adminizer 4.6.0 → 4.7.0-build.221

package/system/Router.js

@@ -5,14 +5,23 @@ import _edit from "../controllers/edit.js";
 import _add from "../controllers/add.js";
 import _view from "../controllers/view.js";
 import _remove from "../controllers/remove.js";
+import _inlineUpdate from "../controllers/inlineUpdate.js";
+import _filterFields from "../controllers/filter-fields/filterFields.js";
+import { getSavedFilters, saveFilter, deleteFilter, applyTemporaryFilter, getTemporaryFilter } from "../controllers/filter-fields/savedFilters.js";
+import { getAllUserFilters } from "../controllers/filter-fields/getAllUserFilters.js";
+import { getModelColumns, updateFilterColumns } from "../controllers/filter-fields/columns.js";
+import { getAllGroups } from "../controllers/filter-fields/groups.js";
 import { ckEditorUpload } from "../controllers/ckeditorUpload.js";
-import _form from "../controllers/form.js";
+import _exportData from "../controllers/exportData.js";
+import _feed from "../controllers/feed.js";
+import { getUserApiKey, regenerateUserApiKey } from "../controllers/userApiKey.js";
 import { widgetSwitchController } from "../controllers/widgets/switch.js";
 import _getAllWidgets from "../controllers/getAllWidgets.js";
 import _widgetsDB from "../controllers/widgetsDB.js";
 import { widgetInfoController } from '../controllers/widgets/Info.js';
 import { widgetActionController } from '../controllers/widgets/Action.js';
 import { widgetCustomController } from "../controllers/widgets/Custom.js";
+import { widgetFilterInfoController } from "../controllers/widgets/filterInfo.js";
 import { catalogController } from "../controllers/catalog/Catalog.js";
 import { mediaManagerController } from "../controllers/media-manager/mediaManagerApi.js";
 import { thumbController } from "../controllers/media-manager/ThumbController.js";
@@ -21,6 +30,10 @@ import timezones from "../controllers/timezones.js";
 import { NotificationController } from "../controllers/notifications/NotificationController.js";
 import { AiAssistantController } from "../controllers/ai/AiAssistantController.js";
 import { HistoryController } from "../controllers/history-actions/HistoryController.js";
+import listUserFilters from "../controllers/listUserFilters.js";
+import { requireAnyPermission, requireAuthAPI, requireAuthEnabled, requireAuthUI, requirePermission } from "../policies/authPolicies.js";
+import { aiModelToken, catalogToken, groupFilterVisibilityToken, historyToken, mediaManagerToken, modelCreateToken, modelDeleteToken, modelReadToken, modelUpdateToken, widgetToken, widgetsToken } from "../policies/permissionResolvers.js";
+import { bindWithMiddlewares } from "./routePolicies.js";
 export default class Router {
     adminizer;
     constructor(adminizer) {
@@ -47,7 +60,8 @@ export default class Router {
          * List or one policy that should be bound to actions
          * @type {MiddlewareType[]}
          */
-        let policies = adminizer.config.policies;
+        let middlewares = adminizer.config.middlewares;
+        const withPolicies = (action, ...policies) => bindWithMiddlewares(adminizer, middlewares, action, policies);
         /**
          * Prevent stale/cached admin API responses.
