
+}
+export async function regenerateUserApiKey(req, res) {
+    const newKey = generateUserApiKey();
+    try {
+        const userModel = req.adminizer.modelHandler.internal("auth").get("UserAP");
+        await userModel.updateOne({ where: { id: req.user.id } }, { apiKey: newKey });
+        Adminizer.log.debug(`User ${req.user.id} regenerated their API key`);
+        return res.json({ apiKey: newKey });
+    }
+    catch (e) {
+        Adminizer.log.error('Error regenerating user API key:', e);
+        return res.status(500).json({ error: 'Failed to regenerate API key' });
+    }
+}

package/controllers/view.js

@@ -6,49 +6,39 @@ import { inertiaGroupHelper } from "../helpers/inertiaGroupHelper.js";
 import inertiaAddHelper from "../helpers/inertiaAddHelper.js";
 import { FieldsHelper } from "../helpers/fieldsHelper.js";
 import { getRelationsMediaManager } from "../lib/media-manager/helpers/MediaManagerHelper.js";
-import { redirectToLogin } from '../helpers/inertiaAutHelper.js';
 export default async function view(req, res) {
     // Check id
     if (!req.params.id) {
         return res.status(404).send({ error: 'Not Found' });
     }
-    let entity = ControllerHelper.findEntityObject(req);
-    if (!entity.config.view) {
-        return res.redirect(`${req.adminizer.config.routePrefix}/${entity.uri}`);
+    let modelResource = ControllerHelper.findModelResource(req);
+    if (!modelResource.config.view) {
+        return res.redirect(`${req.adminizer.config.routePrefix}/${modelResource.uri}`);
     }
-    if (!entity.model) {
+    if (!modelResource.model) {
         return res.status(404).send({ error: 'Not Found' });
     }
-    if (req.adminizer.config.auth.enable) {
-        if (!req.user) {
-            return redirectToLogin(req, res);
-        }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`read-${entity.name}-model`, req.user)) {
-            return res.sendStatus(403);
-        }
-    }
-    let dataAccessor = new DataAccessor(req.adminizer, req.user, entity, "view");
+    let dataAccessor = new DataAccessor(req.adminizer, req.user, modelResource, "view");
     let fields = dataAccessor.getFieldsConfig();
     let record;
     try {
-        record = await entity.model.findOne({ id: req.params.id }, dataAccessor);
+        record = await modelResource.model.findOne({ where: { id: req.params.id } }, dataAccessor);
     }
     catch (e) {
         Adminizer.log.error('Admin edit error: ');
         Adminizer.log.error(e);
         return res.status(500).send({ error: 'Internal Server Error' });
     }
-    switch (entity.config.model) {
+    switch (modelResource.config.model) {
         case 'userap':
             let groups;
             try {
-                // TODO refactor CRUD functions for DataAccessor usage
-                groups = await req.adminizer.modelHandler.model.get("GroupAP")["_find"]({});
+                groups = await req.adminizer.modelHandler.internal("users").get("GroupAP").find({});
             }
             catch (e) {
                 Adminizer.log.error(e);
             }
-            const userProps = inertiaUserHelper(entity, req, groups, record, true);
+            const userProps = inertiaUserHelper(modelResource, req, groups, record, true);
             return req.Inertia.render({
                 component: 'add-user',
                 props: userProps
@@ -56,16 +46,14 @@ export default async function view(req, res) {
         case 'groupap':
             let users;
             try {
-                // TODO refactor CRUD functions for DataAccessor usage
-                users = await req.adminizer.modelHandler.model.get("UserAP")["_find"](({ isAdministrator: false }));
+                users = await req.adminizer.modelHandler.internal("users").get("UserAP").find({ where: { isAdministrator: false } });
             }
             catch (e) {
                 Adminizer.log.error(e);
             }
             let group;
             try {
-                // TODO refactor CRUD functions for DataAccessor usage
-                group = await req.adminizer.modelHandler.model.get("GroupAP")["_findOne"]({ id: req.params.id });
+                group = await req.adminizer.modelHandler.internal("users").get("GroupAP").findOne({ where: { id: Number(req.params.id) } });
             }
             catch (e) {
                 Adminizer.log.error('Admin edit error: ');
@@ -77,7 +65,7 @@ export default async function view(req, res) {
             for (let department of departments) {
                 groupedTokens[department] = req.adminizer.accessRightsHelper.getTokensByDepartment(department);
             }
-            const groupProps = inertiaGroupHelper(entity, req, users, groupedTokens, group, true);
+            const groupProps = inertiaGroupHelper(modelResource, req, users, groupedTokens, group, true);
             return req.Inertia.render({
                 component: 'add-group',
                 props: groupProps
@@ -89,13 +77,13 @@ export default async function view(req, res) {
                 if (fieldConfigConfig.type === 'mediamanager') {
                     record[field] = await getRelationsMediaManager(req.adminizer, {
                         mediaManagerId: fieldConfigConfig.options?.id ?? "default",
-                        model: entity.model.modelname,
+                        model: modelResource.model.modelname,
                         widgetName: field,
                         modelId: req.params.id
                     });
                 }
             }
-            const props = inertiaAddHelper(req, entity, fields, record, true);
+            const props = inertiaAddHelper(req, modelResource, fields, record, true);
             return req.Inertia.render({
                 component: 'add',
                 props: props

