adminizer 5.0.0-build.9 → 5.1.0-build.24

package/lib/notifications/GeneralNotificationService.js

@@ -6,23 +6,24 @@ export class GeneralNotificationService extends AbstractNotificationService {
     icon = 'info';
     iconColor = '#5987de';
     async dispatchNotification(notification) {
+        const { userId, ...notificationData } = notification;
         const fullNotification = {
-            ...notification,
+            ...notificationData,
             notificationClass: this.notificationClass
         };
         let notificationDB;
         try {
             notificationDB = await this.notificationModel().create(fullNotification);
-            if (notification.userId) {
+            if (userId) {
                 // For specific user
-                await this.createUserNotification(notificationDB.id, notification.userId);
+                await this.createUserNotification(notificationDB.id, userId);
             }
             else {
                 // For all users
                 const users = await this.userModel().find({});
                 for (const user of users) {
                     try {
-                        if (this.adminizer.accessRightsHelper.hasPermission(`notification-${this.notificationClass}`, user)) {
+                        if (await this.adminizer.accessRightsHelper.hasPermission(`notification-${this.notificationClass}`, user)) {
                             await this.createUserNotification(notificationDB.id, user.id);
                         }
                         else {
@@ -45,7 +46,7 @@ export class GeneralNotificationService extends AbstractNotificationService {
                     },
                 },
                 notificationClass: this.notificationClass,
-                userId: notification.userId ?? null
+                userId: userId ?? null
             };
             this.broadcast(event);
             Adminizer.log.info(`[General] Notification dispatched: ${fullNotification.title}`);

package/lib/notifications/SystemNotificationService.js

@@ -19,7 +19,7 @@ export class SystemNotificationService extends AbstractNotificationService {
             const users = await this.userModel().find({});
             for (const user of users) {
                 try {
-                    if (this.adminizer.accessRightsHelper.hasPermission(`notification-${this.notificationClass}`, user)) {
+                    if (await this.adminizer.accessRightsHelper.hasPermission(`notification-${this.notificationClass}`, user)) {
                         await this.createUserNotification(notificationDB.id, user.id);
                     }
                 }