          * This protects JSON endpoints from browser/proxy cache and avoids
@@ -80,138 +94,201 @@ export default class Router {
         /**
          * Widgets All
          */
-        adminizer.app.all(`${adminizer.config.routePrefix}/widgets-get-all`, adminizer.policyManager.bindPolicies(policies, _getAllWidgets));
+        adminizer.app.all(`${adminizer.config.routePrefix}/widgets-get-all`, withPolicies(_getAllWidgets, requireAuthUI(), requirePermission(widgetsToken, { mode: "ui" })));
         /**
          * Widgets All from DB
          */
-        adminizer.app.all(`${adminizer.config.routePrefix}/widgets-get-all-db`, adminizer.policyManager.bindPolicies(policies, _widgetsDB));
+        adminizer.app.all(`${adminizer.config.routePrefix}/widgets-get-all-db`, withPolicies(_widgetsDB, requireAuthUI(), requirePermission(widgetsToken, { mode: "ui" })));
         /**
          * Widgets Switch
          */
-        adminizer.app.all(`${adminizer.config.routePrefix}/widgets-switch/:widgetId`, adminizer.policyManager.bindPolicies(policies, widgetSwitchController));
+        adminizer.app.all(`${adminizer.config.routePrefix}/widgets-switch/:widgetId`, withPolicies(widgetSwitchController, requireAuthUI(), requirePermission(widgetToken, { mode: "ui" })));
         /**
          * Widgets Info
          */
-        adminizer.app.all(`${adminizer.config.routePrefix}/widgets-info/:widgetId`, adminizer.policyManager.bindPolicies(policies, widgetInfoController));
+        adminizer.app.all(`${adminizer.config.routePrefix}/widgets-info/:widgetId`, withPolicies(widgetInfoController, requireAuthUI(), requirePermission(widgetToken, { mode: "ui" })));
+        /**
+         * Widgets Filter Info (built-in filter widgets)
+         */
+        adminizer.app.all(`${adminizer.config.routePrefix}/widgets-filter-info/:filterId`, withPolicies(widgetFilterInfoController, requireAuthUI(), requirePermission(widgetsToken, { mode: "ui" })));
         /**
          * Widgets Action
          */
-        adminizer.app.all(`${adminizer.config.routePrefix}/widgets-action/:widgetId`, adminizer.policyManager.bindPolicies(policies, widgetActionController));
+        adminizer.app.all(`${adminizer.config.routePrefix}/widgets-action/:widgetId`, withPolicies(widgetActionController, requireAuthUI(), requirePermission(widgetToken, { mode: "ui" })));
         /**
          * Widgets Custom
          */
-        adminizer.app.all(`${adminizer.config.routePrefix}/widgets-action/:widgetId`, adminizer.policyManager.bindPolicies(policies, widgetCustomController));
-        /**
-         * Edit form
-         * */
-        adminizer.app.all(`${adminizer.config.routePrefix}/form/:slug`, adminizer.policyManager.bindPolicies(policies, _form));
+        adminizer.app.all(`${adminizer.config.routePrefix}/widgets-action/:widgetId`, withPolicies(widgetCustomController, requireAuthUI(), requirePermission(widgetToken, { mode: "ui" })));
         /**
-         *  Create a base entity route
+         *  Create a base ModelResource route
          */
-        let baseRoute = `${adminizer.config.routePrefix}/:entityType(form|model)/:entityName`;
+        const resourceRoute = (suffix = '') => `${adminizer.config.routePrefix}/model/:modelResourceName${suffix}`;
         /**
          * Catalog
          */
-        adminizer.app.all(`${adminizer.config.routePrefix}/catalog/:slug/:id`, adminizer.policyManager.bindPolicies(policies, catalogController));
-        adminizer.app.all(`${adminizer.config.routePrefix}/catalog/:slug`, adminizer.policyManager.bindPolicies(policies, catalogController));
+        adminizer.app.all(`${adminizer.config.routePrefix}/catalog/:slug/:id`, withPolicies(catalogController, requireAuthUI(), requirePermission(catalogToken, { mode: "ui" })));
+        adminizer.app.all(`${adminizer.config.routePrefix}/catalog/:slug`, withPolicies(catalogController, requireAuthUI(), requirePermission(catalogToken, { mode: "ui" })));
         /**
          * Media Manager
          */
-        adminizer.app.post(`${adminizer.config.routePrefix}/media-manager-uploader/:id/upload`, adminizer.policyManager.bindPolicies(policies, mediaManagerController));
-        adminizer.app.post(`${adminizer.config.routePrefix}/media-manager-uploader/:id/upload-variant`, adminizer.policyManager.bindPolicies(policies, mediaManagerController));
-        adminizer.app.all(`${adminizer.config.routePrefix}/media-manager-uploader/:id`, adminizer.policyManager.bindPolicies(policies, mediaManagerController));
-        adminizer.app.all(`${adminizer.config.routePrefix}/get-thumbs`, adminizer.policyManager.bindPolicies(policies, thumbController));