package/controllers/welcome.d.ts

@@ -1,4 +1,4 @@
 /**
  * Welcome text
  */
-export default function welcome(req: ReqType, res: ResType): void | Promise<import("express").Response<any, Record<string, any>>>;
+export default function welcome(req: ReqType, res: ResType): Promise<import("express").Response<any, Record<string, any>>>;

package/controllers/welcome.js

@@ -1,11 +1,7 @@
-import { redirectToLogin } from '../helpers/inertiaAutHelper.js';
 /**
  * Welcome text
  */
 export default function welcome(req, res) {
-    if (!req.user) {
-        return redirectToLogin(req, res);
-    }
     let text = '';
     let title = '';
     if (Boolean((req.adminizer.configHelper.getConfig()).welcome) && Boolean((req.adminizer.configHelper.getConfig()).welcome.title) && Boolean((req.adminizer.configHelper.getConfig()).welcome.text)) {

package/controllers/widgets/Action.d.ts

@@ -1 +1 @@
-export declare function widgetActionController(req: ReqType, res: ResType): Promise<void | ResType>;
+export declare function widgetActionController(req: ReqType, res: ResType): Promise<ResType>;

package/controllers/widgets/Action.js

@@ -1,17 +1,8 @@
-import { redirectToLogin } from '../../helpers/inertiaAutHelper.js';
 export async function widgetActionController(req, res) {
     let widgetId = req.params.widgetId;
     if (!widgetId) {
         return res.status(404).send({ error: 'Not Found' });
     }
-    if (req.adminizer.config.auth.enable) {
-        if (!req.user) {
-            return redirectToLogin(req, res);
-        }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.user)) {
-            return res.sendStatus(403);
-        }
-    }
     let widget = req.adminizer.widgetHandler.getById(widgetId);
     if (widget === undefined) {
         return res.status(404).send({ error: 'Not Found' });
@@ -25,4 +16,5 @@ export async function widgetActionController(req, res) {
             return res.json(error);
         }
     }
+    return res.status(405).end();
 }

package/controllers/widgets/Custom.d.ts

@@ -1 +1 @@
-export declare function widgetCustomController(req: ReqType, res: ResType): Promise<void | ResType>;
+export declare function widgetCustomController(req: ReqType, res: ResType): Promise<ResType>;