package/lib/ui-i18n/uiTranslationKeys.d.ts

@@ -1,6 +1,7 @@
-export declare const COMMON_UI_TRANSLATION_KEYS: readonly ["Delete", "Diff", "Preview", "Add", "Search", "Yes", "No", "On", "Off", "Hide", "Show", "No notifications found", "No notifications", "No widgets found", "Changes not found", "Old", "New", "Added", "Removed", "Updated", "changed type", "Error: Invalid field data", "Error: Fields data is invalid", "No fields to display", "Error: Some fields are missing required properties (name, type, label)", "Edit", "create", "Clean", "Are you sure?", "Select Item type", "Select Ids", "Open in a new window", "Visible", "Performing an action...", "Action completed", "Action failed", "Save", "First", "Last", "Previous", "Next", "Send feedback", "Feedback", "Title", "Description", "Attach files", "Send", "Sending...", "Feedback sent successfully", "Title is required", "File size exceeds the 5 MB limit", "Remove file", "Max 5 MB per file", "View All", "Make read", "Make all read", "Message", "Date", "Watch", "Current", "There is no history"];
+export declare const COMMON_UI_TRANSLATION_KEYS: readonly ["Delete", "Diff", "Preview", "Add", "Search", "Yes", "No", "On", "Off", "Hide", "Show", "No notifications found", "No notifications", "No widgets found", "Changes not found", "Old", "New", "Added", "Removed", "Updated", "changed type", "Error: Invalid field data", "Error: Fields data is invalid", "No fields to display", "Error: Some fields are missing required properties (name, type, label)", "Edit", "create", "Clean", "Are you sure?", "Select Item type", "Select Ids", "Open in a new window", "Visible", "Performing an action...", "Action completed", "Action failed", "Save", "First", "Last", "Previous", "Next", "Send feedback", "Feedback", "Title", "Description", "Attach files", "Send", "Sending...", "Feedback sent successfully", "Title is required", "File size exceeds the 5 MB limit", "Remove file", "Max 5 MB per file", "View All", "Make read", "Make all read", "Message", "Date", "Watch", "Current", "There is no history", "Documentation", "Page documentation", "Knowledge base", "Schema", "Back to contents", "Open in knowledge base", "Send to assistant", "Failed to load documentation", "Loading...", "Nothing found", "Field", "Type", "Required", "Language"];
 export declare const FILTER_UI_TRANSLATION_KEYS: readonly ["Filters", "Saved filters", "Active filter", "Add filter", "Reset filter", "Reset", "Equal", "Not equal", "Contains", "Not contains", "Starts with", "Ends with", "Is empty", "Is not empty", "Greater than", "Greater or equal", "Less than", "Less or equal", "Between", "After", "After or equal", "Before", "Before or equal", "In list", "Not in list", "Is null", "Is not null", "Yes", "No", "From", "To", "From...", "To...", "Date...", "Today", "Month", "Month range", "Year", "Year range", "Value...", "Select...", "selected", "Search...", "No results", "Error", "Model not found", "Error applying filter", "Enter filter name", "Temporary filter", "Error: model not found", "Error loading columns", "Network error", "Columns settings", "Available columns", "Visible columns", "Add all", "Hide all", "No available columns", "Move columns here", "Save changes", "Apply", "Save", "Back", "Cancel", "conditions", "modified", "Private filter", "For groups", "Public filter", "Only for you", "For selected groups", "For all users", "Visible only to you", "Visible only to your group", "API access (feed)", "Hide", "Show", "Regenerate", "copied to clipboard", "Failed to copy", "Loading filters...", "No saved filters", "Save current filter for quick access", "Someone else's private filter (owner:", "unknown)", "Owner", "Apply filter", "Delete filter", "No permission to delete filter", "Edit filter", "New filter", "Filter conditions", "Add condition", "Select field", "No conditions. Add a condition above.", "Name", "Description", "Icon", "Color", "Filter parameters", "Change filter conditions and parameters", "Configure filter conditions", "Specify name and parameters for saving", "Someone else's private filter", "You cannot change someone else's filter visibility", "Private", "Public", "Visibility", "Export", "Exporting...", "Export is only available with an active filter", "Export to", "completed", "Export error", "Data in JSON format", "Text format CSV", "Excel file", "Conditions", "Access for groups", "Selected groups", "Groups list", "Columns", "Saving...", "Error saving filter", "Column configuration", "Select and arrange columns to display in the table", "Loading columns...", "Use buttons", "to move and", "to change order", "Add", "Edit", "Save filter", "and", "Custom filtering", "Select a saved filter or create a new one", "Select a filter or create a new one", "Filter visibility", "Unknown", "JSON URL", "XML URL", "API key is not created", "The key is not created. Create it or contact an administrator.", "OK"];
 export declare const HISTORY_UI_TRANSLATION_KEYS: readonly ["Models", "All", "Users", "Date", "Pick a date", "Search", "Reset", "Model", "Name", "Event", "User", "Diff", "The end of the list has been reached", "There are no records to display"];
 export declare const HISTORY_TABLE_UI_TRANSLATION_KEYS: readonly ["Event", "Date", "User", "Watch", "Current", "There is no history", "Diff"];
 export declare const NOTIFICATION_UI_TRANSLATION_KEYS: readonly ["Make read", "View All", "Search", "Make all read", "Title", "Message", "Date", "Diff", "No notifications", "No notifications found", "The end of the list has been reached"];
 export declare const USER_FILTERS_UI_TRANSLATION_KEYS: readonly ["Loading...", "Search filters...", "All models", "No filters found", "Loading more...", "Filter Name", "Model", "Visibility", "API access (feed)", "Owner", "Private", "Public", "Groups", "Yes", "No", "You", "Unknown", "Reset", "found", "User Filters"];
+export declare const DOCS_UI_TRANSLATION_KEYS: readonly ["Documentation", "Knowledge base", "Contents", "Search documentation", "Search", "Keywords", "Clear", "Nothing found", "There is no documentation yet", "Select a document to read", "Loading...", "Language", "Send to assistant", "Schema", "Related models", "Failed to load documentation", "Field", "Type", "Required", "No fields to display", "Previous", "Next", "Found", "In this document", "Document not found"];

package/lib/ui-i18n/uiTranslationKeys.js

@@ -59,7 +59,21 @@ export const COMMON_UI_TRANSLATION_KEYS = [
     "Date",
     "Watch",
     "Current",
-    "There is no history"
+    "There is no history",
+    "Documentation",
+    "Page documentation",
+    "Knowledge base",
+    "Schema",
+    "Back to contents",
+    "Open in knowledge base",
+    "Send to assistant",
+    "Failed to load documentation",
+    "Loading...",
+    "Nothing found",
+    "Field",
+    "Type",
+    "Required",
+    "Language"
 ];
 export const FILTER_UI_TRANSLATION_KEYS = [
     "Filters",
@@ -267,3 +281,30 @@ export const USER_FILTERS_UI_TRANSLATION_KEYS = [
     "found",
     "User Filters"
 ];
+export const DOCS_UI_TRANSLATION_KEYS = [
+    "Documentation",
+    "Knowledge base",
+    "Contents",
+    "Search documentation",
+    "Search",
+    "Keywords",
+    "Clear",
+    "Nothing found",
+    "There is no documentation yet",
+    "Select a document to read",
+    "Loading...",
+    "Language",
+    "Send to assistant",
+    "Schema",
+    "Related models",
+    "Failed to load documentation",
+    "Field",
+    "Type",
+    "Required",
+    "No fields to display",
+    "Previous",
+    "Next",
+    "Found",
+    "In this document",
+    "Document not found"
+];

