adminizer 5.0.0-build.13 → 5.0.0-build.14

package/controllers/ai/AiAssistantController.js

@@ -9,9 +9,10 @@ export class AiAssistantController {
             Adminizer.log.warn('AI assistant handler is not initialized');
             return res.json([]);
         }
-        const models = handler
-            .getModels()
-            .filter((model) => req.adminizer.accessRightsHelper.hasPermission(`ai-assistant-${model.id}`, req.user));
+        const models = (await Promise.all(handler.getModels().map(async (model) => ({
+            model,
+            allowed: await req.adminizer.accessRightsHelper.hasPermission(`ai-assistant-${model.id}`, req.user),
+        })))).filter(({ allowed }) => allowed).map(({ model }) => model);
         return res.json(models);
     }
 }

package/controllers/edit.js

@@ -134,7 +134,7 @@ export default async function edit(req, res) {
             });
         }
     }
-    const props = inertiaAddHelper(req, modelResource, fields, record);
+    const props = await inertiaAddHelper(req, modelResource, fields, record);
     if (req.query?.without_layout) {
         return res.json({
             props: props

package/controllers/editGroup.js

@@ -44,13 +44,22 @@ export default async function editGroup(req, res) {
                     }
                 }
             }
-            if (key.startsWith("token-checkbox-") && req.body[key] === true) {
-                for (let token of allTokens) {
-                    if (token.id == key.slice(15)) {
-                        tokensOfThisGroup.push(token.id);
-                    }
-                }
+        }
+        for (const token of allTokens) {
+            if (req.body[`token-checkbox-${token.id}`] !== true)
+                continue;
+            if (!token.getOptions) {
+                tokensOfThisGroup.push(token.id);
+                continue;
             }
+            const submittedRights = req.body[`token-record-rights-${token.id}`];
+            const rights = Array.isArray(submittedRights)
+                ? Array.from(new Set(submittedRights.map(String)))
+                : [];
+            tokensOfThisGroup.push({
+                tokenId: token.id,
+                rights,
+            });
         }
         let updatedGroup;
         try {

package/controllers/filter-fields/savedFilters.js

@@ -125,7 +125,7 @@ export async function saveFilter(req, res) {
     }
     // Determine visibility and groupIds
     const isAdmin = req.user?.isAdministrator === true;
-    const canManageGroupVisibility = isAdmin || req.adminizer.accessRightsHelper.hasPermission(GROUP_FILTER_VISIBILITY_TOKEN, req.user);
+    const canManageGroupVisibility = isAdmin || await req.adminizer.accessRightsHelper.hasPermission(GROUP_FILTER_VISIBILITY_TOKEN, req.user);
     let effectiveVisibility = 'private';
     let effectiveGroupIds;
     if (visibility === 'public' && isAdmin) {

package/controllers/history-actions/HistoryController.js

@@ -3,13 +3,13 @@ import { getUiTranslations } from "../../lib/ui-i18n/getUiTranslations.js";
 import { HISTORY_UI_TRANSLATION_KEYS } from "../../lib/ui-i18n/uiTranslationKeys.js";
 export class HistoryController {
     static async index(req, res) {
-        if (!HistoryController.checkHistoryPermission(req, res))
+        if (!await HistoryController.checkHistoryPermission(req, res))
             return;
         const adapter = HistoryController.getAdapter(req);
         if (req.method.toUpperCase() === 'GET') {
             const rawModels = adapter.getModels(req.user);
             let users = [];
-            const accessToUsersHistory = req.adminizer.accessRightsHelper.enoughPermissions([
+            const accessToUsersHistory = await req.adminizer.accessRightsHelper.enoughPermissions([
                 `users-history-${adapter.id}`
             ], req.user);
             if (accessToUsersHistory)
@@ -59,7 +59,7 @@ export class HistoryController {
         return res.status(405).end();
     }
     static async getAllModelHistory(req, res) {
-        if (!HistoryController.checkHistoryPermission(req, res))
+        if (!await HistoryController.checkHistoryPermission(req, res))
             return;
         const { modelId, modelName } = req.body;
         if (!modelId || !modelName) {
@@ -80,7 +80,7 @@ export class HistoryController {
         }
     }
     static async getModelFieldsHistory(req, res) {
-        if (!HistoryController.checkHistoryPermission(req, res))
+        if (!await HistoryController.checkHistoryPermission(req, res))
             return;
         const { historyId } = req.body;
         if (!historyId) {
@@ -103,12 +103,12 @@ export class HistoryController {
         const adapter = req.adminizer.config.history?.adapter ?? 'default';
         return req.adminizer.historyHandler.get(adapter);
     }
-    static checkHistoryPermission(req, res) {
+    static async checkHistoryPermission(req, res) {
         if (!req.adminizer?.historyHandler) {
             res.status(401).json({ error: 'History system not initialized' });
             return false;
         }
-        const hasPermission = req.adminizer.accessRightsHelper.hasPermission(`history-${req.adminizer.config.history?.adapter ?? 'default'}`, req.user);
+        const hasPermission = await req.adminizer.accessRightsHelper.hasPermission(`history-${req.adminizer.config.history?.adapter ?? 'default'}`, req.user);
         if (!hasPermission) {
             res.sendStatus(403);
             return false;

