adminizer 4.6.0 → 4.7.0-build.221

package/lib/I18n.js

@@ -6,7 +6,10 @@ export class I18n {
     devMode;
     static locales = {};
     defaultLocale;
+    defaultDirectory;
     directory;
+    customDirectory;
+    missingDirectory;
     extension;
     cookieName;
     sessionVarName;
@@ -16,15 +19,27 @@ export class I18n {
     static localeCache = {};
     static resMethods = ["__", "__n", "getLocale", "isPreferredLocale"];
     constructor(options = {}) {
-        this.devMode = process.env.NODE_ENV !== "production";
+        this.devMode = process.env.ADMINIZER_ENV === "dev";
         this.defaultLocale = options.defaultLocale || "en";
-        this.directory = options.directory || path.join(import.meta.filename, '../../translations');
+        const runtimeDefaultTranslationsPath = path.resolve(import.meta.dirname, "../translations");
+        const sourceTranslationsPath = path.resolve(import.meta.dirname, "../../src/translations");
+        this.defaultDirectory = this.devMode
+            ? (fs.existsSync(sourceTranslationsPath) ? sourceTranslationsPath : runtimeDefaultTranslationsPath)
+            : runtimeDefaultTranslationsPath;
+        this.customDirectory = options.directory ? path.resolve(options.directory) : undefined;
+        this.missingDirectory = options.missingDirectory ? path.resolve(options.missingDirectory) : undefined;
+        this.directory = this.customDirectory || this.defaultDirectory;
         this.extension = options.extension || ".json";
         this.cookieName = options.cookieName || "lang";
         this.sessionVarName = options.sessionVarName || "locale";
         this.indent = options.indent || "\t";
         if (options.locales) {
-            options.locales.forEach((locale) => this.readFile(locale));
+            options.locales.forEach((locale) => {
+                this.readFile(locale, this.defaultDirectory);
+                if (this.customDirectory && this.customDirectory !== this.defaultDirectory) {
+                    this.readFile(locale, this.customDirectory);
+                }
+            });
         }
         this.setLocale(this.defaultLocale);
     }
@@ -75,16 +90,17 @@ export class I18n {
         const localeDictionary = I18n.locales[locale] || {};
         const translation = localeDictionary[singular];
         if (!translation && this.devMode) {
-            I18n.locales[locale] = I18n.locales[locale] || {};
-            I18n.locales[locale][singular] = plural ? { one: singular, other: plural } : singular;
-            this.writeFile(locale);
+            this.writeMissingTranslation(locale, singular, plural);
         }
         return translation || (plural ? { one: singular, other: plural } : singular);
     }
-    readFile(locale) {
-        const file = this.locateFile(locale);
+    readFile(locale, directory = this.directory) {
+        const file = this.locateFile(locale, directory);
         if (!this.devMode && I18n.localeCache[file]) {
-            I18n.locales[locale] = I18n.localeCache[file];
+            I18n.locales[locale] = {
+                ...(I18n.locales[locale] || {}),
+                ...I18n.localeCache[file]
+            };
             return;
         }
         try {
@@ -95,34 +111,44 @@ export class I18n {
                 ...parsed
             };
             if (!this.devMode) {
-                I18n.localeCache[file] = I18n.locales[locale];
+                I18n.localeCache[file] = parsed;
             }
         }
         catch (error) {
             if (this.devMode) {
                 Adminizer.log.warn(`Failed to read locale file ${file}:`, error);
             }
-            I18n.locales[locale] = {};
+            I18n.locales[locale] = I18n.locales[locale] || {};
         }
     }
-    writeFile(locale) {
-        if (!this.devMode)
+    locateFile(locale, directory = this.directory) {
+        return path.normalize(`${directory}/${locale}${this.extension}`);
+    }
+    writeMissingTranslation(locale, singular, plural) {
+        if (!this.missingDirectory)
             return;
-        const file = this.locateFile(locale);
+        const file = this.locateFile(locale, this.missingDirectory);
         const tmpFile = `${file}.tmp`;
         const dir = path.dirname(file);
+        const value = plural ? { one: singular, other: plural } : singular;
         try {
             fs.mkdirSync(dir, { recursive: true });
-            fs.writeFileSync(tmpFile, JSON.stringify(I18n.locales[locale], null, this.indent), "utf8");
+            let missingTranslations = {};
+            if (fs.existsSync(file)) {
+                const data = fs.readFileSync(file, "utf8");
+                missingTranslations = JSON.parse(data);
+            }
+            if (Object.prototype.hasOwnProperty.call(missingTranslations, singular)) {
+                return;
+            }
+            missingTranslations[singular] = value;
+            fs.writeFileSync(tmpFile, JSON.stringify(missingTranslations, null, this.indent), "utf8");
             fs.renameSync(tmpFile, file);
         }
         catch (error) {
-            Adminizer.log.error(`Failed to write locale file ${file}:`, error);
+            Adminizer.log.error(`Failed to write missing translation file ${file}:`, error);
         }
     }
-    locateFile(locale) {
-        return path.normalize(`${this.directory}/${locale}${this.extension}`);
-    }
     static appendLocale(locale, data) {
         I18n.locales[locale] = { ...I18n.locales[locale], ...data };
     }