+        adminizer.app.post(`${adminizer.config.routePrefix}/media-manager-uploader/:id/upload`, withPolicies(mediaManagerController, requireAuthUI(), requirePermission(mediaManagerToken, { mode: "ui" })));
+        adminizer.app.post(`${adminizer.config.routePrefix}/media-manager-uploader/:id/upload-variant`, withPolicies(mediaManagerController, requireAuthUI(), requirePermission(mediaManagerToken, { mode: "ui" })));
+        adminizer.app.all(`${adminizer.config.routePrefix}/media-manager-uploader/:id`, withPolicies(mediaManagerController, requireAuthUI(), requirePermission(mediaManagerToken, { mode: "ui" })));
+        adminizer.app.all(`${adminizer.config.routePrefix}/get-thumbs`, adminizer.middlewareManager.bindMiddlewares(middlewares, thumbController));
         /**
          * Upload images CKeditor5
          */
-        adminizer.app.post(`${baseRoute}/ckeditor5/upload`, adminizer.policyManager.bindPolicies(policies, ckEditorUpload));
+        adminizer.app.post(resourceRoute('/ckeditor5/upload'), withPolicies(ckEditorUpload, requireAuthUI(), requireAnyPermission([
+            modelUpdateToken,
+            modelCreateToken,
+        ], { mode: "ui" })));
         /**
          * Notifications
          */
         if (adminizer.config.notifications.enabled) {
-            adminizer.app.get(`${adminizer.config.routePrefix}/notifications`, adminizer.policyManager.bindPolicies(policies, NotificationController.viewAll));
-            adminizer.app.post(`${adminizer.config.routePrefix}/notifications`, adminizer.policyManager.bindPolicies(policies, NotificationController.viewAll));
-            adminizer.app.get(`${adminizer.config.routePrefix}/notifications/api/stream`, adminizer.policyManager.bindPolicies(policies, NotificationController.getNotificationsStream));
-            adminizer.app.get(`${adminizer.config.routePrefix}/notifications/api/get-classes`, adminizer.policyManager.bindPolicies(policies, NotificationController.getNotificationClasses));
-            adminizer.app.get(`${adminizer.config.routePrefix}/notifications/api/:notificationClass`, adminizer.policyManager.bindPolicies(policies, NotificationController.getNotificationsByClass));
-            adminizer.app.get(`${adminizer.config.routePrefix}/notifications/api`, adminizer.policyManager.bindPolicies(policies, NotificationController.getUserNotifications));
-            adminizer.app.put(`${adminizer.config.routePrefix}/notifications/api/:notificationClass/:id/read`, adminizer.policyManager.bindPolicies(policies, NotificationController.markAsRead));
-            adminizer.app.put(`${adminizer.config.routePrefix}/notifications/api/read-all`, adminizer.policyManager.bindPolicies(policies, NotificationController.markAllAsRead));
-            adminizer.app.post(`${adminizer.config.routePrefix}/notifications/api/search`, adminizer.policyManager.bindPolicies(policies, NotificationController.search));
+            adminizer.app.get(`${adminizer.config.routePrefix}/notifications`, withPolicies(NotificationController.viewAll, requireAuthUI()));
+            adminizer.app.get(`${adminizer.config.routePrefix}/notifications/api/stream`, withPolicies(NotificationController.getNotificationsStream, requireAuthAPI()));
+            adminizer.app.get(`${adminizer.config.routePrefix}/notifications/api/get-classes`, withPolicies(NotificationController.getNotificationClasses, requireAuthAPI()));
+            adminizer.app.get(`${adminizer.config.routePrefix}/notifications/api/:notificationClass`, withPolicies(NotificationController.getNotificationsByClass, requireAuthAPI()));
+            adminizer.app.get(`${adminizer.config.routePrefix}/notifications/api`, withPolicies(NotificationController.getUserNotifications, requireAuthAPI()));
+            adminizer.app.put(`${adminizer.config.routePrefix}/notifications/api/:notificationClass/:id/read`, withPolicies(NotificationController.markAsRead, requireAuthAPI()));
+            adminizer.app.put(`${adminizer.config.routePrefix}/notifications/api/read-all`, withPolicies(NotificationController.markAllAsRead, requireAuthAPI()));
+            adminizer.app.post(`${adminizer.config.routePrefix}/notifications/api/search`, withPolicies(NotificationController.search, requireAuthAPI()));
         }
         /**
          * History-actions
          */
         if (adminizer.config.history?.enabled) {
-            adminizer.app.get(`${adminizer.config.routePrefix}/history/view-all`, adminizer.policyManager.bindPolicies(policies, HistoryController.index));
-            adminizer.app.post(`${adminizer.config.routePrefix}/history/view-all`, adminizer.policyManager.bindPolicies(policies, HistoryController.index));
