adminizer 5.0.0-build.9 → 5.1.0-build.25

package/controllers/docs/index.js

@@ -0,0 +1,126 @@
+import { resolveModelResource } from '../../helpers/modelResourceHelper.js';
+import { getUiTranslations } from '../../lib/ui-i18n/getUiTranslations.js';
+import { DOCS_UI_TRANSLATION_KEYS } from '../../lib/ui-i18n/uiTranslationKeys.js';
+import { DataAccessor } from '../../lib/DataAccessor.js';
+/**
+ * Thin JSON proxy of the documentation subsystem: policies have checked the
+ * auth and the base token, `DocumentationHandler` applies per-document rights,
+ * the implementation does the actual work. No logic lives here.
+ */
+function requestedLocale(req) {
+    const locale = typeof req.query.locale === 'string' ? req.query.locale.trim() : '';
+    return locale || req.adminizer.documentationHandler.localeFor(req.user);
+}
+function describeMeta(meta) {
+    return {
+        id: meta.id,
+        title: meta.title,
+        section: meta.section,
+        keywords: meta.keywords,
+        models: meta.models,
+        urls: meta.urls,
+        locales: meta.locales,
+    };
+}
+export async function docsList(req, res) {
+    const documents = await req.adminizer.documentationHandler.list(req.user, requestedLocale(req));
+    return res.json({ documents: documents.map(describeMeta) });
+}
+export async function docsKeywords(req, res) {
+    const keywords = await req.adminizer.documentationHandler.keywords(req.user, requestedLocale(req));
+    return res.json({ keywords: Object.fromEntries(keywords) });
+}
+export async function docsSearch(req, res) {
+    const keywords = typeof req.query.keywords === 'string'
+        ? req.query.keywords.split(',').map((keyword) => keyword.trim()).filter(Boolean)
+        : undefined;
+    const results = await req.adminizer.documentationHandler.search(req.user, {
+        query: typeof req.query.q === 'string' ? req.query.q : undefined,
+        keywords,
+        url: typeof req.query.url === 'string' ? req.query.url : undefined,
+        model: typeof req.query.model === 'string' ? req.query.model : undefined,
+    }, requestedLocale(req));
+    return res.json({
+        results: results.map((result) => ({ ...describeMeta(result.meta), snippets: result.snippets })),
+    });
+}
+export async function docsContext(req, res) {
+    const documents = await req.adminizer.documentationHandler.forContext(req.user, {
+        url: typeof req.query.url === 'string' ? req.query.url : undefined,
+        model: typeof req.query.model === 'string' ? req.query.model : undefined,
+    }, requestedLocale(req));
+    return res.json({ documents: documents.map(describeMeta) });
+}
+export async function docsDoc(req, res) {
+    const content = await req.adminizer.documentationHandler.get(req.user, String(req.params.id ?? ''), requestedLocale(req));
+    // A document the user may not read does not exist for them.
+    if (!content) {
+        return res.status(404).json({ error: req.i18n?.__('Not found') || 'Not found' });
+    }
+    return res.json({ meta: describeMeta(content.meta), markdown: content.markdown, locale: content.locale });
+}
+/**
+ * Resolves references written inside a document to document ids. How a
+ * reference is spelled is the implementation's business; the viewer only
+ * learns which of them point at a document this user may open — the rest stay
+ * unresolved and are rendered as plain text.
+ */
+export async function docsResolve(req, res) {
+    const from = typeof req.query.from === 'string' ? req.query.from : '';
+    // `refs` is the comma-separated form the viewer uses; repeated `ref`
+    // parameters are accepted as well for hand-written calls.
+    const raw = req.query.ref;
+    const refs = [
+        ...(typeof req.query.refs === 'string' ? req.query.refs.split(',') : []),
+        ...(Array.isArray(raw) ? raw : [raw]),
+    ]
+        .filter((ref) => typeof ref === 'string' && ref.trim() !== '')
+        .map((ref) => ref.trim());
+    const resolved = {};
+    for (const ref of refs) {
+        const id = await req.adminizer.documentationHandler.resolveLink(req.user, from, ref);
+        if (id)
+            resolved[ref] = id;
+    }
+    return res.json({ resolved });
+}
+/**
+ * The viewer page. The document itself is fetched by the page through the API,
+ * so a deep link only has to name the document it opens with.
+ */
+export async function docsPage(req) {
+    return req.Inertia.render({
+        component: 'docs',
+        props: {
+            title: req.i18n.__('Documentation'),
+            docId: typeof req.params.id === 'string' ? req.params.id : null,
+            i18nPage: getUiTranslations(req, DOCS_UI_TRANSLATION_KEYS),
+        },
+    });
+}
+/**
+ * Structure of a model resource as this user is allowed to see it — the same
+ * fields DataAccessor would hand to the list page, nothing more.
+ */
+export async function docsSchema(req, res) {
+    const name = typeof req.query.model === 'string' ? req.query.model.trim() : '';
+    const resource = name ? resolveModelResource(req.adminizer, name) : undefined;
+    if (!resource) {
+        return res.status(404).json({ error: req.i18n.__('Model not found') });
+    }
+    if (!await req.adminizer.accessRightsHelper.checkPermission(`read-${resource.name}-model`, req.user)) {
+        return res.status(403).json({ error: req.i18n.__('Access denied') });
+    }
+    const fields = new DataAccessor(req.adminizer, req.user, resource, 'list').getFieldsConfig() ?? {};
+    return res.json({
+        model: resource.name,
+        title: req.i18n.__(resource.config?.title ?? resource.name),
+        url: resource.uri,
+        fields: Object.entries(fields).map(([key, field]) => ({
+            name: key,
+            title: field.config?.title ? req.i18n.__(field.config.title) : key,
+            type: String(field.config?.type ?? field.model?.type ?? 'string'),
+            required: Boolean(field.config?.required ?? field.model?.required),
+        })),
+    });
+}

