adminizer 5.0.0-build.8 → 5.1.0-build.24

package/lib/ai-assistant/builtinAgentSkills.js

@@ -0,0 +1,259 @@
+import { listModelResources, resolveModelResource } from '../../helpers/modelResourceHelper.js';
+import { listAccessibleMenuItems } from '../../helpers/navigationAccessHelper.js';
+import { DataAccessor } from '../DataAccessor.js';
+import { toJsonSafe } from './jsonSafe.js';
+const MAX_RECORDS = 50;
+const DEFAULT_RECORDS = 10;
+/** The model resources the current user may read or edit, with the CRUD flags of each. */
+async function listPermittedModels(adminizer, user) {
+    const has = (token) => adminizer.accessRightsHelper.hasPermission(token, user);
+    const permitted = [];
+    for (const resource of listModelResources(adminizer)) {
+        const entry = {
+            resource,
+            canRead: await has(`read-${resource.name}-model`),
+            canUpdate: await has(`update-${resource.name}-model`),
+            canCreate: await has(`create-${resource.name}-model`),
+        };
+        if (entry.canRead || entry.canUpdate)
+            permitted.push(entry);
+    }
+    return permitted;
+}
+/** Resolves a model this user may use for `action`, throwing when they may not. */
+async function requireModel(adminizer, user, name, action) {
+    const resource = resolveModelResource(adminizer, name);
+    if (!resource?.model)
+        throw new Error(`Model "${name}" is not available.`);
+    const token = action === 'read' ? `read-${resource.name}-model` : `update-${resource.name}-model`;
+    if (!await adminizer.accessRightsHelper.hasPermission(token, user)) {
+        throw new Error(`You are not allowed to ${action} the "${resource.name}" model.`);
+    }
+    return resource;
+}
+async function modelNames(adminizer, user, action) {
+    return (await listPermittedModels(adminizer, user))
+        .filter((entry) => (action === 'read' ? entry.canRead : entry.canUpdate))
+        .map((entry) => entry.resource.name);
+}
+/** Adds an `enum` of permitted models, so the agent cannot invent a model name. */
+function withModelEnum(schema, models) {
+    const properties = { ...schema.properties };
+    properties.model = { ...properties.model, enum: models };
+    return { ...schema, properties };
+}
+function identifierField(adminizer, resource) {
+    return resource.config?.identifierField
+        ?? adminizer.config.identifierField
+        ?? resource.model?.primaryKey
+        ?? 'id';
+}
+function parseCriteria(filter) {
+    if (filter === undefined || filter === null || filter === '')
+        return {};
+    if (typeof filter === 'object')
+        return filter;
+    try {
+        const parsed = JSON.parse(String(filter));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            throw new Error('not an object');
+        return parsed;
+    }
+    catch {
+        throw new Error('filter must be a JSON object, e.g. {"title": "example"}');
+    }
+}
+function pickFields(record, fields) {
+    return Object.fromEntries(fields.filter((field) => field in record).map((field) => [field, record[field]]));
+}
+function slugify(value) {
+    return String(value ?? '').trim().toLowerCase().replace(/[\s_-]+/g, '-');
+}
+/** The sub-actions of a menu item, recursively, as the agent sees them. */
+function describeNavigationActions(actions) {
+    return (actions ?? []).map((action) => ({
+        id: action.id || action.title,
+        title: action.title,
+        link: action.link,
+        icon: action.icon || undefined,
+        target: action.type === 'blank' ? 'blank' : undefined,
+        actions: action.subItems?.length ? describeNavigationActions(action.subItems) : undefined,
+    }));
+}
+function describeNavigationItem(item) {
+    return {
+        id: item.id,
+        title: item.title,
+        link: item.link,
+        icon: item.icon || undefined,
+        target: item.type === 'blank' ? 'blank' : undefined,
+        model: item.modelResourceName || undefined,
+        actions: item.actions?.length ? describeNavigationActions(item.actions) : undefined,
+    };
+}
+/** Field names of a model resource that this user may see or write. */
+function fieldNames(adminizer, user, resource, action) {
+    // undefined = no rights on the model at all: report no fields instead of throwing.
+    return Object.keys(new DataAccessor(adminizer, user, resource, action).getFieldsConfig() ?? {});
+}
+/**
+ * Skills every agent gets for free: who it is talking to, and read/edit access
+ * scoped to exactly the data that user may reach in the admin panel. Because
+ * every call re-checks the user's permissions, an agent built on them can be
+ * offered to non-administrator accounts as well.
+ */
+export function buildBuiltinAgentSkills(adminizer) {
+    const currentUser = {
+        id: 'current_user',
+        description: 'Get the admin user this conversation belongs to: login, name, email, locale, groups and administrator flag.',
+        inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+        execute: (_input, { userIdentity }) => userIdentity,
+    };
+    const listModels = {
+        id: 'list_data_models',
+        description: 'List the data models the current user may read or edit, with their fields, allowed operations and admin URLs.',
+        inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+        execute: async (_input, { user }) => ({
+            models: (await listPermittedModels(adminizer, user)).map(({ resource, canRead, canUpdate, canCreate }) => ({
+                name: resource.name,
+                title: resource.config?.title ?? resource.name,
+                canRead,
+                canUpdate,
+                canCreate,
+                identifierField: identifierField(adminizer, resource),
+                listUrl: resource.uri,
+                recordUrlTemplate: canUpdate ? `${resource.uri}/edit/:id` : undefined,
+                fields: fieldNames(adminizer, user, resource, canUpdate ? 'edit' : 'list'),
+            })),
+        }),
+    };
+    const listNavigation = {
+        id: 'list_admin_navigation',
+        description: 'Show the admin panel navigation menu of the current user: sections, their links with sub-actions,'
+            + ' and the templates of parametrized pages such as a single record. Only entries this user may open are returned.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                query: {
+                    type: 'string',