package/lib/MiddlewareManager.d.ts

@@ -0,0 +1,8 @@
+import { Adminizer } from "./Adminizer";
+declare class MiddlewareManager {
+    private readonly _adminizer;
+    constructor(adminizer: Adminizer);
+    loadMiddlewares(): Promise<void>;
+    bindMiddlewares(middleware: MiddlewareType[], action: MiddlewareType): MiddlewareType[];
+}
+export default MiddlewareManager;

package/lib/MiddlewareManager.js

@@ -0,0 +1,53 @@
+import * as fs from "fs";
+import * as path from "path";
+import { Adminizer } from "./Adminizer.js";
+import { pathToFileURL } from "url";
+class MiddlewareManager {
+    _adminizer;
+    constructor(adminizer) {
+        this._adminizer = adminizer;
+    }
+    async loadMiddlewares() {
+        try {
+            const middlewaresDirPath = path.join(import.meta.dirname, "../middlewares");
+            const middlewaresDir = fs.readdirSync(middlewaresDirPath);
+            for (const middlewareFile of middlewaresDir) {
+                if (path.extname(middlewareFile).toLowerCase() === ".js") {
+                    const middlewarePath = path.join(middlewaresDirPath, middlewareFile);
+                    const middleware = (await import(pathToFileURL(middlewarePath).href)).default;
+                    if (typeof middleware === "function" &&
+                        Array.isArray(this._adminizer.config.middlewares)) {
+                        this._adminizer.config.middlewares.push(middleware);
+                    }
+                    else {
+                        Adminizer.log.error(`Adminizer > Middleware ${middlewareFile} is not a function`);
+                    }
+                }
+            }
+            Adminizer.log.info("Adminizer middlewares loaded");
+        }
+        catch (e) {
+            Adminizer.log.error("Adminizer > Could not load middlewares", e);
+        }
+    }
+    bindMiddlewares(middleware, action) {
+        const result = [];
+        const bindMiddleware = (middleware) => {
+            if (typeof middleware === "function") {
+                result.push(middleware);
+            }
+            else {
+                Adminizer.log.error("AdminPanel: Middleware format unknown: " + middleware);
+            }
+        };
+        if (Array.isArray(middleware)) {
+            middleware.forEach(bindMiddleware);
+        }
+        else {
+            bindMiddleware(middleware);
+        }
+        result.push(action);
+        return result;
+    }
+}
+export default MiddlewareManager;

package/lib/ai-assistant/OpenAiModelService.d.ts

@@ -3,9 +3,9 @@ import { AiAssistantMessage } from '../../interfaces/types';
 import { UserAP } from '../../models/UserAP';
 import { Adminizer } from '../Adminizer';
 import { ActionType } from '../../interfaces/adminpanelConfig';
-import { Entity } from '../../interfaces/types';
+import { ModelResource } from '../../interfaces/types';
 import { DataAccessor } from '../DataAccessor';
-type DataAccessorFactory = (entity: Entity, user: UserAP, action: ActionType) => DataAccessor;
+type DataAccessorFactory = (modelResource: ModelResource, user: UserAP, action: ActionType) => DataAccessor;
 export declare class OpenAiModelService extends AbstractAiModelService {
     private readonly createAccessor;
     constructor(adminizer: Adminizer, accessorFactory?: DataAccessorFactory);
@@ -13,7 +13,7 @@ export declare class OpenAiModelService extends AbstractAiModelService {
     private handleCreate;
     private parseInstruction;
     private usageMessage;
-    private resolveEntity;
+    private resolveModelResource;
     private normalizeModelConfig;
     private userHasPermission;
     private getPermissionToken;

