adminizer 5.0.0-build.9 → 5.1.0-build.25

package/helpers/accessRightsHelper.js

@@ -1,6 +1,29 @@
 import { Adminizer } from "../lib/Adminizer.js";
+export function parseGroupPermissionGrant(value) {
+    if (!value ||
+        typeof value !== "object" ||
+        typeof value.tokenId !== "string" ||
+        !Array.isArray(value.rights) ||
+        !value.rights.every((right) => typeof right === "string" || typeof right === "number")) {
+        return null;
+    }
+    const parsed = value;
+    return {
+        tokenId: parsed.tokenId.toLowerCase(),
+        rights: Array.from(new Set(parsed.rights.map(String))),
+    };
+}
+/** `<verb>-<model>-model` — the id shape registered by {@link AccessRightsHelper.registerModelTokens}. */
+const MODEL_CRUD_TOKEN_PATTERN = /^(create|read|update|delete)-.+-model$/;
+/**
+ * Stack frames of the code that merely forwards a deprecated call: this helper
+ * itself and the app-manager runtime bridge. Naming either of them would hide
+ * the module we are actually trying to point at.
+ */
+const FORWARDING_FRAME_PATTERN = /[\\/](?:helpers[\\/]accessRightsHelper|app-manager[\\/]AppManager)\.[cm]?[jt]s/;
 export class AccessRightsHelper {
     _tokens = [];
+    warnedDeprecations = new Set();
     adminizer;
     constructor(adminizer) {
         this.adminizer = adminizer;
@@ -10,6 +33,19 @@ export class AccessRightsHelper {
         if (!accessRightsToken.id || !accessRightsToken.name || !accessRightsToken.description || !accessRightsToken.department) {
             throw new Error("Adminpanel > Can not register token: Missed one or more required parameters");
         }
+        if (accessRightsToken.getOptions && typeof accessRightsToken.getOptions !== "function") {
+            throw new Error("Adminpanel > Can not register token: getOptions must be a function");
+        }
+        if (accessRightsToken.check && typeof accessRightsToken.check !== "function") {
+            throw new Error("Adminpanel > Can not register token: check must be a function");
+        }
+        // Model CRUD tokens are consulted from synchronous paths (DataAccessor field
+        // config), where a contextual `check` cannot run and is denied. Such a token would
+        // silently hide every field of the model, so it is rejected at registration.
+        if (accessRightsToken.check && MODEL_CRUD_TOKEN_PATTERN.test(accessRightsToken.id)) {
+            throw new Error(`Adminpanel > Can not register token "${accessRightsToken.id}": model CRUD tokens are ` +
+                `evaluated synchronously and cannot carry a contextual "check"`);
+        }
         for (let i = 0; i < this._tokens.length; i++) {
             if (this._tokens[i].id === accessRightsToken.id) {
                 this._tokens.splice(i, 1);
@@ -31,6 +67,10 @@ export class AccessRightsHelper {
         const normalizedTokenId = tokenId.toLowerCase();
         return this._tokens.some((token) => token.id === normalizedTokenId);
     }
+    getToken(tokenId) {
+        const normalizedTokenId = tokenId.toLowerCase();
+        return this._tokens.find((token) => token.id === normalizedTokenId);
+    }
     registerTokens(accessRightsTokens) {
         for (let token of accessRightsTokens) {
             this.registerToken(token);
@@ -54,7 +94,33 @@ export class AccessRightsHelper {
             .map((token) => token.department)
             .filter((item, pos, self) => self.indexOf(item) === pos);
     }
-    enoughPermissions(tokens, user) {
+    /**
+     * The full access decision: the token exists, a group of this user carries
+     * it, and — for a contextual token — its own `check` accepts the context.
+     *
+     * This is the only entry point that can honour a contextual `check`, and the
+     * one every Adminizer call site uses. It replaces {@link hasPermission},
+     * which stays synchronous forever so that modules written against it cannot
+     * be broken open by a missing `await`.
+     */
+    async checkPermission(tokenId, user, context) {
+        if (!this.adminizer.config.auth.enable || user.isAdministrator) {
+            return true;
+        }
+        const token = this.getRegisteredToken(tokenId);
+        if (!token) {
+            return false;
+        }
+        if (!this.hasAssignedPermission(token.id, user)) {
+            return false;
+        }
+        if (!token.check) {
+            return true;
+        }
+        return this.runTokenCheck(token, user, context ?? {});
+    }
+    /** Grants when {@link checkPermission} grants any of `tokens`. */
+    async checkAnyPermission(tokens, user) {
         if (user.isAdministrator) {
             return true;
         }
@@ -62,30 +128,153 @@ export class AccessRightsHelper {
         if (!tokens.length) {
             return true;
         }
-        return tokens.some((token) => this.hasPermission(token, user));
+        for (const token of tokens) {
+            if (await this.checkPermission(token, user)) {
+                return true;
+            }
+        }
+        return false;
     }
-    hasPermission(tokenId, user, context) {
-        if (!this.adminizer.config.auth.enable) {
+    /**
+     * Synchronous access decision for call sites that cannot await, such as the
+     * field configuration built by `DataAccessor`.