+                    description: 'Optional words to filter menu items by title, section or path. Omit to get the whole menu.',
+                },
+            },
+            additionalProperties: false,
+        },
+        execute: async (input, { user }) => {
+            const needle = slugify(input.query);
+            const matches = (...values) => !needle || slugify(values.filter(Boolean).join(' ')).includes(needle);
+            const sections = new Map();
+            for (const item of await listAccessibleMenuItems(adminizer, user)) {
+                if (!matches(item.title, item.id, item.section, item.link, item.modelResourceName))
+                    continue;
+                const section = item.section || 'Platform';
+                if (!sections.has(section))
+                    sections.set(section, []);
+                sections.get(section).push(describeNavigationItem(item));
+            }
+            return {
+                sections: [...sections].map(([section, items]) => ({ section, items })),
+                // Record and other parametrized pages have no fixed URL, so the
+                // agent gets them as templates to fill in.
+                templates: (await adminizer.adminLinkHandler.listTemplates(user))
+                    .filter((template) => matches(template.title, template.id, template.section, template.description, template.template))
+                    .map((template) => ({
+                    id: template.id,
+                    title: template.title,
+                    template: template.template,
+                    description: template.description,
+                    section: template.section,
+                    params: template.params,
+                })),
+            };
+        },
+    };
+    const readRecords = {
+        id: 'read_model_records',
+        description: 'Read records of a data model the current user may read.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                model: { type: 'string', description: 'Model name as returned by list_data_models.' },
+                filter: { type: 'string', description: 'Optional JSON criteria object, e.g. {"title": "example"}.' },
+                fields: { type: 'array', items: { type: 'string' }, description: 'Optional subset of fields to return.' },
+                limit: {
+                    type: 'integer', minimum: 1, maximum: MAX_RECORDS,
+                    description: `Maximum number of records to return (default ${DEFAULT_RECORDS}).`,
+                },
+            },
+            required: ['model'],
+            additionalProperties: false,
+        },
+        requiresUser: true,
+        describe: async (user) => {
+            const models = await modelNames(adminizer, user, 'read');
+            return {
+                description: `Read records of a data model the current user may read. Readable models: ${models.join(', ') || 'none'}.`,
+                inputSchema: withModelEnum(readRecords.inputSchema, models),
+            };
+        },
+        execute: async (input, { user }) => {
+            const resource = await requireModel(adminizer, user, String(input.model ?? ''), 'read');
+            const criteria = parseCriteria(input.filter);
+            const limit = Math.min(Math.max(Math.trunc(Number(input.limit) || DEFAULT_RECORDS), 1), MAX_RECORDS);
+            const fields = Array.isArray(input.fields) ? input.fields.map(String) : [];
+            const accessor = new DataAccessor(adminizer, user, resource, 'list');
+            // `limit` belongs in the query: slicing afterwards would read the whole table.
+            // `total` is then a separate COUNT over the same access-scoped criteria.
+            const records = await resource.model.find({ ...criteria, limit }, accessor);
+            const total = await resource.model.count(criteria, accessor);
+            return toJsonSafe({
+                model: resource.name,
+                total,
+                count: records.length,
+                records: fields.length ? records.map((record) => pickFields(record, fields)) : records,
+            });
+        },
+    };
+    const updateRecord = {
+        id: 'update_model_record',
+        description: 'Update one record of a data model the current user may edit.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                model: { type: 'string', description: 'Model name as returned by list_data_models.' },
+                id: { type: 'string', description: 'Identifier of the record to update.' },
+                values: {
+                    type: 'object',
+                    description: 'Field values to write, e.g. {"title": "new title"}. Fields this user may not edit are dropped by the panel.',
+                    additionalProperties: true,
+                },
+            },
+            required: ['model', 'id', 'values'],
+            additionalProperties: false,
+        },
+        requiresUser: true,
+        describe: async (user) => {
+            const models = await modelNames(adminizer, user, 'update');
+            return {
+                description: `Update one record of a data model the current user may edit. Editable models: ${models.join(', ') || 'none'}.`,
+                inputSchema: withModelEnum(updateRecord.inputSchema, models),
+            };
+        },
+        execute: async (input, { user }) => {
+            const resource = await requireModel(adminizer, user, String(input.model ?? ''), 'update');
+            const id = String(input.id ?? '').trim();
+            if (!id)
+                throw new Error('id of the record to update is required');
+            const values = input.values && typeof input.values === 'object' && !Array.isArray(input.values)
+                ? input.values
+                : null;
+            if (!values || !Object.keys(values).length)
+                throw new Error('values must be a non-empty object of field values');
+            const accessor = new DataAccessor(adminizer, user, resource, 'edit');
+            const record = await resource.model.updateOne({ [identifierField(adminizer, resource)]: id }, values, accessor);
+            if (!record)
+                throw new Error(`Record "${id}" was not found in "${resource.name}".`);
+            return toJsonSafe({ model: resource.name, id, record });
+        },
+    };
+    return [currentUser, listNavigation, listModels, readRecords, updateRecord];
+}