-            adminizer.app.post(`${adminizer.config.routePrefix}/history/get-model-history`, adminizer.policyManager.bindPolicies(policies, HistoryController.getAllModelHistory));
-            adminizer.app.post(`${adminizer.config.routePrefix}/history/get-model-fields`, adminizer.policyManager.bindPolicies(policies, HistoryController.getModelFieldsHistory));
+            adminizer.app.get(`${adminizer.config.routePrefix}/history/view-all`, withPolicies(HistoryController.index, requireAuthUI(), requirePermission(historyToken, { mode: "ui" })));
+            adminizer.app.post(`${adminizer.config.routePrefix}/history/view-all`, withPolicies(HistoryController.index, requireAuthAPI(), requirePermission(historyToken)));
+            adminizer.app.post(`${adminizer.config.routePrefix}/history/get-model-history`, withPolicies(HistoryController.getAllModelHistory, requireAuthAPI(), requirePermission(historyToken)));
+            adminizer.app.post(`${adminizer.config.routePrefix}/history/get-model-fields`, withPolicies(HistoryController.getModelFieldsHistory, requireAuthAPI(), requirePermission(historyToken)));
         }
         if (adminizer.config.aiAssistant?.enabled) {
-            adminizer.app.get(`${adminizer.config.routePrefix}/api/ai-assistant/models`, adminizer.policyManager.bindPolicies(policies, AiAssistantController.getModels));
-            adminizer.app.get(`${adminizer.config.routePrefix}/api/ai-assistant/history/:modelId`, adminizer.policyManager.bindPolicies(policies, AiAssistantController.getHistory));
-            adminizer.app.post(`${adminizer.config.routePrefix}/api/ai-assistant/query`, adminizer.policyManager.bindPolicies(policies, AiAssistantController.sendMessage));
-            adminizer.app.delete(`${adminizer.config.routePrefix}/api/ai-assistant/history/:modelId`, adminizer.policyManager.bindPolicies(policies, AiAssistantController.resetHistory));
+            adminizer.app.get(`${adminizer.config.routePrefix}/api/ai-assistant/models`, withPolicies(AiAssistantController.getModels, requireAuthAPI()));
+            adminizer.app.get(`${adminizer.config.routePrefix}/api/ai-assistant/history/:modelId`, withPolicies(AiAssistantController.getHistory, requireAuthAPI(), requirePermission(aiModelToken)));
+            adminizer.app.post(`${adminizer.config.routePrefix}/api/ai-assistant/query`, withPolicies(AiAssistantController.sendMessage, requireAuthAPI(), requirePermission(aiModelToken)));
+            adminizer.app.delete(`${adminizer.config.routePrefix}/api/ai-assistant/history/:modelId`, withPolicies(AiAssistantController.resetHistory, requireAuthAPI(), requirePermission(aiModelToken)));
         }
         /**
          * List of records
          */
-        adminizer.app.all(baseRoute, adminizer.policyManager.bindPolicies(policies, _list));
-        adminizer.app.get(`${adminizer.config.routePrefix}/get-timezones`, adminizer.policyManager.bindPolicies(policies, timezones));
+        adminizer.app.all(resourceRoute(), withPolicies(_list, requireAuthUI(), requirePermission(modelReadToken, { mode: "ui" })));
+        if (adminizer.config.filters?.enabled) {
+            /**
+             * Get filter fields for model
+             */
+            adminizer.app.get(resourceRoute('/filter-fields'), withPolicies(_filterFields, requireAuthAPI(), requirePermission(modelReadToken)));
+            /**
+             * Saved filters
+             */
+            adminizer.app.get(resourceRoute('/saved-filters'), withPolicies(getSavedFilters, requireAuthAPI(), requirePermission(modelReadToken)));
+            adminizer.app.get(resourceRoute('/filter/temporary'), withPolicies(getTemporaryFilter, requireAuthAPI(), requirePermission(modelReadToken)));
+            adminizer.app.post(resourceRoute('/filter'), withPolicies(saveFilter, requireAuthAPI(), requirePermission(modelReadToken)));
+            adminizer.app.post(resourceRoute('/filter/apply'), withPolicies(applyTemporaryFilter, requireAuthAPI(), requirePermission(modelReadToken)));
+            adminizer.app.delete(resourceRoute('/filter/:id'), withPolicies(deleteFilter, requireAuthAPI(), requirePermission(modelReadToken)));
+            /**
+             * Get all groups (for admin filter visibility settings)
+             */
+            adminizer.app.get(`${adminizer.config.routePrefix}/groups`, withPolicies(getAllGroups, requireAuthAPI(), requirePermission(groupFilterVisibilityToken)));
+            /**
+             * Export data (JSON, CSV, XLSX)
+             */
+            adminizer.app.post(resourceRoute('/export'), withPolicies(_exportData, requireAuthAPI(), requirePermission(modelReadToken)));
+            /**
+             * Public feed API — export by apiKey without auth
+             * GET /adminizer/api/feed/:apiKey.json