package/controllers/edit.js

@@ -33,7 +33,7 @@ export default async function edit(req, res) {
     }
     let fields = dataAccessor.getFieldsConfig();
     // add deprecated 'records' to config
-    fields = await FieldsHelper.loadAssociations(req, fields, "edit");
+    fields = await FieldsHelper.loadAssociations(req, fields, "edit", dataAccessor.recordAccessCache);
     // Save
     if (req.method.toUpperCase() === 'POST') {
         const identifierField = modelResource.config.identifierField || req.adminizer.config.identifierField;
@@ -134,7 +134,7 @@ export default async function edit(req, res) {
             });
         }
     }
-    const props = inertiaAddHelper(req, modelResource, fields, record);
+    const props = await inertiaAddHelper(req, modelResource, fields, record);
     if (req.query?.without_layout) {
         return res.json({
             props: props

package/controllers/editGroup.js

@@ -44,13 +44,22 @@ export default async function editGroup(req, res) {
                     }
                 }
             }
-            if (key.startsWith("token-checkbox-") && req.body[key] === true) {
-                for (let token of allTokens) {
-                    if (token.id == key.slice(15)) {
-                        tokensOfThisGroup.push(token.id);
-                    }
-                }
+        }
+        for (const token of allTokens) {
+            if (req.body[`token-checkbox-${token.id}`] !== true)
+                continue;
+            if (!token.getOptions) {
+                tokensOfThisGroup.push(token.id);
+                continue;
             }
+            const submittedRights = req.body[`token-record-rights-${token.id}`];
+            const rights = Array.isArray(submittedRights)
+                ? Array.from(new Set(submittedRights.map(String)))
+                : [];
+            tokensOfThisGroup.push({
+                tokenId: token.id,
+                rights,
+            });
         }
         let updatedGroup;
         try {