package/lib/ai-assistant/OpenAiModelService.js

@@ -16,7 +16,7 @@ export class OpenAiModelService extends AbstractAiModelService {
             name: 'OpenAI fixture agent',
             description: 'Executes structured commands with DataAccessor using the current user permissions.',
         });
-        this.createAccessor = accessorFactory ?? ((entity, user, action) => new DataAccessor(adminizer, user, entity, action));
+        this.createAccessor = accessorFactory ?? ((modelResource, user, action) => new DataAccessor(adminizer, user, modelResource, action));
     }
     async generateReply(prompt, _history, user) {
         const instruction = this.parseInstruction(prompt);
@@ -31,28 +31,28 @@ export class OpenAiModelService extends AbstractAiModelService {
         }
     }
     async handleCreate(instruction, user) {
-        const entity = this.resolveEntity(instruction.entity);
-        if (!entity || !entity.model) {
-            return `Model "${instruction.entity}" is not available in this project.`;
+        const modelResource = this.resolveModelResource(instruction.modelResource);
+        if (!modelResource || !modelResource.model) {
+            return `Model "${instruction.modelResource}" is not available in this project.`;
         }
-        if (!this.userHasPermission(entity, user, 'add')) {
-            return `User "${user.login}" does not have permission to create ${entity.name} records.`;
+        if (!this.userHasPermission(modelResource, user, 'add')) {
+            return `User "${user.login}" does not have permission to create ${modelResource.name} records.`;
         }
         if (!instruction.payload || typeof instruction.payload !== 'object') {
             return 'The "create" action requires a "data" object with field values.';
         }
         try {
-            const accessor = this.createAccessor(entity, user, 'add');
-            const created = await entity.model.create(instruction.payload, accessor);
+            const accessor = this.createAccessor(modelResource, user, 'add');
+            const created = await modelResource.model.create(instruction.payload, accessor);
             const preview = JSON.stringify(created, null, 2);
-            const recordId = this.extractPrimaryKey(created, entity);
+            const recordId = this.extractPrimaryKey(created, modelResource);
             const idMessage = recordId !== undefined ? ` (id: ${recordId})` : '';
-            return `Record created in ${entity.name}${idMessage}:\n${preview}`;
+            return `Record created in ${modelResource.name}${idMessage}:\n${preview}`;
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
             Adminizer.log.error('OpenAI agent failed to create record', error);
-            return `Failed to create ${entity.name} record: ${message}`;
+            return `Failed to create ${modelResource.name} record: ${message}`;
         }
     }
     parseInstruction(prompt) {
@@ -69,15 +69,15 @@ export class OpenAiModelService extends AbstractAiModelService {
             if (!['create', 'list', 'update', 'delete'].includes(action)) {
                 return null;
             }
-            const entity = this.extractString(parsed, ['entity', 'model']);
-            if (!entity) {
+            const modelResource = this.extractString(parsed, ['modelResource', 'model']);
+            if (!modelResource) {
                 return null;
             }
             const payload = this.extractObject(parsed, ['data', 'payload', 'record']);
             const criteria = this.extractObject(parsed, ['criteria', 'where', 'filter']);
             return {
                 action: action,
-                entity,
+                modelResource,
                 payload,
                 criteria,
             };
@@ -93,14 +93,14 @@ export class OpenAiModelService extends AbstractAiModelService {
             '```json',
             '{',
             '  "action": "create",',
-            '  "entity": "Example",',
+            '  "modelResource": "Example",',
             '  "data": { "title": "Hello from the agent" }',
             '}',
             '```',
             'The agent uses DataAccessor, so any field-level restrictions from your account are respected.',
         ].join('\n');
     }
-    resolveEntity(modelName) {
+    resolveModelResource(modelName) {
         const models = this.adminizer.config.models;
         if (!models) {
             return null;
@@ -127,7 +127,6 @@ export class OpenAiModelService extends AbstractAiModelService {
         return {
             name: configName,
             uri: `${this.adminizer.config.routePrefix}/model/${configName}`,
-            type: 'model',
             config: normalizedConfig,
             model,
         };
@@ -148,20 +147,20 @@ export class OpenAiModelService extends AbstractAiModelService {
         }
         return { ...baseConfig, ...config };
     }
-    userHasPermission(entity, user, action) {
-        const token = this.getPermissionToken(entity, action);
+    userHasPermission(modelResource, user, action) {
+        const token = this.getPermissionToken(modelResource, action);
         return this.adminizer.accessRightsHelper.hasPermission(token, user);
     }
-    getPermissionToken(entity, action) {
+    getPermissionToken(modelResource, action) {
         const verb = ACTION_TOKENS[action];
-        const modelName = entity.model?.modelname ?? entity.config?.model ?? entity.name;
-        return `${verb}-${modelName}-${entity.type}`.toLowerCase();
+        const modelName = modelResource.model?.modelname ?? modelResource.config?.model ?? modelResource.name;
+        return `${verb}-${modelName}-model`.toLowerCase();
     }
-    extractPrimaryKey(record, entity) {
+    extractPrimaryKey(record, modelResource) {
         if (!record) {
             return undefined;
         }
-        const primaryKey = entity.model?.primaryKey ?? 'id';
+        const primaryKey = modelResource.model?.primaryKey ?? 'id';
         return record[primaryKey];
     }
     extractString(source, keys) {