package/controllers/list.js

@@ -14,7 +14,7 @@ export default async function list(req, res) {
     }
     let dataAccessor = new DataAccessor(req.adminizer, req.user, modelResource, "list");
     let fields = dataAccessor.getFieldsConfig();
-    const header = inertiaListHelper(modelResource, req, fields);
+    const header = await inertiaListHelper(modelResource, req, fields);
     const i18nPage = getUiTranslations(req, FILTER_UI_TRANSLATION_KEYS);
     // Parse pagination
     const defaultPageSize = req.adminizer.config.list?.defaultPageSize ?? 50;

package/controllers/login.js

@@ -61,7 +61,7 @@ export default async function login(req, res) {
                         //Here we use the captchaSolution key to output messages unrelated to the form fields.
                         return inertiaAdminMessage(req, "Profile expired, contact the administrator", 'captchaSolution');
                     }
-                    if (!req.adminizer.accessRightsHelper.hasPermission('access-to-adminpanel', user)) {
+                    if (!await req.adminizer.accessRightsHelper.hasPermission('access-to-adminpanel', user)) {
                         return inertiaAdminMessage(req, "The user is not allowed to enter, please contact the administrator", 'captchaSolution');
                     }
                     const token = signUser({

package/controllers/notifications/NotificationController.js

@@ -7,7 +7,7 @@ export class NotificationController {
             return;
         if (req.method.toUpperCase() === 'POST') {
             const { s, notificationClass } = req.body;
-            const hasPermission = req.adminizer.accessRightsHelper.hasPermission(`notification-${notificationClass}`, req.user);
+            const hasPermission = await req.adminizer.accessRightsHelper.hasPermission(`notification-${notificationClass}`, req.user);
             if (!hasPermission) {
                 res.status(403).json({ error: 'Forbidden' });
                 return;
@@ -42,7 +42,7 @@ export class NotificationController {
         const services = req.adminizer.notificationHandler.getAllServices();
         let activeServices = [];
         for (const service of services) {
-            const hasPermission = req.adminizer.accessRightsHelper.hasPermission(`notification-${service.notificationClass}`, req.user);
+            const hasPermission = await req.adminizer.accessRightsHelper.hasPermission(`notification-${service.notificationClass}`, req.user);
             if (hasPermission) {
                 activeServices.push({
                     displayName: req.i18n.__(service.displayName),
@@ -68,12 +68,12 @@ export class NotificationController {
         res.write(': stream-open\n\n');
         const clientId = `user-${req.user?.id}-${Date.now()}`;
         // Function for sending events to the client
-        const sendEvent = (event) => {
+        const sendEvent = async (event) => {
             // Filtering notifications by user rights
             if (event.type === 'notification') {
                 const notificationClass = event.notificationClass;
                 // UNIFIED rights check via AccessRightsHelper
-                const hasPermission = req.adminizer.accessRightsHelper.hasPermission(`notification-${notificationClass}`, req.user);
+                const hasPermission = await req.adminizer.accessRightsHelper.hasPermission(`notification-${notificationClass}`, req.user);
                 if (!hasPermission) {
                     return; // The user does not have rights to this notification class
                 }
@@ -88,7 +88,10 @@ export class NotificationController {
         };
         // We connect the client to all services
         const services = req.adminizer.notificationHandler.getAllServices();
-        const allowedServices = services.filter(service => req.adminizer.accessRightsHelper.hasPermission(`notification-${service.notificationClass}`, req.user));
+        const allowedServices = (await Promise.all(services.map(async (service) => ({
+            service,
+            allowed: await req.adminizer.accessRightsHelper.hasPermission(`notification-${service.notificationClass}`, req.user),
+        })))).filter(({ allowed }) => allowed).map(({ service }) => service);
         allowedServices.forEach(service => {
             service.addClient(clientId, sendEvent, req.user);
             // For a system service, add a client to CRUD channels
@@ -100,7 +103,7 @@ export class NotificationController {
             //     });
             // }
         });
-        sendEvent({
+        await sendEvent({
             type: 'connected',
             data: {
                 message: 'Connected to unified notification stream',
@@ -144,7 +147,7 @@ export class NotificationController {
             const { notificationClass } = req.params;
             const { limit = 20, skip = 0, unreadOnly = false } = req.query;
             // Checking access rights
-            const hasPermission = req.adminizer.accessRightsHelper.hasPermission(`notification-${notificationClass}`, req.user);
+            const hasPermission = await req.adminizer.accessRightsHelper.hasPermission(`notification-${notificationClass}`, req.user);
             if (!hasPermission) {
                 res.status(403).json({ error: 'Forbidden' });
                 return;
@@ -170,7 +173,10 @@ export class NotificationController {
         try {
             // Filtering services by access rights
             const services = req.adminizer.notificationHandler.getAllServices();
-            const allowedServices = services.filter(service => req.adminizer.accessRightsHelper.hasPermission(`notification-${service.notificationClass}`, req.user));
+            const allowedServices = (await Promise.all(services.map(async (service) => ({
+                service,
+                allowed: await req.adminizer.accessRightsHelper.hasPermission(`notification-${service.notificationClass}`, req.user),
+            })))).filter(({ allowed }) => allowed).map(({ service }) => service);
             const allNotifications = [];
             for (const service of allowedServices) {
                 const notifications = await service.getNotifications(req.user.id, Number(limit), Number(skip), unreadOnly === 'true');

package/controllers/view.js

@@ -83,7 +83,7 @@ export default async function view(req, res) {
                     });
                 }
             }
-            const props = inertiaAddHelper(req, modelResource, fields, record, true);
+            const props = await inertiaAddHelper(req, modelResource, fields, record, true);
             return req.Inertia.render({
                 component: 'add',
                 props: props

package/controllers/widgets/filterInfo.js

@@ -28,7 +28,7 @@ export async function widgetFilterInfoController(req, res) {
     if (!filter || !filterService.canViewFilter(filter, user)) {
         return res.status(404).send({ error: req.i18n.__("Not found") });
     }
-    if (!req.adminizer.accessRightsHelper.hasPermission(`read-${filter.modelName}-model`, user)) {
+    if (!await req.adminizer.accessRightsHelper.hasPermission(`read-${filter.modelName}-model`, user)) {
         return res.sendStatus(403);
     }
     if (req.method.toUpperCase() === "GET") {