+             * GET /adminizer/api/feed/:apiKey.xml
+             */
+            adminizer.app.get(`${adminizer.config.routePrefix}/api/feed/:apiKey.:format`, _feed);
+            // Also support without extension (defaults to JSON)
+            adminizer.app.get(`${adminizer.config.routePrefix}/api/feed/:apiKey`, _feed);
+            /**
+             * User Filters — list all filters accessible to the current user across all models
+             */
+            adminizer.app.get(`${adminizer.config.routePrefix}/api/all-user-filters`, withPolicies(getAllUserFilters, requireAuthAPI()));
+            adminizer.app.all(`${adminizer.config.routePrefix}/user-filters`, withPolicies(listUserFilters, requireAuthUI()));
+            /**
+            * Get model columns (available columns for the model)
+            */
+            adminizer.app.get(resourceRoute('/columns'), withPolicies(getModelColumns, requireAuthAPI(), requirePermission(modelReadToken)));
+            /**
+             * Update filter columns configuration
+             */
+            adminizer.app.post(resourceRoute('/filter/:filterId/columns'), withPolicies(updateFilterColumns, requireAuthAPI(), requirePermission(modelReadToken)));
+        }
+        /**
+         * User API Key management
+         * GET /adminizer/api/user-key — returns current user's API key
+         * POST /adminizer/api/user-key/regenerate — regenerates the API key
+         */
+        adminizer.app.get(`${adminizer.config.routePrefix}/api/user-key`, withPolicies(getUserApiKey, requireAuthEnabled(), requireAuthAPI()));
+        adminizer.app.post(`${adminizer.config.routePrefix}/api/user-key/regenerate`, withPolicies(regenerateUserApiKey, requireAuthEnabled(), requireAuthAPI()));
+        adminizer.app.get(`${adminizer.config.routePrefix}/get-timezones`, withPolicies(timezones, requireAuthUI()));
         if (adminizer.config.models) {
             for (let model in adminizer.config.models) {
-                await this.bindModelRoutes(model, policies);
+                await this.bindModelRoutes(model, middlewares);
             }
         }
+        /**
+         * Inline update field in list view
+         */
+        adminizer.app.patch(resourceRoute('/inline/:id'), withPolicies(_inlineUpdate, requireAuthAPI(), requirePermission(modelUpdateToken)));
         /**
          * View record details
          */
-        adminizer.app.all(baseRoute + "/view/:id", adminizer.policyManager.bindPolicies(policies, _view));
+        adminizer.app.all(resourceRoute('/view/:id'), withPolicies(_view, requireAuthUI(), requirePermission(modelReadToken, { mode: "ui" })));
         /**
          * Remove record
          */
-        adminizer.app.all(baseRoute + "/remove/:id", adminizer.policyManager.bindPolicies(policies, _remove));
+        adminizer.app.all(resourceRoute('/remove/:id'), withPolicies(_remove, requireAuthUI(), requirePermission(modelDeleteToken, { mode: "ui" })));
         /**
          * Create a default dashboard
          */
         if (adminizer.config.dashboard) {
-            adminizer.app.all(adminizer.config.routePrefix, adminizer.policyManager.bindPolicies(policies, _dashboard));
+            adminizer.app.all(adminizer.config.routePrefix, withPolicies(_dashboard, requireAuthUI()));
         }
         else {
-            adminizer.app.all(adminizer.config.routePrefix, adminizer.policyManager.bindPolicies(policies, _welcome));
+            adminizer.app.all(adminizer.config.routePrefix, withPolicies(_welcome, requireAuthUI()));
         }
         // TODO emit can be used in tests
         adminizer.emitter.emit("router:bound");
     }
     unbindModelRoutes(model) {
-        if (!this.adminizer.app._router)
+        const routerStack = this.getRouterStack();
+        if (!routerStack)
             return;
         const patterns = this.modelRoutePatterns.get(model);
         if (!patterns?.length)
             return;
         const removedPaths = [];
-        this.adminizer.app._router.stack = this.adminizer.app._router.stack.filter((layer) => {
+        const filteredStack = routerStack.filter((layer) => {
             if (layer.route && patterns.some((p) => p.test(layer.route.path))) {
                 removedPaths.push(layer.route.path);
                 return false;
             }
             return true;
         });
+        routerStack.splice(0, routerStack.length, ...filteredStack);
         this.modelRoutePatterns.delete(model);
         Adminizer.log.debug(`Adminpanel removed routes for model \`${model}\`: ${removedPaths.join(', ')}`);
     }
+    getRouterStack() {
+        const app = this.adminizer.app;
+        const router = app.router ?? app._router;