package/lib/widgets/widgetHandler.js

@@ -116,7 +116,11 @@ export class WidgetHandler {
         const filterService = new FilterService(this.adminizer);
         const result = [];
         for (const modelName of modelNames) {
-            if (!this.adminizer.accessRightsHelper.hasPermission(`read-${modelName}-model`, user)) {
+            const readToken = `read-${modelName}-model`;
+            if (!this.adminizer.accessRightsHelper.hasToken(readToken)) {
+                continue;
+            }
+            if (!await this.adminizer.accessRightsHelper.hasPermission(readToken, user)) {
                 continue;
             }
             let filters = [];
@@ -163,7 +167,7 @@ export class WidgetHandler {
             let id_key = 0;
             for (const widget of this.widgets) {
                 if (widget.widgetType === 'switcher') {
-                    if (this.adminizer.accessRightsHelper.hasPermission(this.resolveAccessRightsToken(widget), dashboardUser)) {
+                    if (await this.adminizer.accessRightsHelper.hasPermission(this.resolveAccessRightsToken(widget), dashboardUser)) {
                         widgets.push({
                             id: `${widget.id}__${id_key}`,
                             type: widget.widgetType,
@@ -178,7 +182,7 @@ export class WidgetHandler {
                     }
                 }
                 else if (widget.widgetType === 'info') {
-                    if (this.adminizer.accessRightsHelper.hasPermission(this.resolveAccessRightsToken(widget), dashboardUser)) {
+                    if (await this.adminizer.accessRightsHelper.hasPermission(this.resolveAccessRightsToken(widget), dashboardUser)) {
                         widgets.push({
                             id: `${widget.id}__${id_key}`,
                             type: widget.widgetType,
@@ -195,7 +199,7 @@ export class WidgetHandler {
                     }
                 }
                 else if (widget.widgetType === 'action') {
-                    if (this.adminizer.accessRightsHelper.hasPermission(this.resolveAccessRightsToken(widget), dashboardUser)) {
+                    if (await this.adminizer.accessRightsHelper.hasPermission(this.resolveAccessRightsToken(widget), dashboardUser)) {
                         widgets.push({
                             id: `${widget.id}__${id_key}`,
                             type: widget.widgetType,
@@ -210,7 +214,7 @@ export class WidgetHandler {
                     }
                 }
                 else if (widget.widgetType === 'link') {
-                    if (this.adminizer.accessRightsHelper.hasPermission(this.resolveAccessRightsToken(widget), dashboardUser)) {
+                    if (await this.adminizer.accessRightsHelper.hasPermission(this.resolveAccessRightsToken(widget), dashboardUser)) {
                         let links_id_key = 0;
                         for (const link of widget.links) {
                             widgets.push({
@@ -229,7 +233,7 @@ export class WidgetHandler {
                     }
                 }
                 else if (widget.widgetType === 'custom') {
-                    if (this.adminizer.accessRightsHelper.hasPermission(this.resolveAccessRightsToken(widget), dashboardUser)) {
+                    if (await this.adminizer.accessRightsHelper.hasPermission(this.resolveAccessRightsToken(widget), dashboardUser)) {
                         widgets.push({
                             id: `${widget.id}_${id_key}`,
                             type: widget.widgetType,