package/controllers/widgets/Custom.js

@@ -1,17 +1,8 @@
-import { redirectToLogin } from '../../helpers/inertiaAutHelper.js';
 export async function widgetCustomController(req, res) {
     let widgetId = req.params.widgetId;
     if (!widgetId) {
         return res.status(404).send({ error: 'Not Found' });
     }
-    if (req.adminizer.config.auth.enable) {
-        if (!req.user) {
-            return redirectToLogin(req, res);
-        }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.user)) {
-            return res.sendStatus(403);
-        }
-    }
     let widget = req.adminizer.widgetHandler.getById(widgetId);
     if (widget === undefined) {
         return res.status(404).send({ error: 'Not Found' });
@@ -34,4 +25,5 @@ export async function widgetCustomController(req, res) {
     // 		return res.serverError(e)
     // 	}
     // }
+    return res.status(405).end();
 }

package/controllers/widgets/Info.d.ts

@@ -1 +1 @@
-export declare function widgetInfoController(req: ReqType, res: ResType): Promise<void | ResType>;
+export declare function widgetInfoController(req: ReqType, res: ResType): Promise<ResType>;

package/controllers/widgets/Info.js

@@ -1,17 +1,8 @@
-import { redirectToLogin } from '../../helpers/inertiaAutHelper.js';
 export async function widgetInfoController(req, res) {
     let widgetId = req.params.widgetId;
     if (!widgetId) {
         return res.status(404).send({ error: 'Not Found' });
     }
-    if (req.adminizer.config.auth.enable) {
-        if (!req.user) {
-            return redirectToLogin(req, res);
-        }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.user)) {
-            return res.sendStatus(403);
-        }
-    }
     let widget = req.adminizer.widgetHandler.getById(widgetId);
     if (widget === undefined) {
         return res.status(404).send({ error: 'Not Found' });
@@ -26,4 +17,5 @@ export async function widgetInfoController(req, res) {
             return res.status(500).send({ error: e.message || 'Internal Server Error' });
         }
     }
+    return res.status(405).end();
 }

package/controllers/widgets/filterInfo.d.ts

@@ -0,0 +1 @@
+export declare function widgetFilterInfoController(req: ReqType, res: ResType): Promise<ResType>;

package/controllers/widgets/filterInfo.js

@@ -0,0 +1,44 @@
+import { FilterService } from "../../lib/filters/FilterService.js";
+async function resolveDashboardUser(req) {
+    if (req.user) {
+        return req.user;
+    }
+    const adminLogin = req.adminizer.config.administrator?.login ?? "admin";
+    const userModel = req.adminizer.modelHandler.internal("widgets").get("UserAP");
+    const user = await userModel.findOne({ where: { login: adminLogin } });
+    return user ?? null;
+}
+export async function widgetFilterInfoController(req, res) {
+    const filterId = req.params.filterId;
+    if (!filterId) {
+        return res.status(404).send({ error: req.i18n.__("Not found") });
+    }
+    const user = await resolveDashboardUser(req);
+    if (!user) {
+        return res.status(401).send({ error: req.i18n.__("Unauthorized") });
+    }
+    const filterService = new FilterService(req.adminizer);
+    let filter = null;
+    try {
+        filter = await filterService.getFilterById(filterId, user);
+    }
+    catch {
+        filter = null;
+    }
+    if (!filter || !filterService.canViewFilter(filter, user)) {
+        return res.status(404).send({ error: req.i18n.__("Not found") });
+    }
+    if (!req.adminizer.accessRightsHelper.hasPermission(`read-${filter.modelName}-model`, user)) {
+        return res.sendStatus(403);
+    }
+    if (req.method.toUpperCase() === "GET") {
+        try {
+            const count = await filterService.countFilterResults(filter, user);
+            return res.send(count >= 0 ? String(count) : "-");
+        }
+        catch (e) {
+            return res.status(500).send({ error: e.message || req.i18n.__("Internal server error") });
+        }
+    }
+    return res.status(405).end();
+}

package/controllers/widgets/switch.d.ts

@@ -1 +1 @@
-export declare function widgetSwitchController(req: ReqType, res: ResType): Promise<void | ResType>;
+export declare function widgetSwitchController(req: ReqType, res: ResType): Promise<ResType>;