+        return Array.isArray(router?.stack) ? router.stack : null;
+    }
     async bindModelRoutes(model, policies) {
         if (!policies)
-            policies = this.adminizer.config.policies;
+            policies = this.adminizer.config.middlewares;
         if (this.modelRoutePatterns.has(model)) {
             this.unbindModelRoutes(model);
         }
         const modelConfig = this.adminizer.config.models[model];
         const prefix = `${this.adminizer.config.routePrefix}/model/${model}`;
         const registeredPaths = [];
-        const register = (path, handler) => {
-            this.adminizer.app.all(path, this.adminizer.policyManager.bindPolicies(policies, handler));
+        const register = (path, handler, policies = []) => {
+            this.adminizer.app.all(path, bindWithMiddlewares(this.adminizer, policies, handler, policies));
             const patterns = this.modelRoutePatterns.get(model) ?? [];
             patterns.push(new RegExp(`^${path.replace(/:[^/]+/g, '[^/]+')}$`));
             this.modelRoutePatterns.set(model, patterns);
@@ -219,9 +296,9 @@ export default class Router {
         };
         if (typeof modelConfig === "boolean" && modelConfig === true) {
             Adminizer.log.debug(`Adminpanel create CRUD routes for \`${model}\` by boolean true`);
-            register(`${prefix}/add`, _add);
-            register(`${prefix}/edit/:id`, _edit);
-            register(`${prefix}/remove/:id`, _remove);
+            register(`${prefix}/add`, _add, [requireAuthUI(), requirePermission(() => `create-${model}-model`, { mode: "ui" })]);
+            register(`${prefix}/edit/:id`, _edit, [requireAuthUI(), requirePermission(() => `update-${model}-model`, { mode: "ui" })]);
+            register(`${prefix}/remove/:id`, _remove, [requireAuthUI(), requirePermission(() => `delete-${model}-model`, { mode: "ui" })]);
         }
         else if (modelConfig !== undefined && typeof modelConfig !== "boolean") {
             Adminizer.log.debug(`Adminpanel create CRUD routes for \`${model}\` by ModelConfig`);
@@ -232,14 +309,14 @@ export default class Router {
             if (addHandler?.controller) {
                 if (typeof addHandler.controller === 'string') {
                     let controller = await import(addHandler.controller);
-                    register(`${prefix}/add`, controller.default);
+                    register(`${prefix}/add`, controller.default, [requireAuthUI(), requirePermission(() => `create-${model}-model`, { mode: "ui" })]);
                 }
                 else {
-                    register(`${prefix}/add`, addHandler.controller);
+                    register(`${prefix}/add`, addHandler.controller, [requireAuthUI(), requirePermission(() => `create-${model}-model`, { mode: "ui" })]);
                 }
             }
             else {
-                register(`${prefix}/add`, _add);
+                register(`${prefix}/add`, _add, [requireAuthUI(), requirePermission(() => `create-${model}-model`, { mode: "ui" })]);
             }
             /**
              * Edit existing record
@@ -248,14 +325,14 @@ export default class Router {
             if (editHandler?.controller) {
                 if (typeof editHandler.controller === 'string') {
                     let controller = await import(editHandler.controller);
-                    register(`${prefix}/edit/:id`, controller.default);
+                    register(`${prefix}/edit/:id`, controller.default, [requireAuthUI(), requirePermission(() => `update-${model}-model`, { mode: "ui" })]);
                 }
                 else {
-                    register(`${prefix}/edit/:id`, editHandler.controller);
+                    register(`${prefix}/edit/:id`, editHandler.controller, [requireAuthUI(), requirePermission(() => `update-${model}-model`, { mode: "ui" })]);
                 }
             }
             else {
-                register(`${prefix}/edit/:id`, _edit);
+                register(`${prefix}/edit/:id`, _edit, [requireAuthUI(), requirePermission(() => `update-${model}-model`, { mode: "ui" })]);
             }
         }
         else {

package/system/bindAccessRights.js

@@ -1,3 +1,4 @@
+import { GROUP_FILTER_VISIBILITY_TOKEN } from "../policies/permissionResolvers.js";
 export default async function bindAccessRights(adminizer) {
     if (adminizer.config.models) {
         let models = adminizer.config.models;
@@ -8,32 +9,6 @@ export default async function bindAccessRights(adminizer) {
             }
         }
     }
-    if (adminizer.config.forms && adminizer.config.forms.data) {
-        let forms = adminizer.config.forms.data;
-        for (let key of Object.keys(forms)) {