package/models/Group.d.ts

@@ -1,8 +1,9 @@
 import type { User } from "./User.js";
+import type { PermissionGrant } from "../interfaces/types.js";
 export interface Group {
     id?: number;
     name: string;
     description?: string;
-    tokens?: string[];
+    tokens?: PermissionGrant[];
     users?: User[];
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "adminizer",
   "type": "module",
-  "version": "5.0.0-build.9",
+  "version": "5.1.0-build.24",
   "main": "index.js",
   "exports": {
     ".": "./index.js",
@@ -21,7 +21,7 @@
     "dev:typeorm:no-seed": "cross-env ADMINIZER_ENV=dev NO_SEED_DATA=true ORM=typeorm tsx watch --tsconfig ./fixture/tsconfig.json ./fixture/index.ts",
     "dev:no-seed-clean": "cross-env ADMINIZER_ENV=dev NO_SEED_DATA=true CLEAN_TMP=true ORM=sequelize tsx watch --tsconfig ./fixture/tsconfig.json ./fixture/index.ts",
     "dev:cors": "cross-env ADMINIZER_ENV=dev NO_SEED_DATA=true ORM=sequelize FRONTEND_URL=http://localhost:8080 tsx watch --tsconfig ./fixture/tsconfig.json ./fixture/index.ts",
-    "build:assets": "vite build && vite build --config vite.config.controls.ts && vite build --config fixture/widgets/vite.config.widget.ts",
+    "build:assets": "vite build && vite build --config vite.config.controls.ts && vite build --config vite.config.ai-assistant.ts && vite build --config fixture/widgets/vite.config.widget.ts",
     "build:controls": "vite build --config vite.config.controls.ts",
     "compile:backend": "tsc -p src/tsconfig.json && node ./scripts/appendJsExtension.js",
     "compile:ui": "tsc -p tsconfig.ui.json",
@@ -31,7 +31,10 @@
     "build": "npm run copy:backend && npm run compile:backend && npm run compile:ui && npm run build:assets",
     "build:catalog-modules": "cross-env CATALOG_COMPONENT=catalogAction vite build --config fixture/virtual-catalog/vite.config.module.ts && cross-env CATALOG_COMPONENT=Group vite build --config fixture/virtual-catalog/vite.config.module.ts",
     "start:typeorm:seed": "cross-env ORM=typeorm tsx --tsconfig ./fixture/tsconfig.json ./fixture/index.ts",
-    "build:apps": "vite build --config fixture/apps/notification-sender/vite.config.module.ts && vite build --config fixture/apps/module-manager/vite.config.module.ts && vite build --config fixture/apps/navigation/vite.config.module.ts && vite build --config fixture/apps/quill-editor/vite.config.module.ts && vite build --config fixture/apps/widgets/vite.config.module.ts && vite build --config fixture/apps/handsontable-test/vite.config.module.ts && npm run build:catalog-modules"
+    "build:apps": "vite build --config fixture/apps/notification-sender/vite.config.module.ts && vite build --config fixture/apps/module-manager/vite.config.module.ts && vite build --config fixture/apps/navigation/vite.config.module.ts && vite build --config fixture/apps/quill-editor/vite.config.module.ts && vite build --config fixture/apps/widgets/vite.config.module.ts && vite build --config fixture/apps/handsontable-test/vite.config.module.ts && vite build --config fixture/apps/record-scope-test/vite.config.module.ts && npm run build:catalog-modules",
+    "build:ai-assistant": "vite build --config vite.config.ai-assistant.ts",
+    "lint": "eslint src",
+    "lint:async": "eslint src -c eslint.config.async.mjs"
   },
   "keywords": [],
   "author": "Siziy Ivan <xziy88@gmail.com>",
@@ -59,41 +62,34 @@
     "jsonwebtoken": "^9.0.3",
     "multer": "^2.1.1",
     "password-hash": "^1.2.2",
+    "serve-static": "^2.2.1",
     "sharp": "^0.33.5",
     "sprintf-js": "^1.1.3",
+    "sqlite3": "^5.1.7",
+    "typeorm": "^0.3.20",
     "uuid": "^14.0.0",
     "winston": "^3.17.0",
     "xlsx": "^0.18.5",
-    "zod": "^4.1.11",
-    "sqlite3": "^5.1.7",
-    "typeorm": "^0.3.20"
+    "zod": "^4.1.11"
   },
   "devDependencies": {
-    "reflect-metadata": "^0.2.2",
-    "react-dnd": "^16.0.1",
-    "react-cropper": "^2.3.3",
-    "material-icons": "^1.13.14",
-    "next-themes": "^0.4.6",
-    "dotenv": "^17.4.2",
-    "date-fns": "^3.6.0",
-    "cmdk": "^1.1.1",
-    "@handsontable/react-wrapper": "^17.0.1",
-    "@minoru/react-dnd-treeview": "^3.5.2",
-    "@radix-ui/react-context-menu": "^2.2.15",
-    "@radix-ui/react-tabs": "^1.1.12",
-    "typescript": "^6.0.3",
+    "@assistant-ui/react": "^0.15.15",
+    "@assistant-ui/react-markdown": "^0.14.6",
     "@babel/plugin-proposal-decorators": "^7.27.1",
     "@ckeditor/ckeditor5-react": "^9.5.0",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@eslint/compat": "^1.2.9",
     "@faker-js/faker": "^9.7.0",
+    "@handsontable/react-wrapper": "^17.0.1",
     "@inertiajs/react": "^3.0.3",
+    "@minoru/react-dnd-treeview": "^3.5.2",
     "@monaco-editor/react": "^4.7.0",
     "@openai/agents": "^0.3.2",
     "@radix-ui/react-avatar": "^1.1.3",
     "@radix-ui/react-checkbox": "^1.1.4",
     "@radix-ui/react-collapsible": "^1.1.3",
+    "@radix-ui/react-context-menu": "^2.2.15",
     "@radix-ui/react-dialog": "^1.1.7",
     "@radix-ui/react-dropdown-menu": "^2.1.6",
     "@radix-ui/react-label": "^2.1.2",
@@ -105,6 +101,7 @@
     "@radix-ui/react-slider": "^1.2.3",
     "@radix-ui/react-slot": "^1.2.0",
     "@radix-ui/react-switch": "^1.2.4",
+    "@radix-ui/react-tabs": "^1.1.12",
     "@radix-ui/react-tooltip": "^1.1.8",
     "@tailwindcss/vite": "^4.0.15",
     "@tanstack/react-table": "^8.21.2",
@@ -127,12 +124,17 @@
     "@types/react-grid-layout": "^1.3.5",
     "@types/sprintf-js": "^1.1.4",
     "@types/uuid": "^10.0.0",
-    "@typescript-eslint/eslint-plugin": "^8.32.1",
+    "@typescript-eslint/eslint-plugin": "^8.67.0",
+    "@typescript-eslint/parser": "^8.67.0",
     "@vitejs/plugin-react": "^5.2.0",
+    "asmcrypto.js": "^0.22.0",
     "ckeditor5": "^45.0.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
+    "cmdk": "^1.1.1",
     "cross-env": "^7.0.3",
+    "date-fns": "^3.6.0",
+    "dotenv": "^17.4.2",
     "eslint": "^9.26.0",
     "handsontable": "^17.0.1",
     "isomorphic-webcrypto": "^2.3.8",
@@ -141,14 +143,22 @@
     "leaflet-draw": "^1.0.4",
     "lodash-es": "^4.17.21",
     "lucide-react": "^0.485.0",
-    "react": "^19.0.0",
+    "material-icons": "^1.13.14",
+    "mermaid": "^11.17.0",
+    "next-themes": "^0.4.6",
+    "radix-ui": "^1.6.7",
+    "react": "19.2.8",
+    "react-cropper": "^2.3.3",
     "react-day-picker": "^8.10.1",
-    "react-dom": "^19.0.0",
+    "react-dnd": "^16.0.1",
+    "react-dom": "19.2.8",
     "react-grid-layout": "^1.5.1",
     "react-intersection-observer": "^9.16.0",
     "react-leaflet": "^5.0.0",
     "react-quill-new": "^3.4.6",
     "react-simple-wysiwyg": "^3.2.2",
+    "reflect-metadata": "^0.2.2",
+    "remark-gfm": "^4.0.1",
     "sequelize": "^6.37.7",
     "sequelize-typescript": "^2.1.6",
     "shelljs": "^0.9.2",
@@ -157,10 +167,12 @@
     "tailwindcss": "^4.0.15",
     "tsx": "^4.21.0",
     "tw-animate-css": "^1.2.5",
+    "typescript": "^6.0.3",
     "vanilla-jsoneditor": "^3.1.1",
     "vite": "^7.3.2",
     "vite-plugin-externals": "^0.6.2",
-    "vitest": "^3.0.7"
+    "vitest": "^3.0.7",
+    "zustand": "^5.0.14"
   },
   "overrides": {
     "@toast-ui/react-editor": {