package/lib/ai-assistant/jsonSafe.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Converts arbitrary values (ORM records, Dates, Buffers, cyclic graphs) into
+ * plain JSON data.
+ *
+ * Tool results are stored verbatim in the agent's message history and are
+ * re-validated by the AI SDK against its `ModelMessage[]` schema on every
+ * subsequent turn. A single non-JSON value — a `Date` from a Sequelize record,
+ * for example — therefore does not fail the call that produced it: it poisons
+ * the session and every later turn dies with `Invalid prompt: The messages do
+ * not match the ModelMessage[] schema`. Passing tool output through this
+ * helper keeps that class of failure out of the history.
+ */
+export declare function toJsonSafe<T>(value: T): unknown;

package/lib/ai-assistant/jsonSafe.js

@@ -0,0 +1,81 @@
+/**
+ * Converts arbitrary values (ORM records, Dates, Buffers, cyclic graphs) into
+ * plain JSON data.
+ *
+ * Tool results are stored verbatim in the agent's message history and are
+ * re-validated by the AI SDK against its `ModelMessage[]` schema on every
+ * subsequent turn. A single non-JSON value — a `Date` from a Sequelize record,
+ * for example — therefore does not fail the call that produced it: it poisons
+ * the session and every later turn dies with `Invalid prompt: The messages do
+ * not match the ModelMessage[] schema`. Passing tool output through this
+ * helper keeps that class of failure out of the history.
+ */
+const MAX_DEPTH = 12;
+export function toJsonSafe(value) {
+    return convert(value, new WeakSet(), 0);
+}
+function convert(value, seen, depth) {
+    if (value === null)
+        return null;
+    switch (typeof value) {
+        case 'string':
+        case 'boolean':
+            return value;
+        case 'number':
+            return Number.isFinite(value) ? value : null;
+        case 'bigint':
+            return value.toString();
+        case 'undefined':
+        case 'function':
+        case 'symbol':
+            return undefined;
+    }
+    const object = value;
+    if (value instanceof Date)
+        return Number.isNaN(value.getTime()) ? null : value.toISOString();
+    if (value instanceof Error)
+        return value.message;
+    if (value instanceof RegExp)
+        return value.toString();
+    if (typeof Buffer !== 'undefined' && Buffer.isBuffer(value))
+        return `<binary ${value.length} bytes>`;
+    if (ArrayBuffer.isView(value))
+        return `<binary ${value.byteLength} bytes>`;
+    if (value instanceof ArrayBuffer)
+        return `<binary ${value.byteLength} bytes>`;
+    if (seen.has(object))
+        return '[Circular]';
+    if (depth >= MAX_DEPTH)
+        return '[MaxDepth]';
+    seen.add(object);
+    try {
+        if (Array.isArray(value)) {
+            // JSON.stringify turns array holes and `undefined` items into null.
+            return value.map((item) => {
+                const converted = convert(item, seen, depth + 1);
+                return converted === undefined ? null : converted;
+            });
+        }
+        if (value instanceof Set)
+            return convert([...value], seen, depth);
+        if (value instanceof Map) {
+            return convert(Object.fromEntries([...value].map(([key, item]) => [String(key), item])), seen, depth);
+        }
+        // Sequelize instances, Decimal, Luxon and friends: let them describe
+        // themselves first, then normalize whatever they produced.
+        const toJSON = value.toJSON;
+        if (typeof toJSON === 'function') {
+            return convert(toJSON.call(value), seen, depth + 1);
+        }
+        const result = {};
+        for (const [key, item] of Object.entries(value)) {
+            const converted = convert(item, seen, depth + 1);
+            if (converted !== undefined)
+                result[key] = converted;
+        }
+        return result;
+    }
+    finally {
+        seen.delete(object);
+    }
+}

package/lib/app-manager/AdminizerApp.d.ts

@@ -1,5 +1,5 @@