package/controllers/filter-fields/savedFilters.js

@@ -125,7 +125,7 @@ export async function saveFilter(req, res) {
     }
     // Determine visibility and groupIds
     const isAdmin = req.user?.isAdministrator === true;
-    const canManageGroupVisibility = isAdmin || req.adminizer.accessRightsHelper.hasPermission(GROUP_FILTER_VISIBILITY_TOKEN, req.user);
+    const canManageGroupVisibility = isAdmin || await req.adminizer.accessRightsHelper.checkPermission(GROUP_FILTER_VISIBILITY_TOKEN, req.user);
     let effectiveVisibility = 'private';
     let effectiveGroupIds;
     if (visibility === 'public' && isAdmin) {

package/controllers/history-actions/HistoryController.js

@@ -3,13 +3,13 @@ import { getUiTranslations } from "../../lib/ui-i18n/getUiTranslations.js";
 import { HISTORY_UI_TRANSLATION_KEYS } from "../../lib/ui-i18n/uiTranslationKeys.js";
 export class HistoryController {
     static async index(req, res) {
-        if (!HistoryController.checkHistoryPermission(req, res))
+        if (!await HistoryController.checkHistoryPermission(req, res))
             return;
         const adapter = HistoryController.getAdapter(req);
         if (req.method.toUpperCase() === 'GET') {
-            const rawModels = adapter.getModels(req.user);
+            const rawModels = await adapter.getModels(req.user);
             let users = [];
-            const accessToUsersHistory = req.adminizer.accessRightsHelper.enoughPermissions([
+            const accessToUsersHistory = await req.adminizer.accessRightsHelper.checkAnyPermission([
                 `users-history-${adapter.id}`
             ], req.user);
             if (accessToUsersHistory)
@@ -59,7 +59,7 @@ export class HistoryController {
         return res.status(405).end();
     }
     static async getAllModelHistory(req, res) {
-        if (!HistoryController.checkHistoryPermission(req, res))
+        if (!await HistoryController.checkHistoryPermission(req, res))
             return;
         const { modelId, modelName } = req.body;
         if (!modelId || !modelName) {
@@ -80,7 +80,7 @@ export class HistoryController {
         }
     }
     static async getModelFieldsHistory(req, res) {
-        if (!HistoryController.checkHistoryPermission(req, res))
+        if (!await HistoryController.checkHistoryPermission(req, res))
             return;
         const { historyId } = req.body;
         if (!historyId) {
@@ -103,12 +103,12 @@ export class HistoryController {
         const adapter = req.adminizer.config.history?.adapter ?? 'default';
         return req.adminizer.historyHandler.get(adapter);
     }
-    static checkHistoryPermission(req, res) {
+    static async checkHistoryPermission(req, res) {
         if (!req.adminizer?.historyHandler) {
             res.status(401).json({ error: 'History system not initialized' });
             return false;
         }
-        const hasPermission = req.adminizer.accessRightsHelper.hasPermission(`history-${req.adminizer.config.history?.adapter ?? 'default'}`, req.user);
+        const hasPermission = await req.adminizer.accessRightsHelper.checkPermission(`history-${req.adminizer.config.history?.adapter ?? 'default'}`, req.user);
         if (!hasPermission) {
             res.sendStatus(403);
             return false;

package/controllers/inlineUpdate.js

@@ -62,10 +62,17 @@ export default async function inlineUpdate(req, res) {
     const convertedValue = convertInlineValue(newValue, fieldType);
     // Update record
     const id = req.params.id;
-    const params = {};
-    params[modelResource.config.identifierField || req.adminizer.config.identifierField] = id;
+    // Reuse the resolved identifier: without the primary-key fallback the key is
+    // `undefined`, the adapter drops the unknown condition, and the update hits every
+    // record the user may reach instead of the one addressed by :id.
+    const params = { [identifierField]: id };
     try {
-        await modelResource.model.update(params, { [fieldName]: convertedValue }, dataAccessor);
+        const updated = await modelResource.model.update(params, { [fieldName]: convertedValue }, dataAccessor);
+        // Record access is enforced by the criteria, so a record out of the user's reach
+        // simply matches nothing. Reporting success would leave the edited value on screen.
+        if (!updated.length) {
+            return res.status(404).json({ error: 'Record not found' });
+        }
         return res.json({
             success: true,
             data: {