package/policies/authPolicies.js

@@ -20,7 +20,7 @@ function resolveToken(token, req) {
     return token;
 }
 export function requireAuthEnabled() {
-    return (req, res, next) => {
+    return async (req, res, next) => {
         if (!req.adminizer.config.auth.enable) {
             return res.status(403).json({ error: "Auth is disabled" });
         }
@@ -28,7 +28,7 @@ export function requireAuthEnabled() {
     };
 }
 export function requireAuthUI() {
-    return (req, res, next) => {
+    return async (req, res, next) => {
         if (req.adminizer.config.auth.enable && !req.user) {
             unauthorized(req, res, "ui");
             return;
@@ -64,7 +64,7 @@ export function requireAdmin(options = {}) {
 }
 export function requirePermission(token, options = {}) {
     const mode = options.mode || "api";
-    return (req, res, next) => {
+    return async (req, res, next) => {
         if (!req.adminizer.config.auth.enable) {
             return next();
         }
@@ -73,7 +73,7 @@ export function requirePermission(token, options = {}) {
             return;
         }
         const tokenId = resolveToken(token, req);
-        const hasPermission = req.adminizer.accessRightsHelper.hasPermission(tokenId, req.user);
+        const hasPermission = await req.adminizer.accessRightsHelper.hasPermission(tokenId, req.user);
         if (!hasPermission) {
             forbidden(req, res, mode);
             return;
@@ -83,7 +83,7 @@ export function requirePermission(token, options = {}) {
 }
 export function requireAnyPermission(tokens, options = {}) {
     const mode = options.mode || "api";
-    return (req, res, next) => {
+    return async (req, res, next) => {
         if (!req.adminizer.config.auth.enable) {
             return next();
         }
@@ -94,7 +94,7 @@ export function requireAnyPermission(tokens, options = {}) {
         const tokenIds = tokens
             .map((token) => resolveToken(token, req))
             .filter((token) => Boolean(token));
-        const hasPermission = req.adminizer.accessRightsHelper.enoughPermissions(tokenIds, req.user);
+        const hasPermission = await req.adminizer.accessRightsHelper.enoughPermissions(tokenIds, req.user);
         if (!hasPermission) {
             forbidden(req, res, mode);
             return;