 import type { ActionType, AdminpanelConfig, AdminpanelIcon, ModelConfig } from "../../interfaces/adminpanelConfig.js";
-import type { AccessRightsToken, INotification, ModelResource } from "../../interfaces/types.js";
+import type { AccessRightsToken, INotification, ModelResource, PermissionContext } from "../../interfaces/types.js";
 import type { AbstractCatalog } from "../catalog/AbstractCatalog.js";
 import type { CatalogTemplateComponentResource } from "../catalog/CatalogTemplateComponentHandler.js";
 import type { AppModelAccess } from "../model/ModelHandler.js";
@@ -8,6 +8,9 @@ import type { Config, ControlType } from "../controls/Control.js";
 import type { User } from "../../models/User.js";
 import type { DataAccessor } from "../DataAccessor.js";
 import type { AbstractAiModelService } from "../ai-assistant/AbstractAiModelService.js";
+import type { AiAssistantUiMethod } from '../ai-assistant/AiAssistantUiMethodHandler.js';
+import type { AdminLink, AdminLinkTemplate } from '../admin-links/AdminLinkHandler.js';
+import type { AiAssistantAgentSkill } from '../ai-assistant/AiAssistantAgentSkillHandler.js';
 export type AppDisposer = () => void | Promise<void>;
 export type AppEventName = string | symbol;
 export type AppEventHandler<TPayload = any> = (payload: TPayload, runtime: AppRuntime) => void | Promise<void>;
@@ -127,9 +130,14 @@ export type AppWidgetResource = AppInfoWidgetResource | AppActionWidgetResource
 export interface AppRuntime {
     models: AppModelAccess;
     config: AppRuntimeConfig;
+    accessRights: AppRuntimeAccessRights;
     notifications: AppRuntimeNotifications;
     apps: AppRuntimeApps;
 }
+export interface AppRuntimeAccessRights {
+    hasPermission(token: string, user: User, context?: PermissionContext): Promise<boolean>;
+    getPermissionRights(token: string, user: User): string[] | null;
+}
 export interface AppRuntimeConfig {
     readonly routePrefix: string;
     getModelConfig(modelName: string): ModelConfig | undefined;
@@ -171,12 +179,28 @@ export interface AppAiAssistantContext {
     routePrefix: string;
     getModelResources(): ModelResource[];
     resolveModelResource(modelName: string): ModelResource | undefined;
-    hasPermission(token: string, user: User): boolean;
+    hasPermission(token: string, user: User): Promise<boolean>;
     createDataAccessor(modelResource: ModelResource, user: User, action: ActionType): DataAccessor;
+    /** UI tools available to this user, including methods registered by apps. */
+    getUiMethods(user: User): Promise<AiAssistantUiMethod[]>;
 }
 export interface AppAiAssistantResource {
     models: Array<(context: AppAiAssistantContext) => AbstractAiModelService | Promise<AbstractAiModelService>>;
 }
+export interface AppAiAssistantUiMethodResource extends AiAssistantUiMethod {
+    id: string;
+}
+export interface AppAiAssistantAgentSkillResource extends AiAssistantAgentSkill {
+}
+/** Skills contributed by an app. UI methods are browser skills; agent skills run on the server. */
+export interface AppSkills {
+    uiMethod(method: AppAiAssistantUiMethodResource): void;
+    agent(skill: AppAiAssistantAgentSkillResource): void;
+}
+export interface AppAdminLinkResource extends AdminLink {
+}
+export interface AppAdminLinkTemplateResource extends AdminLinkTemplate {
+}
 /**
  * Resource registration API provided while an app is being enabled.
  *
@@ -197,6 +221,11 @@ export interface AppSetupContext {
     model(model: AppModelResource): void;
     modelAccess(access: AppModelAccessResource): void;
     aiAssistant(resource: AppAiAssistantResource): void;
+    skills: AppSkills;
+    /** Register a standalone server page in the admin navigation and agent search. */
+    adminLink(link: AppAdminLinkResource): void;
+    /** Register a parametrized page (e.g. `/admin/orders/:id/invoice`) the assistant may open. */
+    adminLinkTemplate(template: AppAdminLinkTemplateResource): void;
     listener(event: AppEventName, handler: AppEventHandler): void;
 }
 /**