package/helpers/accessRightsHelper.d.ts

@@ -1,6 +1,7 @@
 import { User } from "../models/User.js";
-import { AccessRightsToken } from "../interfaces/types.js";
+import { AccessRightsToken, GroupPermissionGrant, PermissionContext } from "../interfaces/types.js";
 import { Adminizer } from "../lib/Adminizer.js";
+export declare function parseGroupPermissionGrant(value: unknown): GroupPermissionGrant | null;
 export declare class AccessRightsHelper {
     private _tokens;
     adminizer: Adminizer;
@@ -8,13 +9,19 @@ export declare class AccessRightsHelper {
     registerToken(accessRightsToken: AccessRightsToken): void;
     unregisterToken(tokenId: string): boolean;
     hasToken(tokenId: string): boolean;
+    getToken(tokenId: string): AccessRightsToken | undefined;
     registerTokens(accessRightsTokens: AccessRightsToken[]): void;
     registerModelTokens(modelName: string, department?: string): void;
     getTokens(): AccessRightsToken[];
     getTokensByDepartment(department: string): AccessRightsToken[];
     getAllDepartments(): string[];
     enoughPermissions(tokens: string[], user: User): boolean;
-    hasPermission(tokenId: string | undefined, user: User, context?: string): boolean;
+    hasPermission(tokenId: string | undefined, user: User, context?: PermissionContext): boolean | Promise<boolean>;
+    /** Returns trusted option IDs granted by all groups for a contextual token. */
+    getPermissionRights(tokenId: string | undefined, user: User): string[] | null;
+    private getRegisteredToken;
+    private hasAssignedPermission;
+    private runTokenCheck;
 }
 export declare class GroupsAccessRightsHelper {
     static hasAccess(user: User, groupsAccessRights?: string[]): boolean;

package/helpers/accessRightsHelper.js

@@ -1,4 +1,18 @@
 import { Adminizer } from "../lib/Adminizer.js";
+export function parseGroupPermissionGrant(value) {
+    if (!value ||
+        typeof value !== "object" ||
+        typeof value.tokenId !== "string" ||
+        !Array.isArray(value.rights) ||
+        !value.rights.every((right) => typeof right === "string" || typeof right === "number")) {
+        return null;
+    }
+    const parsed = value;
+    return {
+        tokenId: parsed.tokenId.toLowerCase(),
+        rights: Array.from(new Set(parsed.rights.map(String))),
+    };
+}
 export class AccessRightsHelper {
     _tokens = [];
     adminizer;
@@ -10,6 +24,12 @@ export class AccessRightsHelper {
         if (!accessRightsToken.id || !accessRightsToken.name || !accessRightsToken.description || !accessRightsToken.department) {
             throw new Error("Adminpanel > Can not register token: Missed one or more required parameters");
         }
+        if (accessRightsToken.getOptions && typeof accessRightsToken.getOptions !== "function") {
+            throw new Error("Adminpanel > Can not register token: getOptions must be a function");
+        }
+        if (accessRightsToken.check && typeof accessRightsToken.check !== "function") {
+            throw new Error("Adminpanel > Can not register token: check must be a function");
+        }
         for (let i = 0; i < this._tokens.length; i++) {
             if (this._tokens[i].id === accessRightsToken.id) {
                 this._tokens.splice(i, 1);
@@ -31,6 +51,10 @@ export class AccessRightsHelper {
         const normalizedTokenId = tokenId.toLowerCase();
         return this._tokens.some((token) => token.id === normalizedTokenId);
     }
+    getToken(tokenId) {
+        const normalizedTokenId = tokenId.toLowerCase();