package/lib/catalog/Navigation.d.ts

@@ -14,6 +14,7 @@ export declare class StorageService {
     protected readonly adminizer: Adminizer;
     readonly ready: Promise<void>;
     constructor(adminizer: Adminizer, id: string, model: string);
+    private navigationModel;
     initModel(): Promise<void>;
     getId(): string;
     buildTree(): Promise<any>;

package/lib/catalog/Navigation.js

@@ -13,17 +13,18 @@ export class StorageService {
         this.model = model.toLowerCase();
         this.ready = this.initModel();
     }
+    navigationModel() {
+        return this.adminizer.modelHandler.internal("navigation").get(this.model);
+    }
     async initModel() {
-        // Direct call by model adapter
-        const navigation = await this.adminizer.modelHandler.model.get(this.model)["_findOne"]({ label: this.id });
+        const navigation = await this.navigationModel().findOne({ where: { label: this.id } });
         if (navigation) {
             Adminizer.log.info(`Found existing navigation: ${this.id}`);
             await this.populateFromTree(navigation.tree);
         }
         else {
             const newNavigation = { label: this.id, tree: [] };
-            // Direct call by model adapter
-            await this.adminizer.modelHandler.model.get(this.model)["_create"](newNavigation);
+            await this.navigationModel().create(newNavigation);
             Adminizer.log.info(`Created a new navigation: ${this.id}`);
         }
     }
@@ -99,8 +100,7 @@ export class StorageService {
     async saveToDB() {
         let tree = await this.buildTree();
         try {
-            // Direct call by model adapter
-            await this.adminizer.modelHandler.model.get(this.model)["_update"]({ label: this.id }, { tree: tree });
+            await this.navigationModel().update({ where: { label: this.id } }, { tree: tree });
         }
         catch (e) {
             console.log(e);
@@ -208,12 +208,14 @@ class NavigationItem extends AbstractItem {
         this.adminizer = adminizer;
         this.storageServices = storageServices;
     }
+    contentModel() {
+        return this.adminizer.modelHandler.internal("navigation").get(this.model);
+    }
     async create(data, catalogId) {
         let storage = this.storageServices.get(catalogId);
         let storageData = null;
         if (data._method === 'select') {
-            // Direct call by model adapter
-            let record = await this.adminizer.modelHandler.model.get(this.model)["_findOne"]({ id: data.record });
+            let record = await this.contentModel().findOne({ where: { id: data.record } });
             storageData = await this.dataPreparation({
                 record: record,
                 parentId: data.parentId,
@@ -275,13 +277,12 @@ class NavigationItem extends AbstractItem {
         return await storage.findElementById(itemId);
     }
     /**
-     * @deprecated reason: migration for intertia
+     * @deprecated reason: transition to Inertia
     * // TODO: need passing custom React module
     */
     async getAddTemplate(req) {
         let type = 'model.link';
-        // Direct call by model adapter
-        let itemsDB = await this.adminizer.modelHandler.model.get(this.model)["_find"]({});
+        let itemsDB = await this.contentModel().find({});
         let items = itemsDB.map((item) => {
             return {
                 id: item.id,

package/lib/controls/jsoneditor/JsonEditor.d.ts

@@ -1,8 +1,7 @@
 import { AbstractControls, ControlType, Path, Config } from "../AbstractControls";
-import { EditorOptions } from "@toast-ui/editor/types/editor";
 import { Adminizer } from "../../Adminizer";
 export declare class JsonEditor extends AbstractControls {
-    readonly config: Partial<EditorOptions>;
+    readonly config: Record<string, string | string[] | object | number | boolean>;
     readonly name: string;
     readonly path: Path;
     readonly type: ControlType;