-            let department = `Form ${key}`;
-            // create
-            adminizer.accessRightsHelper.registerToken({
-                id: `create-${key}-form`, name: "Create",
-                description: "Access to creating form in database", department: department
-            });
-            // read
-            adminizer.accessRightsHelper.registerToken({
-                id: `read-${key}-form`, name: "Read",
-                description: "Access to reading form in database", department: department
-            });
-            // update
-            adminizer.accessRightsHelper.registerToken({
-                id: `update-${key}-form`, name: "Update",
-                description: "Access to updating form in database", department: department
-            });
-            // delete
-            adminizer.accessRightsHelper.registerToken({
-                id: `delete-${key}-form`, name: "Delete",
-                description: "Access to deleting form in database", department: department
-            });
-        }
-    }
     // Widgets
     adminizer.accessRightsHelper.registerToken({
         id: `widgets`, name: "Widgets",
@@ -46,13 +21,19 @@ export default async function bindAccessRights(adminizer) {
         description: "Are users allowed to log in to the admin panel?",
         department: "Admin panel"
     });
+    // Filters
+    adminizer.accessRightsHelper.registerToken({
+        id: GROUP_FILTER_VISIBILITY_TOKEN,
+        name: "Manage group filter visibility",
+        description: "Allows setting saved filter visibility to selected groups",
+        department: "Filters"
+    });
     // Default user group
     if (adminizer.config.registration && adminizer.config.registration.enable) {
-        // TODO refactor CRUD functions for DataAccessor usage
-        let defaultUserGroupRecord = await adminizer.modelHandler.model.get("GroupAP")["_findOne"]({ name: adminizer.config.registration.defaultUserGroup });
+        const groupModel = adminizer.modelHandler.internal("access-rights").get("GroupAP");
+        let defaultUserGroupRecord = await groupModel.findOne({ where: { name: adminizer.config.registration.defaultUserGroup } });
         if (!defaultUserGroupRecord) {
-            // TODO refactor CRUD functions for DataAccessor usage
-            await adminizer.modelHandler.model.get("GroupAP")?.["_create"]({
+            await groupModel.create({
                 name: adminizer.config.registration.defaultUserGroup,
                 description: "Group for default users (guests) who dont have access to fields"
             });

package/system/bindAuthorization.js

@@ -3,11 +3,12 @@ import _register from "../controllers/register.js";
 import _initUser from "../controllers/initUser.js";
 import { Adminizer } from "../lib/Adminizer.js";
 import { generate } from "password-hash";
+import { generateUserApiKey } from "../helpers/apiKeyHelper.js";
 export default async function bindAuthorization(adminizer) {
+    const userModel = adminizer.modelHandler.internal("auth").get("UserAP");
     let admins;
     try {
-        // TODO refactor CRUD functions for DataAccessor usage
-        admins = await adminizer.modelHandler.model.get("UserAP")?.["_find"]({ isAdministrator: true });
+        admins = await userModel.find({ where: { isAdministrator: true } });
     }
     catch (e) {
         Adminizer.log.error("Error trying to find administrator", e);
@@ -16,8 +17,8 @@ export default async function bindAuthorization(adminizer) {
     /**
      * Router
      */
-    let policies = adminizer.config.policies;
-    let baseRoute = `${adminizer.config.routePrefix}/model/:entity`;
+    let policies = adminizer.config.middlewares;
+    let baseRoute = `${adminizer.config.routePrefix}/model/:modelResourceName`;
     let adminsCredentials = [];
     // if we have administrator profiles
     let config = adminizer.config;
@@ -45,14 +46,14 @@ export default async function bindAuthorization(adminizer) {
         try {
             let passwordHashed = generate(adminData.login + adminData.password + process.env.AP_PASSWORD_SALT);
             let password = 'masked';
-            // TODO refactor CRUD functions for DataAccessor usage
-            await adminizer.modelHandler.model.get("UserAP")?.["_create"]({
+            await userModel.create({
                 login: adminData.login, passwordHashed: passwordHashed, fullName: "Administrator",
-                isActive: true, isAdministrator: true
+                isActive: true, isAdministrator: true,
+                apiKey: generateUserApiKey()
             });
         }
         catch (e) {
-            Adminizer.log.error("Could not create administrator profile", e);