package/controllers/list.js

@@ -14,7 +14,7 @@ export default async function list(req, res) {
     }
     let dataAccessor = new DataAccessor(req.adminizer, req.user, modelResource, "list");
     let fields = dataAccessor.getFieldsConfig();
-    const header = inertiaListHelper(modelResource, req, fields);
+    const header = await inertiaListHelper(modelResource, req, fields);
     const i18nPage = getUiTranslations(req, FILTER_UI_TRANSLATION_KEYS);
     // Parse pagination
     const defaultPageSize = req.adminizer.config.list?.defaultPageSize ?? 50;

package/controllers/login.js

@@ -61,7 +61,7 @@ export default async function login(req, res) {
                         //Here we use the captchaSolution key to output messages unrelated to the form fields.
                         return inertiaAdminMessage(req, "Profile expired, contact the administrator", 'captchaSolution');
                     }
-                    if (!req.adminizer.accessRightsHelper.hasPermission('access-to-adminpanel', user)) {
+                    if (!await req.adminizer.accessRightsHelper.checkPermission('access-to-adminpanel', user)) {
                         return inertiaAdminMessage(req, "The user is not allowed to enter, please contact the administrator", 'captchaSolution');
                     }
                     const token = signUser({

package/controllers/notifications/NotificationController.js

@@ -7,7 +7,7 @@ export class NotificationController {
             return;
         if (req.method.toUpperCase() === 'POST') {
             const { s, notificationClass } = req.body;
-            const hasPermission = req.adminizer.accessRightsHelper.hasPermission(`notification-${notificationClass}`, req.user);
+            const hasPermission = await req.adminizer.accessRightsHelper.checkPermission(`notification-${notificationClass}`, req.user);
             if (!hasPermission) {
                 res.status(403).json({ error: 'Forbidden' });
                 return;
@@ -42,7 +42,7 @@ export class NotificationController {
         const services = req.adminizer.notificationHandler.getAllServices();
         let activeServices = [];
         for (const service of services) {
-            const hasPermission = req.adminizer.accessRightsHelper.hasPermission(`notification-${service.notificationClass}`, req.user);
+            const hasPermission = await req.adminizer.accessRightsHelper.checkPermission(`notification-${service.notificationClass}`, req.user);
             if (hasPermission) {
                 activeServices.push({
                     displayName: req.i18n.__(service.displayName),
@@ -68,12 +68,12 @@ export class NotificationController {
         res.write(': stream-open\n\n');
         const clientId = `user-${req.user?.id}-${Date.now()}`;
         // Function for sending events to the client
-        const sendEvent = (event) => {
+        const sendEvent = async (event) => {
             // Filtering notifications by user rights
             if (event.type === 'notification') {
                 const notificationClass = event.notificationClass;
                 // UNIFIED rights check via AccessRightsHelper
-                const hasPermission = req.adminizer.accessRightsHelper.hasPermission(`notification-${notificationClass}`, req.user);
+                const hasPermission = await req.adminizer.accessRightsHelper.checkPermission(`notification-${notificationClass}`, req.user);
                 if (!hasPermission) {
                     return; // The user does not have rights to this notification class
                 }
@@ -88,7 +88,10 @@ export class NotificationController {
         };
         // We connect the client to all services
         const services = req.adminizer.notificationHandler.getAllServices();
-        const allowedServices = services.filter(service => req.adminizer.accessRightsHelper.hasPermission(`notification-${service.notificationClass}`, req.user));
+        const allowedServices = (await Promise.all(services.map(async (service) => ({
+            service,
+            allowed: await req.adminizer.accessRightsHelper.checkPermission(`notification-${service.notificationClass}`, req.user),
+        })))).filter(({ allowed }) => allowed).map(({ service }) => service);
         allowedServices.forEach(service => {
             service.addClient(clientId, sendEvent, req.user);
             // For a system service, add a client to CRUD channels
@@ -100,7 +103,7 @@ export class NotificationController {
             //     });
             // }
         });
-        sendEvent({
+        await sendEvent({
             type: 'connected',
             data: {
                 message: 'Connected to unified notification stream',
@@ -144,7 +147,7 @@ export class NotificationController {
             const { notificationClass } = req.params;
             const { limit = 20, skip = 0, unreadOnly = false } = req.query;
             // Checking access rights
-            const hasPermission = req.adminizer.accessRightsHelper.hasPermission(`notification-${notificationClass}`, req.user);
+            const hasPermission = await req.adminizer.accessRightsHelper.checkPermission(`notification-${notificationClass}`, req.user);
             if (!hasPermission) {
                 res.status(403).json({ error: 'Forbidden' });
                 return;
@@ -170,7 +173,10 @@ export class NotificationController {
         try {
             // Filtering services by access rights
             const services = req.adminizer.notificationHandler.getAllServices();
-            const allowedServices = services.filter(service => req.adminizer.accessRightsHelper.hasPermission(`notification-${service.notificationClass}`, req.user));
+            const allowedServices = (await Promise.all(services.map(async (service) => ({
+                service,
+                allowed: await req.adminizer.accessRightsHelper.checkPermission(`notification-${service.notificationClass}`, req.user),
+            })))).filter(({ allowed }) => allowed).map(({ service }) => service);
             const allNotifications = [];
             for (const service of allowedServices) {
                 const notifications = await service.getNotifications(req.user.id, Number(limit), Number(skip), unreadOnly === 'true');