package/lib/app-manager/AppManager.js

@@ -1,5 +1,6 @@
 import { Adminizer } from "../Adminizer.js";
 import { DataAccessor } from "../DataAccessor.js";
+import { listModelResources, resolveModelResource } from "../../helpers/modelResourceHelper.js";
 class RuntimeAppSetupContext {
     adminizer;
     appName;
@@ -7,6 +8,8 @@ class RuntimeAppSetupContext {
     pendingModelRegistrations = [];
     pendingModelAccessRegistrations = [];
     pendingAiAssistantRegistrations = [];
+    pendingAiAssistantUiMethodRegistrations = [];
+    pendingAiAssistantAgentSkillRegistrations = [];
     pendingMediaManagerRegistrations = [];
     pendingCatalogRegistrations = [];
     configLayerIndex = 0;
@@ -14,7 +17,12 @@ class RuntimeAppSetupContext {
     constructor(adminizer, appName) {
         this.adminizer = adminizer;
         this.appName = appName;
+        this.skills = {
+            uiMethod: (method) => this.registerAiAssistantUiMethod(method),
+            agent: (skill) => this.registerAiAssistantAgentSkill(skill),
+        };
     }
+    skills;
     asset(asset) {
         const resourceId = `${this.appName}:${asset.id}`;
         const url = this.adminizer.assetHandler.register(this.appName, asset);
@@ -114,6 +122,32 @@ class RuntimeAppSetupContext {
     aiAssistant(resource) {
         this.pendingAiAssistantRegistrations.push(() => this.registerAiAssistant(resource));
     }
+    registerAiAssistantUiMethod(method) {
+        this.pendingAiAssistantUiMethodRegistrations.push(async () => {
+            this.adminizer.aiAssistantUiMethodHandler.register(method, this.appName);
+            this.disposers.push(() => this.adminizer.aiAssistantUiMethodHandler.unregister(method.id, this.appName));
+        });
+    }
+    registerAiAssistantAgentSkill(skill) {
+        this.pendingAiAssistantAgentSkillRegistrations.push(async () => {
+            this.adminizer.aiAssistantAgentSkillHandler.add(skill, this.appName);
+            this.disposers.push(() => {
+                this.adminizer.aiAssistantAgentSkillHandler.remove(skill.id, this.appName);
+            });
+        });
+    }
+    adminLink(link) {
+        const resourceId = this.adminizer.adminLinkHandler.add(link, this.appName);
+        this.disposers.push(() => {
+            this.adminizer.adminLinkHandler.remove(resourceId, this.appName);
+        });
+    }
+    adminLinkTemplate(template) {
+        const resourceId = this.adminizer.adminLinkHandler.addTemplate(template, this.appName);
+        this.disposers.push(() => {
+            this.adminizer.adminLinkHandler.removeTemplate(resourceId, this.appName);
+        });
+    }
     listener(event, handler) {
         const resourceId = `${this.appName}:${event.toString()}:${this.disposers.length + 1}`;
         const listener = (payload) => handler(payload, this.adminizer.appManager.createRuntime(this.appName));
@@ -136,6 +170,8 @@ class RuntimeAppSetupContext {
         await this.runRegistrationPhase(this.pendingModelRegistrations);
         await this.runRegistrationPhase(this.pendingModelAccessRegistrations);
         await this.runRegistrationPhase(this.pendingAiAssistantRegistrations);
+        await this.runRegistrationPhase(this.pendingAiAssistantUiMethodRegistrations);
+        await this.runRegistrationPhase(this.pendingAiAssistantAgentSkillRegistrations);
         await this.runRegistrationPhase(this.pendingMediaManagerRegistrations);
         await this.runRegistrationPhase(this.pendingCatalogRegistrations);
     }
@@ -350,52 +386,13 @@ class RuntimeAppSetupContext {
         return {
             runtime: this.adminizer.appManager.createRuntime(this.appName),