+        return this._tokens.find((token) => token.id === normalizedTokenId);
+    }
     registerTokens(accessRightsTokens) {
         for (let token of accessRightsTokens) {
             this.registerToken(token);
@@ -62,30 +86,73 @@ export class AccessRightsHelper {
         if (!tokens.length) {
             return true;
         }
-        return tokens.some((token) => this.hasPermission(token, user));
+        return tokens.some((token) => Boolean(this.hasPermission(token, user)));
     }
     hasPermission(tokenId, user, context) {
-        if (!this.adminizer.config.auth.enable) {
+        const token = this.getRegisteredToken(tokenId);
+        if (!token) {
+            return false;
+        }
+        if (!this.hasAssignedPermission(token.id, user)) {
+            return false;
+        }
+        if (!token.check) {
             return true;
         }
+        return this.runTokenCheck(token, user, context ?? {});
+    }
+    /** Returns trusted option IDs granted by all groups for a contextual token. */
+    getPermissionRights(tokenId, user) {
+        if (!this.adminizer.config.auth.enable) {
+            return null;
+        }
         if (user.isAdministrator) {
-            return true;
+            return null;
         }
+        const token = this.getRegisteredToken(tokenId);
+        if (!token) {
+            return [];
+        }
+        if (!user.groups) {
+            Adminizer.log.error('User has no groups');
+            return [];
+        }
+        const rights = user.groups.flatMap((group) => group.tokens ?? [])
+            .map(parseGroupPermissionGrant)
+            .filter((grant) => grant?.tokenId === token.id)
+            .flatMap((grant) => grant.rights);
+        return Array.from(new Set(rights));
+    }
+    getRegisteredToken(tokenId) {
         if (!tokenId) {
-            Adminizer.log.warn(`AccessRightsHelper > hasPermission: missing accessRightsToken${context ? ` [${context}]` : ''}`);
-            return false;
+            Adminizer.log.warn("AccessRightsHelper > hasPermission: missing accessRightsToken");
+            return undefined;
         }
-        tokenId = tokenId.toLowerCase();
-        const tokenIsValid = this._tokens.some((token) => token.id === tokenId);
-        if (!tokenIsValid) {
-            Adminizer.log.error("Adminpanel > Token is not valid", tokenId, user.login);
-            return false;
+        const token = this.getToken(tokenId);
+        if (!token) {
+            Adminizer.log.error("Adminpanel > Token is not valid", tokenId);
+        }
+        return token;
+    }
+    hasAssignedPermission(tokenId, user) {
+        if (!this.adminizer.config.auth.enable || user.isAdministrator) {
+            return true;
         }
         if (!user.groups) {
-            Adminizer.log.error('User has no groups');
+            Adminizer.log.error("User has no groups");
+            return false;
+        }
+        return user.groups.some((group) => group.tokens?.some((groupToken) => groupToken === tokenId || parseGroupPermissionGrant(groupToken)?.tokenId === tokenId));
+    }
+    async runTokenCheck(token, user, context) {
+        try {
+            const rights = this.getPermissionRights(token.id, user) ?? [];
+            return await token.check(user, { ...context, rights });
+        }
+        catch (error) {
+            Adminizer.log.error("AccessRightsHelper > token check failed", token.id, error);
             return false;
         }
-        return user.groups.some((group) => group.tokens?.includes(tokenId));
     }
 }
 export class GroupsAccessRightsHelper {