package/policies/permissionResolvers.d.ts

@@ -8,5 +8,6 @@ export declare function widgetsToken(): string;
 export declare function catalogToken(req: ReqType): string | undefined;
 export declare function mediaManagerToken(req: ReqType): string | undefined;
 export declare function aiModelToken(req: ReqType): string | undefined;
+export declare function documentationToken(req: ReqType): string;
 export declare function historyToken(req: ReqType): string;
 export declare function groupFilterVisibilityToken(): string;

package/policies/permissionResolvers.js

@@ -44,6 +44,9 @@ export function aiModelToken(req) {
     const modelId = req.params?.modelId || (typeof req.body?.modelId === "string" ? req.body.modelId : undefined);
     return modelId ? `ai-assistant-${modelId}` : undefined;
 }
+export function documentationToken(req) {
+    return req.adminizer.documentationHandler.baseToken;
+}
 export function historyToken(req) {
     return `history-${req.adminizer.config.history?.adapter ?? "default"}`;
 }

package/system/Router.js

@@ -11,6 +11,7 @@ import { getSavedFilters, saveFilter, deleteFilter, applyTemporaryFilter, getTem
 import { getAllUserFilters } from "../controllers/filter-fields/getAllUserFilters.js";
 import { getModelColumns, updateFilterColumns } from "../controllers/filter-fields/columns.js";
 import { getAllGroups } from "../controllers/filter-fields/groups.js";
+import { getPermissionOptions } from "../controllers/access-rights/permissionOptions.js";
 import { ckEditorUpload } from "../controllers/ckeditorUpload.js";
 import _exportData from "../controllers/exportData.js";
 import _feed from "../controllers/feed.js";
@@ -30,6 +31,7 @@ import timezones from "../controllers/timezones.js";
 import { NotificationController } from "../controllers/notifications/NotificationController.js";
 import { HistoryController } from "../controllers/history-actions/HistoryController.js";
 import { AiAssistantController } from "../controllers/ai/AiAssistantController.js";
+import { AiAgentController } from "../controllers/ai/AiAgentController.js";
 import listUserFilters from "../controllers/listUserFilters.js";
 import { requireAnyPermission, requireAuthAPI, requireAuthEnabled, requireAuthUI, requirePermission } from "../policies/authPolicies.js";
 import { aiModelToken, catalogToken, groupFilterVisibilityToken, historyToken, mediaManagerToken, modelCreateToken, modelDeleteToken, modelReadToken, modelUpdateToken, widgetToken, widgetsToken } from "../policies/permissionResolvers.js";
@@ -70,6 +72,7 @@ export default class Router {
         const noCachePrefixes = [
             '/api',
             '/notifications/api',
+            '/docs/api',
             '/history',
             '/widgets-get-all',
             '/widgets-get-all-db',
@@ -167,6 +170,7 @@ export default class Router {
         /**
          * List of records
          */
+        adminizer.app.get(`${adminizer.config.routePrefix}/access-rights/permission-options`, withPolicies(getPermissionOptions, requireAuthAPI(), requireAnyPermission(["create-Group-model", "update-Group-model"])));
         adminizer.app.all(resourceRoute(), withPolicies(_list, requireAuthUI(), requirePermission(modelReadToken, { mode: "ui" })));
         if (adminizer.config.filters?.enabled) {
             /**
@@ -222,9 +226,23 @@ export default class Router {
          * AI assistant — consumed by src/assets/js/contexts/AiAssistantContext.tsx
          */
         adminizer.app.get(`${adminizer.config.routePrefix}/api/ai-assistant/models`, withPolicies(AiAssistantController.getModels, requireAuthAPI()));
-        adminizer.app.get(`${adminizer.config.routePrefix}/api/ai-assistant/history/:modelId`, withPolicies(AiAssistantController.getHistory, requireAuthAPI(), requirePermission(aiModelToken)));
-        adminizer.app.post(`${adminizer.config.routePrefix}/api/ai-assistant/query`, withPolicies(AiAssistantController.sendMessage, requireAuthAPI(), requirePermission(aiModelToken)));
-        adminizer.app.delete(`${adminizer.config.routePrefix}/api/ai-assistant/history/:modelId`, withPolicies(AiAssistantController.resetHistory, requireAuthAPI(), requirePermission(aiModelToken)));
+        /**
+         * Streaming agent transport — consumed by the assistant panel bundle
+         * (src/assets/js/ai-assistant). Model services that implement only
+         * `generateReply` are served through the same routes.
+         */
+        const agentRoute = `${adminizer.config.routePrefix}/api/ai-assistant/agent/:modelId`;
+        adminizer.app.get(`${agentRoute}/status`, withPolicies(AiAgentController.getStatus, requireAuthAPI(), requirePermission(aiModelToken)));
+        adminizer.app.get(`${agentRoute}/limits`, withPolicies(AiAgentController.getLimits, requireAuthAPI(), requirePermission(aiModelToken)));
+        adminizer.app.get(`${agentRoute}/meta`, withPolicies(AiAgentController.getMeta, requireAuthAPI(), requirePermission(aiModelToken)));
+        adminizer.app.post(`${agentRoute}/model`, withPolicies(AiAgentController.setModel, requireAuthAPI(), requirePermission(aiModelToken)));
+        adminizer.app.get(`${agentRoute}/history`, withPolicies(AiAgentController.getHistory, requireAuthAPI(), requirePermission(aiModelToken)));
+        adminizer.app.get(`${agentRoute}/conversations`, withPolicies(AiAgentController.listConversations, requireAuthAPI(), requirePermission(aiModelToken)));
+        adminizer.app.post(`${agentRoute}/conversations`, withPolicies(AiAgentController.createConversation, requireAuthAPI(), requirePermission(aiModelToken)));
+        adminizer.app.post(`${agentRoute}/conversations/:conversationId/select`, withPolicies(AiAgentController.selectConversation, requireAuthAPI(), requirePermission(aiModelToken)));
+        adminizer.app.delete(`${agentRoute}/conversations/:conversationId`, withPolicies(AiAgentController.deleteConversation, requireAuthAPI(), requirePermission(aiModelToken)));
+        adminizer.app.post(`${agentRoute}/runs`, withPolicies(AiAgentController.startRun, requireAuthAPI(), requirePermission(aiModelToken)));
+        adminizer.app.get(`${agentRoute}/runs/:runId/stream`, withPolicies(AiAgentController.streamRun, requireAuthAPI(), requirePermission(aiModelToken)));
         adminizer.app.get(`${adminizer.config.routePrefix}/get-timezones`, withPolicies(timezones, requireAuthUI()));
         if (adminizer.config.models) {
             for (let model in adminizer.config.models) {