package/controllers/widgets/switch.js

@@ -1,17 +1,8 @@
-import { redirectToLogin } from '../../helpers/inertiaAutHelper.js';
 export async function widgetSwitchController(req, res) {
     let widgetId = req.params.widgetId;
     if (!widgetId) {
         return res.status(404).send({ error: 'Not Found' });
     }
-    if (req.adminizer.config.auth.enable) {
-        if (!req.user) {
-            return redirectToLogin(req, res);
-        }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widget-${widgetId}`, req.user)) {
-            return res.sendStatus(403);
-        }
-    }
     let widget = req.adminizer.widgetHandler.getById(widgetId);
     if (widget === undefined) {
         return res.status(404).send({ error: 'Not Found' });
@@ -36,4 +27,5 @@ export async function widgetSwitchController(req, res) {
             return res.status(500).send({ error: e.message || 'Internal Server Error' });
         }
     }
+    return res.status(405).end();
 }

package/controllers/widgetsDB.d.ts

@@ -1 +1 @@
-export default function widgetsDB(req: ReqType, res: ResType): Promise<void | ResType>;
+export default function widgetsDB(req: ReqType, res: ResType): Promise<ResType>;

package/controllers/widgetsDB.js

@@ -1,14 +1,7 @@
-import { redirectToLogin } from '../helpers/inertiaAutHelper.js';
 export default async function widgetsDB(req, res) {
     let id = 0;
     let auth = req.adminizer.config.auth.enable;
-    if (auth) {
-        if (!req.user) {
-            return redirectToLogin(req, res);
-        }
-        else if (!req.adminizer.accessRightsHelper.hasPermission(`widgets`, req.user)) {
-            return res.sendStatus(403);
-        }
+    if (req.user) {
         id = req.user.id;
     }
     if (req.method.toUpperCase() === 'GET') {
@@ -34,4 +27,5 @@ export default async function widgetsDB(req, res) {
             return res.status(500).send({ error: e.message || 'Internal Server Error' });
         }
     }
+    return res.status(405).end();
 }

package/helpers/accessRightsHelper.d.ts

@@ -12,7 +12,7 @@ export declare class AccessRightsHelper {
     getTokensByDepartment(department: string): AccessRightsToken[];
     getAllDepartments(): string[];
     enoughPermissions(tokens: string[], user: UserAP): boolean;
-    hasPermission(tokenId: string, user: UserAP): boolean;
+    hasPermission(tokenId: string | undefined, user: UserAP, context?: string): boolean;
 }
 export declare class GroupsAccessRightsHelper {
     static hasAccess(user: UserAP, groupsAccessRights?: string[]): boolean;

package/helpers/accessRightsHelper.js

@@ -45,23 +45,24 @@ export class AccessRightsHelper {
         if (user.isAdministrator) {
             return true;
         }
+        // No tokens required — access granted for all authenticated users
         if (!tokens.length) {
-            return false;
+            return true;
         }
         return tokens.some((token) => this.hasPermission(token, user));
     }
-    hasPermission(tokenId, user) {
+    hasPermission(tokenId, user, context) {
         if (!this.adminizer.config.auth.enable) {
             return true;
         }
         if (user.isAdministrator) {
             return true;
         }
-        tokenId = tokenId.toLowerCase();
         if (!tokenId) {
-            Adminizer.log.warn(`AccessRightsHelper > hasPermission no tokenId: ${tokenId}`);
+            Adminizer.log.warn(`AccessRightsHelper > hasPermission: missing accessRightsToken${context ? ` [${context}]` : ''}`);
             return false;
         }
+        tokenId = tokenId.toLowerCase();
         const tokenIsValid = this._tokens.some((token) => token.id === tokenId);
         if (!tokenIsValid) {
             Adminizer.log.error("Adminpanel > Token is not valid", tokenId, user.login);