package/helpers/inertiaActionsHelper.d.ts

@@ -7,4 +7,4 @@ export interface Actions {
     title: string;
     icon: string;
 }
-export default function inertiaActionsHelper(actionType: ActionType, modelResource: ModelResource, req: ReqType): Actions[];
+export default function inertiaActionsHelper(actionType: ActionType, modelResource: ModelResource, req: ReqType): Promise<Actions[]>;

package/helpers/inertiaActionsHelper.js

@@ -1,11 +1,10 @@
-export default function inertiaActionsHelper(actionType, modelResource, req) {
+export default async function inertiaActionsHelper(actionType, modelResource, req) {
     let resActions = [];
     if (req.adminizer.menuHelper.hasGlobalActions(modelResource.config, actionType)) {
         const actions = req.adminizer.menuHelper.getGlobalActions(modelResource.config, actionType);
         if (actions && actions.length > 0) {
-            actions.forEach(function (action) {
-                const context = `global action "${action.title}" (${action.id}) on model "${modelResource.name}"`;
-                if (req.adminizer.accessRightsHelper.hasPermission(action.accessRightsToken, req.user, context)) {
+            for (const action of actions) {
+                if (await req.adminizer.accessRightsHelper.hasPermission(action.accessRightsToken, req.user)) {
                     resActions.push({
                         link: action.link,
                         id: action.id,
@@ -14,7 +13,7 @@ export default function inertiaActionsHelper(actionType, modelResource, req) {
                         icon: action.icon
                     });
                 }
-            });
+            }
         }
     }
     return resActions;