package/system/bindAccessRights.js

@@ -1,11 +1,21 @@
 import { GROUP_FILTER_VISIBILITY_TOKEN } from "../policies/permissionResolvers.js";
+import { ownershipTransferToken } from "../lib/access-graph/shared.js";
 export default async function bindAccessRights(adminizer) {
     if (adminizer.config.models) {
         let models = adminizer.config.models;
-        for (let key of Object.keys(models)) {
-            const model = models[key];
+        for (const [resourceName, model] of Object.entries(models)) {
             if (typeof model !== "boolean") {
-                adminizer.accessRightsHelper.registerModelTokens(model.model);
+                adminizer.accessRightsHelper.registerModelTokens(resourceName);
+                // Records of an access-restricted model are pinned to their owner; this token is the
+                // opt-in way back to the pre-scoping workflow of handing one over.
+                if (model && typeof model === "object" && model.userAccessRelation) {
+                    adminizer.accessRightsHelper.registerToken({
+                        id: ownershipTransferToken(resourceName),
+                        name: "Transfer ownership",
+                        description: "Allows setting the owner of a record explicitly instead of inheriting the current user's one",
+                        department: `Model ${resourceName}`
+                    });
+                }
             }
         }
     }

package/system/bindDocs.d.ts

@@ -0,0 +1,13 @@
+import { Adminizer } from '../lib/Adminizer.js';
+/**
+ * The single wiring point of the documentation subsystem: the base token, the
+ * navigation entries, the assistant skills and the HTTP routes.
+ *
+ * It is run by `DocumentationHandler.activate()` — at most once, and only when
+ * the feature has both of its switches: `config.documentation.enabled` is
+ * `true` AND an implementation is registered. Either one missing means none of
+ * this exists; the feature is indistinguishable from absent. The implementation
+ * arrives after `init()`, so the routes are mounted late — the same way the
+ * feedback controller is.
+ */
+export default function bindDocs(adminizer: Adminizer): void;