+            Adminizer.log.error("Error trying to create administrator", e);
             return;
         }
         console.group("Administrators credentials");
@@ -63,10 +64,10 @@ export default async function bindAuthorization(adminizer) {
         try {
             let passwordHashed = generate("demodemo" + process.env.AP_PASSWORD_SALT);
             let password = 'masked';
-            // TODO refactor CRUD functions for DataAccessor usage
-            await adminizer.modelHandler.model.get("UserAP")?.["_create"]({
-                login: 'demo', password: 'demo', passwordHashed: passwordHashed, fullName: "Administrator",
-                isActive: true, isAdministrator: true
+            await userModel.create({
+                login: 'demo', passwordHashed: passwordHashed, fullName: "Administrator",
+                isActive: true, isAdministrator: true,
+                apiKey: generateUserApiKey()
             });
         }
         catch (e) {
@@ -77,15 +78,15 @@ export default async function bindAuthorization(adminizer) {
     else { // try to create one if we don't
         if (adminizer.config.auth.enable) {
             Adminizer.log.debug(`Adminpanel does not have an administrator`);
-            adminizer.config.policies.push(initUserPolicy);
+            adminizer.config.middlewares.push(initUserPolicy);
             //@ts-ignore
             adminizer.app.use(`${adminizer.config.routePrefix}/init_user`, _initUser);
         }
     }
     if (adminizer.config.auth.enable) {
-        adminizer.app.use(baseRoute + '/login', adminizer.policyManager.bindPolicies(policies, _login));
-        adminizer.app.use(baseRoute + '/logout', adminizer.policyManager.bindPolicies(policies, _login));
-        adminizer.app.use(baseRoute + '/register', adminizer.policyManager.bindPolicies(policies, _register));
+        adminizer.app.use(baseRoute + '/login', adminizer.middlewareManager.bindMiddlewares(policies, _login));
+        adminizer.app.use(baseRoute + '/logout', adminizer.middlewareManager.bindMiddlewares(policies, _login));
+        adminizer.app.use(baseRoute + '/register', adminizer.middlewareManager.bindMiddlewares(policies, _register));
     }
 }
 ;
@@ -95,8 +96,7 @@ function getRandomInt(min, max) {
     return Math.floor(Math.random() * (max - min)) + min;
 }
 async function initUserPolicy(req, res, proceed) {
-    // TODO refactor CRUD functions for DataAccessor usage
-    let admins = await req.adminizer.modelHandler.model.get("UserAP")?.["_find"]({ isAdministrator: true });
+    let admins = await req.adminizer.modelHandler.internal("auth").get("UserAP").find({ where: { isAdministrator: true } });
     if (!admins || !admins.length) {
         return res.redirect(`${req.adminizer.config.routePrefix}/init_user`);
     }

package/system/bindCors.js

@@ -5,7 +5,10 @@ export function bindCors(adminizer) {
         const allowedOrigins = Array.isArray(corsConfig.origin)
             ? corsConfig.origin
             : [corsConfig.origin];
-        adminizer.app.all(`${adminizer.config.routePrefix}/${corsConfig.path}`, (req, res, next) => {
+        adminizer.app.use(adminizer.config.routePrefix, (req, res, next) => {
+            if (!matchesCorsPath(req.path, corsConfig.path)) {
+                return next();
+            }
             const requestOrigin = req.headers.origin;
             // Checking if origin is allowed
             const isOriginAllowed = !requestOrigin || allowedOrigins.includes(requestOrigin);
@@ -39,3 +42,15 @@ export function bindCors(adminizer) {
         console.log('✅ API CORS middleware enabled. Allowed origins:', allowedOrigins);
     }
 }
+function matchesCorsPath(requestPath, configuredPath = '') {
+    const normalizedRequestPath = requestPath.replace(/^\/+/, '');
+    const normalizedConfiguredPath = configuredPath.replace(/^\/+/, '');
+    if (!normalizedConfiguredPath || normalizedConfiguredPath === '*') {
+        return true;
+    }
+    if (!normalizedConfiguredPath.includes('*')) {
+        return normalizedRequestPath === normalizedConfiguredPath;
+    }
+    const prefix = normalizedConfiguredPath.slice(0, normalizedConfiguredPath.indexOf('*'));
+    return normalizedRequestPath.startsWith(prefix);
+}

package/system/bindCustomFilterHandlers.d.ts

@@ -0,0 +1,2 @@
+import { Adminizer } from "../lib/Adminizer";
+export default function bindCustomFilterHandlers(adminizer: Adminizer): void;

package/system/bindCustomFilterHandlers.js

@@ -0,0 +1,4 @@
+import { CustomFilterHandler } from "../lib/filters/CustomFilterHandler.js";
+export default function bindCustomFilterHandlers(adminizer) {
+    adminizer.customFilterHandler = new CustomFilterHandler();
+}