             routePrefix: this.adminizer.config.routePrefix,
-            getModelResources: () => this.getModelResources(),
-            resolveModelResource: (modelName) => this.resolveModelResource(modelName),
+            getModelResources: () => listModelResources(this.adminizer),
+            resolveModelResource: (modelName) => resolveModelResource(this.adminizer, modelName),
             hasPermission: (token, user) => this.adminizer.accessRightsHelper.hasPermission(token, user),
             createDataAccessor: (modelResource, user, action) => new DataAccessor(this.adminizer, user, modelResource, action),
+            getUiMethods: (user) => this.adminizer.aiAssistantUiMethodHandler.getAvailable(user),
         };
     }
-    getModelResources() {
-        const resources = [];
-        for (const [configName, configValue] of Object.entries(this.adminizer.config.models ?? {})) {
-            const normalizedConfig = this.normalizeModelConfig(configName, configValue);
-            const model = this.adminizer.modelHandler.model.get(normalizedConfig.model.toLowerCase());
-            if (!model) {
-                continue;
-            }
-            resources.push({
-                name: configName,
-                uri: `${this.adminizer.config.routePrefix}/model/${configName}`,
-                config: normalizedConfig,
-                model,
-            });
-        }
-        return resources;
-    }
-    resolveModelResource(modelName) {
-        const loweredName = modelName.toLowerCase();
-        return this.getModelResources().find((resource) => {
-            const modelId = resource.config.model?.toLowerCase();
-            return resource.name.toLowerCase() === loweredName || modelId === loweredName;
-        });
-    }
-    normalizeModelConfig(name, config) {
-        const baseConfig = {
-            model: name,
-            icon: "description",
-            title: name,
-            list: true,
-            add: true,
-            edit: true,
-            remove: true,
-            view: true,
-        };
-        if (typeof config === "boolean") {
-            return config ? baseConfig : { ...baseConfig, list: false, add: false, edit: false, remove: false, view: false };
-        }
-        return { ...baseConfig, ...config };
-    }
 }
 export class AppManager {
     adminizer;
@@ -508,6 +505,10 @@ export class AppManager {
                     return modelKey ? models[modelKey] : undefined;
                 },
             },
+            accessRights: {
+                hasPermission: async (token, user, context) => await this.adminizer.accessRightsHelper.hasPermission(token, user, context),
+                getPermissionRights: (token, user) => this.adminizer.accessRightsHelper.getPermissionRights(token, user),
+            },
             notifications: {
                 send: (notification) => this.adminizer.sendNotification(notification),
             },

package/lib/app-manager/ConfigLayerHandler.js

@@ -1,3 +1,4 @@
+import { refreshInternalModelAccess } from "../../system/buildInternalModelAccess.js";
 function cloneConfigValue(value) {
     if (Array.isArray(value)) {
         return value.map((item) => cloneConfigValue(item));
@@ -112,6 +113,9 @@ export class ConfigLayerHandler {
             delete targetConfig[key];
         }
         Object.assign(this.adminizer.config, rebuilt);
+        // The rebuilt config may change what the record-access resolvers query (e.g. an
+        // app-patched accessGraph), so the internal allowlists must follow synchronously.
+        refreshInternalModelAccess(this.adminizer);
     }
     getLayerId(appName, layerId) {
         return `${appName}:${layerId}`;