package/system/bindDocs.js

@@ -0,0 +1,77 @@
+import { DOCUMENTATION_DEPARTMENT } from '../lib/docs/DocumentationHandler.js';
+import { buildDocumentationAgentSkills } from '../lib/docs/docsAgentSkills.js';
+import { docsContext, docsDoc, docsKeywords, docsList, docsPage, docsResolve, docsSchema, docsSearch } from '../controllers/docs';
+import { requireAuthAPI, requireAuthUI, requirePermission } from '../policies/authPolicies.js';
+import { documentationToken } from '../policies/permissionResolvers.js';
+import { bindWithMiddlewares } from './routePolicies.js';
+/**
+ * The single wiring point of the documentation subsystem: the base token, the
+ * navigation entries, the assistant skills and the HTTP routes.
+ *
+ * It is run by `DocumentationHandler.activate()` — at most once, and only when
+ * the feature has both of its switches: `config.documentation.enabled` is
+ * `true` AND an implementation is registered. Either one missing means none of
+ * this exists; the feature is indistinguishable from absent. The implementation
+ * arrives after `init()`, so the routes are mounted late — the same way the
+ * feedback controller is.
+ */
+export default function bindDocs(adminizer) {
+    adminizer.accessRightsHelper.registerToken({
+        id: adminizer.documentationHandler.baseToken,
+        name: 'Documentation',
+        description: 'Access to the built-in documentation (knowledge base)',
+        department: DOCUMENTATION_DEPARTMENT,
+    });
+    // The viewer in the navigation, and the per-document page as a template:
+    // the assistant discovers both through `list_admin_navigation` and can
+    // link a user straight to an article.
+    adminizer.adminLinkHandler.add({
+        id: 'documentation',
+        type: 'page',
+        name: 'Documentation',
+        title: 'Documentation',
+        link: `${adminizer.config.routePrefix}/docs`,
+        section: 'Platform',
+        accessRightsToken: adminizer.documentationHandler.baseToken,
+    });
+    adminizer.adminLinkHandler.addTemplate({
+        id: 'documentation-article',
+        title: 'Documentation article',
+        description: 'A single knowledge base article opened in the documentation viewer',
+        template: `${adminizer.config.routePrefix}/docs/:id`,
+        section: 'Platform',
+        accessRightsToken: adminizer.documentationHandler.baseToken,
+        params: [{ name: 'id', description: 'Document id as returned by the documentation skills' }],
+    });
+    // The assistant and the documentation are independent: skills are just
+    // registered; whether an agent picks them up is the assistant's business.
+    for (const skill of buildDocumentationAgentSkills(adminizer)) {
+        adminizer.aiAssistantAgentSkillHandler.add(skill);
+    }
+    /**
+     * HTTP routes — a thin proxy over DocumentationHandler. Mounted routes
+     * cannot be unmounted, so after a runtime `unregister()` the API answers
+     * the same `404` an unknown path gets, not a 500.
+     */
+    const requireDocsService = (req, res, next) => {
+        if (!req.adminizer.documentationHandler.isRegistered()) {
+            return res.status(404).json({ error: req.i18n?.__('Not found') || 'Not found' });
+        }
+        return next();
+    };
+    const middlewares = adminizer.config.middlewares ?? [];
+    const route = (action, ...policies) => bindWithMiddlewares(adminizer, middlewares, action, policies);
+    const prefix = adminizer.config.routePrefix;
+    adminizer.app.get(`${prefix}/docs/api/list`, route(docsList, requireDocsService, requireAuthAPI(), requirePermission(documentationToken)));
+    adminizer.app.get(`${prefix}/docs/api/keywords`, route(docsKeywords, requireDocsService, requireAuthAPI(), requirePermission(documentationToken)));
+    adminizer.app.get(`${prefix}/docs/api/search`, route(docsSearch, requireDocsService, requireAuthAPI(), requirePermission(documentationToken)));
+    adminizer.app.get(`${prefix}/docs/api/context`, route(docsContext, requireDocsService, requireAuthAPI(), requirePermission(documentationToken)));
+    adminizer.app.get(`${prefix}/docs/api/doc/:id`, route(docsDoc, requireDocsService, requireAuthAPI(), requirePermission(documentationToken)));
+    adminizer.app.get(`${prefix}/docs/api/resolve`, route(docsResolve, requireDocsService, requireAuthAPI(), requirePermission(documentationToken)));
+    adminizer.app.get(`${prefix}/docs/api/schema`, route(docsSchema, requireDocsService, requireAuthAPI(), requirePermission(documentationToken)));
+    // The viewer itself; registered after the API so that `/docs/api/...`
+    // never falls into `/docs/:id`. Without a service the page renders an
+    // empty knowledge base — the API behind it answers 404.
+    adminizer.app.get(`${prefix}/docs`, route(docsPage, requireAuthUI(), requirePermission(documentationToken, { mode: 'ui' })));
+    adminizer.app.get(`${prefix}/docs/:id`, route(docsPage, requireAuthUI(), requirePermission(documentationToken, { mode: 'ui' })));
+}