package/helpers/inertiaAddHelper.d.ts

@@ -23,7 +23,7 @@ interface FieldProps extends Record<string | number | symbol, unknown> {
     postLink: string;
     model: string;
 }
-export default function inertiaAddHelper(req: ReqType, modelResource: ModelResource, fields: Fields, record?: Record<string, string | boolean | number | string[]>, view?: boolean): FieldProps;
+export default function inertiaAddHelper(req: ReqType, modelResource: ModelResource, fields: Fields, record?: Record<string, string | boolean | number | string[]>, view?: boolean): Promise<FieldProps>;
 export declare function getControlsOptions(fieldConfig: Field["config"], req: ReqType, type: ControlType, defaultControlName: string, context?: string): {
     name: string;
     config: any;

package/helpers/inertiaAddHelper.js

@@ -14,7 +14,7 @@ function getWeekNumber(date) {
     const yearStart = new Date(Date.UTC(d.getUTCFullYear(), 0, 1));
     return Math.ceil((((d.getTime() - yearStart.getTime()) / 86400000) + 1) / 7);
 }
-export default function inertiaAddHelper(req, modelResource, fields, record, view = false) {
+export default async function inertiaAddHelper(req, modelResource, fields, record, view = false) {
     const actionType = 'add';
     let props = {
         edit: !!record,
@@ -36,7 +36,7 @@ export default function inertiaAddHelper(req, modelResource, fields, record, vie
         postLink: record ? `${modelResource.uri}/edit/${record.id}` : `${modelResource.uri}/add`,
         model: modelResource.name.toLocaleLowerCase()
     };
-    props.actions = inertiaActionsHelper(actionType, modelResource, req);
+    props.actions = await inertiaActionsHelper(actionType, modelResource, req);
     const config = req.adminizer.configHelper.getConfig();
     for (const key of Object.keys(fields)) {
         if ((!config.showORMtime) && (key === 'createdAt' || key === 'updatedAt'))
@@ -118,7 +118,7 @@ export default function inertiaAddHelper(req, modelResource, fields, record, vie
                 ? req.adminizer.modelHandler.resolveModelName(rawRelatedModel)
                 : undefined;
             if (relatedModel && req.user) {
-                canCreateRelated = req.adminizer.accessRightsHelper.hasPermission(`create-${relatedModel}-model`, req.user);
+                canCreateRelated = await req.adminizer.accessRightsHelper.hasPermission(`create-${relatedModel}-model`, req.user);
             }
             else if (relatedModel && !req.adminizer.config.auth?.enable) {
                 canCreateRelated = true;

package/helpers/inertiaGroupHelper.js

@@ -1,3 +1,4 @@
+import { parseGroupPermissionGrant } from "./accessRightsHelper.js";
 export function inertiaGroupHelper(modelResource, req, users, groupedTokens, group, view = false) {
     let props = {
         edit: !!group,
@@ -55,8 +56,15 @@ export function inertiaGroupHelper(modelResource, req, users, groupedTokens, gro
                     label: token.name,
                     tooltip: token.description,
                     name: `token-checkbox-${token.id}`,
-                    value: group ? (group.tokens && group.tokens?.includes(token.id)) : false,
-                    type: 'checkbox'
+                    value: group ? Boolean(group.tokens?.some((value) => value === token.id || parseGroupPermissionGrant(value)?.tokenId === token.id)) : false,
+                    type: 'checkbox',
+                    options: token.getOptions ? {
+                        permissionOptions: {
+                            rights: group?.tokens
+                                ?.map(parseGroupPermissionGrant)
+                                .find((value) => value?.tokenId === token.id)?.rights ?? [],
+                        },
+                    } : undefined,
                 });
             }
             props.groupedTokens.push({

package/helpers/inertiaListHelper.d.ts

@@ -28,5 +28,5 @@ interface listProps extends Record<string | number | symbol, unknown> {
     defaultPageSize: number;
     pageSizeOptions: number[];
 }
-export declare function inertiaListHelper(modelResource: ModelResource, req: ReqType, fields: Fields, activeFilterName?: string): listProps;
+export declare function inertiaListHelper(modelResource: ModelResource, req: ReqType, fields: Fields, activeFilterName?: string): Promise<listProps>;
 export {};