package/controllers/view.js

@@ -29,7 +29,7 @@ export default async function view(req, res) {
         Adminizer.log.error(e);
         return res.status(500).send({ error: 'Internal Server Error' });
     }
-    switch (modelResource.config.model) {
+    switch (modelResource.name) {
         case 'User':
             let groups;
             try {
@@ -71,7 +71,7 @@ export default async function view(req, res) {
                 props: groupProps
             });
         default:
-            fields = await FieldsHelper.loadAssociations(req, fields, "edit");
+            fields = await FieldsHelper.loadAssociations(req, fields, "edit", dataAccessor.recordAccessCache);
             for (const field of Object.keys(fields)) {
                 let fieldConfigConfig = fields[field].config;
                 if (fieldConfigConfig.type === 'mediamanager') {
@@ -83,7 +83,7 @@ export default async function view(req, res) {
                     });
                 }
             }
-            const props = inertiaAddHelper(req, modelResource, fields, record, true);
+            const props = await inertiaAddHelper(req, modelResource, fields, record, true);
             return req.Inertia.render({
                 component: 'add',
                 props: props

package/controllers/widgets/filterInfo.js

@@ -28,7 +28,7 @@ export async function widgetFilterInfoController(req, res) {
     if (!filter || !filterService.canViewFilter(filter, user)) {
         return res.status(404).send({ error: req.i18n.__("Not found") });
     }
-    if (!req.adminizer.accessRightsHelper.hasPermission(`read-${filter.modelName}-model`, user)) {
+    if (!await req.adminizer.accessRightsHelper.checkPermission(`read-${filter.modelName}-model`, user)) {
         return res.sendStatus(403);
     }
     if (req.method.toUpperCase() === "GET") {