package/lib/controls/markdown/ToastUiEditor.d.ts

@@ -1,8 +1,7 @@
 import { AbstractControls, ControlType, Path, Config } from "../AbstractControls";
-import { EditorOptions } from "@toast-ui/editor/types/editor";
 import { Adminizer } from "../../Adminizer";
 export declare class ToastUiEditor extends AbstractControls {
-    readonly config: Partial<EditorOptions>;
+    readonly config: Record<string, string | string[] | object | number | boolean>;
     readonly name: string;
     readonly path: Path;
     readonly type: ControlType;

package/lib/feedback/FeedbackHandler.js

@@ -8,8 +8,8 @@ export class FeedbackHandler {
     }
     register(handler) {
         this.handler = handler;
-        const policies = this.adminizer.config.policies ?? [];
-        bindFeedbackController(this.adminizer, policies);
+        const middlewares = this.adminizer.config.middlewares ?? [];
+        bindFeedbackController(this.adminizer, middlewares);
         Adminizer.log.info('FeedbackHandler registered');
     }
     isRegistered() {

package/lib/filters/ConditionValidator.d.ts

@@ -0,0 +1,107 @@
+import { FilterCondition, FilterOperator } from '../../models/FilterAP';
+/**
+ * Security event types for logging suspicious filter attempts
+ */
+export type SecurityEventType = 'MAX_DEPTH_EXCEEDED' | 'TOO_MANY_CONDITIONS' | 'TOO_MANY_TOTAL_CONDITIONS' | 'DANGEROUS_SQL' | 'TOO_MANY_IN_VALUES' | 'STRING_TOO_LONG';
+/**
+ * Security event details for logging
+ */
+export interface SecurityEvent {
+    type: SecurityEventType;
+    conditionId: string;
+    details: string;
+    timestamp: Date;
+    value?: any;
+}
+/**
+ * Logger interface for security events
+ */
+export interface SecurityLogger {
+    warn: (...args: any[]) => void;
+}
+/**
+ * Validation result
+ */
+export interface ValidationResult {
+    valid: boolean;
+    errors: ValidationError[];
+    securityEvents?: SecurityEvent[];
+}
+/**
+ * Validation error
+ */
+export interface ValidationError {
+    conditionId: string;
+    field?: string;
+    message: string;
+    code: string;
+}
+/**
+ * Field configuration for validation
+ */
+export interface FieldConfig {
+    type: string;
+    required?: boolean;
+    maxLength?: number;
+    min?: number;
+    max?: number;
+}
+/**
+ * ConditionValidator - validates filter conditions
+ *
+ * Validates:
+ * - Field existence
+ * - Operator validity for field type
+ * - Value type and format
+ * - Security limits (depth, array size, etc.)
+ *
+ * Security logging:
+ * Set ConditionValidator.logger to enable logging of suspicious attempts
+ */
+export declare class ConditionValidator {
+    private fieldsConfig;
+    private allowedFields?;
+    /**
+     * Static logger for security events
+     * Set this to enable logging of suspicious filter attempts
+     */
+    static logger: SecurityLogger | null;
+    /**
+     * Collected security events during validation
+     */
+    private securityEvents;
+    constructor(fieldsConfig: Record<string, FieldConfig>, allowedFields?: string[]);
+    /**
+     * Validate array of conditions
+     */
+    validate(conditions: FilterCondition[]): ValidationResult;
+    /**
+     * Log a security event (suspicious filter attempt)
+     */
+    private logSecurityEvent;
+    /**
+     * Validate single condition recursively
+     */
+    private validateCondition;
+    /**
+     * Check if operator is valid for field type
+     */
+    private isOperatorValidForType;
+    /**
+     * Validate value for operator and field type
+     */
+    private validateValue;
+    /**
+     * Validate raw SQL for obvious injection attempts
+     */
+    private validateRawSQL;
+    /**
+     * Get list of allowed operators for a field
+     */
+    getOperatorsForField(fieldName: string): FilterOperator[];
+    /**
+     * Get list of allowed operators for a field type
+     */
+    getOperatorsForType(fieldType: string): FilterOperator[];
+}
+export default ConditionValidator;