package/helpers/inertiaListHelper.js

@@ -1,5 +1,5 @@
 import inertiaActionsHelper from "./inertiaActionsHelper.js";
-export function inertiaListHelper(modelResource, req, fields, activeFilterName) {
+export async function inertiaListHelper(modelResource, req, fields, activeFilterName) {
     const actionType = 'list';
     // Check if filters are enabled for this model
     // Preferred: model-level `models.<Model>.filters`; fallback: legacy top-level `modelFilters.<Model>`
@@ -31,23 +31,22 @@ export function inertiaListHelper(modelResource, req, fields, activeFilterName)
         defaultPageSize: req.adminizer.config.list?.defaultPageSize ?? 50,
         pageSizeOptions: [5, 20, 50],
     };
-    if (modelResource.config.add && req.adminizer.accessRightsHelper.hasPermission(`create-${modelResource.name}-model`, req.user, `CRUD create on model "${modelResource.name}"`)) {
+    if (modelResource.config.add && await req.adminizer.accessRightsHelper.hasPermission(`create-${modelResource.name}-model`, req.user)) {
         props.crudActions.createTitle = req.i18n.__('create');
     }
-    if (modelResource.config.edit && req.adminizer.accessRightsHelper.hasPermission(`update-${modelResource.name}-model`, req.user, `CRUD update on model "${modelResource.name}"`)) {
+    if (modelResource.config.edit && await req.adminizer.accessRightsHelper.hasPermission(`update-${modelResource.name}-model`, req.user)) {
         props.crudActions.editTitle = req.i18n.__('Edit');
     }
-    if (modelResource.config.view && req.adminizer.accessRightsHelper.hasPermission(`read-${modelResource.name}-model`, req.user, `CRUD read on model "${modelResource.name}"`)) {
+    if (modelResource.config.view && await req.adminizer.accessRightsHelper.hasPermission(`read-${modelResource.name}-model`, req.user)) {
         props.crudActions.viewsTitle = req.i18n.__('View');
     }
-    if (modelResource.config.remove && req.adminizer.accessRightsHelper.hasPermission(`delete-${modelResource.name}-model`, req.user, `CRUD delete on model "${modelResource.name}"`)) {
+    if (modelResource.config.remove && await req.adminizer.accessRightsHelper.hasPermission(`delete-${modelResource.name}-model`, req.user)) {
         props.crudActions.deleteTitle = req.i18n.__('Delete');
     }
-    props.actions = inertiaActionsHelper(actionType, modelResource, req);
+    props.actions = await inertiaActionsHelper(actionType, modelResource, req);
     if (req.adminizer.menuHelper.hasInlineActions(modelResource.config, 'list')) {
         for (const inlineAction of req.adminizer.menuHelper.getInlineActions(modelResource.config, 'list')) {
-            const context = `inline action "${inlineAction.title}" (${inlineAction.id}) on model "${modelResource.name}"`;
-            if (req.adminizer.accessRightsHelper.hasPermission(inlineAction.accessRightsToken, req.user, context)) {
+            if (await req.adminizer.accessRightsHelper.hasPermission(inlineAction.accessRightsToken, req.user)) {
                 props.inlineActions.push({
                     icon: inlineAction.icon,
                     id: inlineAction.id,

package/interfaces/types.d.ts

@@ -1,5 +1,6 @@
 import { AbstractModel } from "../lib/model/AbstractModel.js";
 import { ModelConfig } from "./adminpanelConfig.js";
+import type { User } from "../models/User.js";
 export interface ModelResource {
     name: string;
     config?: ModelConfig;
@@ -11,7 +12,24 @@ export interface AccessRightsToken {
     description: string;
     department: string;
     id: string;
+    getOptions?: (user: User) => Promise<PermissionOption[]>;
+    check?: (user: User, context?: PermissionContext) => Promise<boolean>;
 }
+export interface PermissionOption {
+    id: string;
+    name: string;
+    description?: string;
+}
+export interface PermissionContext {
+    rights?: string[];
+    [key: string]: unknown;
+}
+/** Serialized as a JSON string in Group.tokens for a contextual token. */
+export interface GroupPermissionGrant {
+    tokenId: string;
+    rights: string[];
+}
+export type PermissionGrant = string | GroupPermissionGrant;
 export interface PropsField {
     label: string;
     type: string;