package/helpers/accessRightsHelper.d.ts

@@ -1,20 +1,81 @@
 import { User } from "../models/User.js";
-import { AccessRightsToken } from "../interfaces/types.js";
+import { AccessRightsToken, GroupPermissionGrant, PermissionContext } from "../interfaces/types.js";
 import { Adminizer } from "../lib/Adminizer.js";
+export declare function parseGroupPermissionGrant(value: unknown): GroupPermissionGrant | null;
 export declare class AccessRightsHelper {
     private _tokens;
+    private warnedDeprecations;
     adminizer: Adminizer;
     constructor(adminizer: Adminizer);
     registerToken(accessRightsToken: AccessRightsToken): void;
     unregisterToken(tokenId: string): boolean;
     hasToken(tokenId: string): boolean;
+    getToken(tokenId: string): AccessRightsToken | undefined;
     registerTokens(accessRightsTokens: AccessRightsToken[]): void;
     registerModelTokens(modelName: string, department?: string): void;
     getTokens(): AccessRightsToken[];
     getTokensByDepartment(department: string): AccessRightsToken[];
     getAllDepartments(): string[];
+    /**
+     * The full access decision: the token exists, a group of this user carries
+     * it, and — for a contextual token — its own `check` accepts the context.
+     *
+     * This is the only entry point that can honour a contextual `check`, and the
+     * one every Adminizer call site uses. It replaces {@link hasPermission},
+     * which stays synchronous forever so that modules written against it cannot
+     * be broken open by a missing `await`.
+     */
+    checkPermission(tokenId: string | undefined, user: User, context?: PermissionContext): Promise<boolean>;
+    /** Grants when {@link checkPermission} grants any of `tokens`. */
+    checkAnyPermission(tokens: string[], user: User): Promise<boolean>;
+    /**
+     * Synchronous access decision for call sites that cannot await, such as the
+     * field configuration built by `DataAccessor`.
+     *
+     * A contextual token is denied here: its `check` is asynchronous and there
+     * is no context to hand it, so the only safe answer is "no". Model CRUD
+     * tokens never declare `check`, so the ordinary panel paths are unaffected.
+     */
+    hasStaticPermission(tokenId: string | undefined, user: User): boolean;
+    /** Fail-closed synchronous variant of {@link checkAnyPermission}. */
+    enoughStaticPermissions(tokens: string[], user: User): boolean;
+    /**
+     * @deprecated Use {@link checkPermission}, which can honour a contextual
+     * token's `check`. This method stays synchronous and fails closed.
+     *
+     * Kept synchronous deliberately, and never to be made `async`. Modules and
+     * apps outside this repository call it as `if (hasPermission(...))`, and we
+     * can neither find nor warn them at compile time. An `async` version returns
+     * a pending promise there, which is truthy — every such check would grant
+     * access to everyone. So this signature is frozen at `boolean`: the worst a
+     * stale caller gets is a denial it can see, never a silent grant.
+     */
+    hasPermission(tokenId: string | undefined, user: User): boolean;
+    /**
+     * @deprecated Use {@link checkAnyPermission}. Synchronous and fail-closed
+     * for the same reason as {@link hasPermission}.
+     */
     enoughPermissions(tokens: string[], user: User): boolean;
-    hasPermission(tokenId: string | undefined, user: User, context?: string): boolean;
+    /**
+     * Warns once per call site, with the caller's frame so the module still
+     * using it can actually be found.
+     *
+     * Keyed on the frame rather than the method name: an app reaching the
+     * deprecated method through the runtime bridge used to spend the single
+     * warning of the whole process on a frame naming `AppManager` instead of
+     * itself, after which no other stale caller could ever surface.
+     */
+    private warnDeprecated;
+    /**
+     * The first stack frame outside the forwarding layer — this helper and the
+     * app-manager bridge — which is the module that actually made the call.
+     */
+    private resolveCallerFrame;
+    /** Returns trusted option IDs granted by all groups for a contextual token. */
+    getPermissionRights(tokenId: string | undefined, user: User): string[] | null;
+    private getRegisteredToken;
+    private hasAssignedPermission;
+    private runTokenCheck;
 }
 export declare class GroupsAccessRightsHelper {
     static hasAccess(user: User, groupsAccessRights?: string[]): boolean;