package/lib/app-manager/AdminizerApp.d.ts

@@ -1,5 +1,5 @@
 import type { ActionType, AdminpanelConfig, AdminpanelIcon, ModelConfig } from "../../interfaces/adminpanelConfig.js";
-import type { AccessRightsToken, INotification, ModelResource } from "../../interfaces/types.js";
+import type { AccessRightsToken, INotification, ModelResource, PermissionContext } from "../../interfaces/types.js";
 import type { AbstractCatalog } from "../catalog/AbstractCatalog.js";
 import type { CatalogTemplateComponentResource } from "../catalog/CatalogTemplateComponentHandler.js";
 import type { AppModelAccess } from "../model/ModelHandler.js";
@@ -130,9 +130,14 @@ export type AppWidgetResource = AppInfoWidgetResource | AppActionWidgetResource
 export interface AppRuntime {
     models: AppModelAccess;
     config: AppRuntimeConfig;
+    accessRights: AppRuntimeAccessRights;
     notifications: AppRuntimeNotifications;
     apps: AppRuntimeApps;
 }
+export interface AppRuntimeAccessRights {
+    hasPermission(token: string, user: User, context?: PermissionContext): Promise<boolean>;
+    getPermissionRights(token: string, user: User): string[] | null;
+}
 export interface AppRuntimeConfig {
     readonly routePrefix: string;
     getModelConfig(modelName: string): ModelConfig | undefined;
@@ -174,7 +179,7 @@ export interface AppAiAssistantContext {
     routePrefix: string;
     getModelResources(): ModelResource[];
     resolveModelResource(modelName: string): ModelResource | undefined;
-    hasPermission(token: string, user: User): boolean;
+    hasPermission(token: string, user: User): boolean | Promise<boolean>;
     createDataAccessor(modelResource: ModelResource, user: User, action: ActionType): DataAccessor;
     /** UI tools available to this user, including methods registered by apps. */
     getUiMethods(user: User): AiAssistantUiMethod[];

package/lib/app-manager/AppManager.js

@@ -505,6 +505,10 @@ export class AppManager {
                     return modelKey ? models[modelKey] : undefined;
                 },
             },
+            accessRights: {
+                hasPermission: async (token, user, context) => await this.adminizer.accessRightsHelper.hasPermission(token, user, context),
+                getPermissionRights: (token, user) => this.adminizer.accessRightsHelper.getPermissionRights(token, user),
+            },
             notifications: {
                 send: (notification) => this.adminizer.sendNotification(notification),
             },

package/lib/notifications/GeneralNotificationService.js

@@ -23,7 +23,7 @@ export class GeneralNotificationService extends AbstractNotificationService {
                 const users = await this.userModel().find({});
                 for (const user of users) {
                     try {
-                        if (this.adminizer.accessRightsHelper.hasPermission(`notification-${this.notificationClass}`, user)) {
+                        if (await this.adminizer.accessRightsHelper.hasPermission(`notification-${this.notificationClass}`, user)) {
                             await this.createUserNotification(notificationDB.id, user.id);
                         }
                         else {

package/lib/notifications/SystemNotificationService.js

@@ -19,7 +19,7 @@ export class SystemNotificationService extends AbstractNotificationService {
             const users = await this.userModel().find({});
             for (const user of users) {
                 try {
-                    if (this.adminizer.accessRightsHelper.hasPermission(`notification-${this.notificationClass}`, user)) {
+                    if (await this.adminizer.accessRightsHelper.hasPermission(`notification-${this.notificationClass}`, user)) {
                         await this.createUserNotification(notificationDB.id, user.id);
                     }
                 }

package/models/Group.d.ts

@@ -1,8 +1,9 @@
 import type { User } from "./User.js";
+import type { PermissionGrant } from "../interfaces/types.js";
 export interface Group {
     id?: number;
     name: string;
     description?: string;
-    tokens?: string[];
+    tokens?: PermissionGrant[];
     users?: User[];
 }