+     *
+     * A contextual token is denied here: its `check` is asynchronous and there
+     * is no context to hand it, so the only safe answer is "no". Model CRUD
+     * tokens never declare `check`, so the ordinary panel paths are unaffected.
+     */
+    hasStaticPermission(tokenId, user) {
+        if (!this.adminizer.config.auth.enable || user.isAdministrator) {
             return true;
         }
-        if (user.isAdministrator) {
-            return true;
+        const token = this.getRegisteredToken(tokenId);
+        if (!token) {
+            return false;
         }
-        if (!tokenId) {
-            Adminizer.log.warn(`AccessRightsHelper > hasPermission: missing accessRightsToken${context ? ` [${context}]` : ''}`);
+        if (!this.hasAssignedPermission(token.id, user)) {
             return false;
         }
-        tokenId = tokenId.toLowerCase();
-        const tokenIsValid = this._tokens.some((token) => token.id === tokenId);
-        if (!tokenIsValid) {
-            Adminizer.log.error("Adminpanel > Token is not valid", tokenId, user.login);
+        if (token.check) {
+            Adminizer.log.warn("AccessRightsHelper > hasStaticPermission: contextual token denied in a synchronous check", token.id);
             return false;
         }
+        return true;
+    }
+    /** Fail-closed synchronous variant of {@link checkAnyPermission}. */
+    enoughStaticPermissions(tokens, user) {
+        if (user.isAdministrator) {
+            return true;
+        }
+        if (!tokens.length) {
+            return true;
+        }
+        return tokens.some((token) => this.hasStaticPermission(token, user));
+    }
+    /**
+     * @deprecated Use {@link checkPermission}, which can honour a contextual
+     * token's `check`. This method stays synchronous and fails closed.
+     *
+     * Kept synchronous deliberately, and never to be made `async`. Modules and
+     * apps outside this repository call it as `if (hasPermission(...))`, and we
+     * can neither find nor warn them at compile time. An `async` version returns
+     * a pending promise there, which is truthy — every such check would grant
+     * access to everyone. So this signature is frozen at `boolean`: the worst a
+     * stale caller gets is a denial it can see, never a silent grant.
+     */
+    hasPermission(tokenId, user) {
+        this.warnDeprecated("hasPermission", "checkPermission");
+        return this.hasStaticPermission(tokenId, user);
+    }
+    /**
+     * @deprecated Use {@link checkAnyPermission}. Synchronous and fail-closed
+     * for the same reason as {@link hasPermission}.
+     */
+    enoughPermissions(tokens, user) {
+        this.warnDeprecated("enoughPermissions", "checkAnyPermission");
+        return this.enoughStaticPermissions(tokens, user);
+    }
+    /**
+     * Warns once per call site, with the caller's frame so the module still
+     * using it can actually be found.
+     *
+     * Keyed on the frame rather than the method name: an app reaching the
+     * deprecated method through the runtime bridge used to spend the single
+     * warning of the whole process on a frame naming `AppManager` instead of
+     * itself, after which no other stale caller could ever surface.
+     */
+    warnDeprecated(method, replacement) {
+        const callerFrame = this.resolveCallerFrame();
+        const warned = `${method}@${callerFrame ?? "unknown"}`;
+        if (this.warnedDeprecations.has(warned)) {
+            return;
+        }
+        this.warnedDeprecations.add(warned);
+        Adminizer.log.warn(`AccessRightsHelper > ${method} is deprecated and cannot evaluate contextual tokens ` +
+            `(they are denied). Use the asynchronous ${replacement} instead.`, callerFrame ?? "");
+    }
+    /**
+     * The first stack frame outside the forwarding layer — this helper and the
+     * app-manager bridge — which is the module that actually made the call.
+     */
+    resolveCallerFrame() {
+        return new Error().stack
+            ?.split("\n")
+            .slice(1)
+            .map((frame) => frame.trim())
+            .find((frame) => frame.startsWith("at ") && !FORWARDING_FRAME_PATTERN.test(frame));
+    }
+    /** Returns trusted option IDs granted by all groups for a contextual token. */
+    getPermissionRights(tokenId, user) {
+        if (!this.adminizer.config.auth.enable) {
+            return null;
+        }
+        if (user.isAdministrator) {
+            return null;
+        }
+        const token = this.getRegisteredToken(tokenId);
+        if (!token) {
+            return [];
+        }
         if (!user.groups) {
             Adminizer.log.error('User has no groups');
+            return [];
+        }
+        const rights = user.groups.flatMap((group) => group.tokens ?? [])
+            .map(parseGroupPermissionGrant)
+            .filter((grant) => grant?.tokenId === token.id)
+            .flatMap((grant) => grant.rights);
+        return Array.from(new Set(rights));
+    }
+    getRegisteredToken(tokenId) {
+        if (!tokenId) {
+            Adminizer.log.warn("AccessRightsHelper > hasPermission: missing accessRightsToken");
+            return undefined;
+        }
+        const token = this.getToken(tokenId);
+        if (!token) {
+            Adminizer.log.error("Adminpanel > Token is not valid", tokenId);
+        }
+        return token;
+    }
+    hasAssignedPermission(tokenId, user) {
+        if (!this.adminizer.config.auth.enable || user.isAdministrator) {
+            return true;
+        }
+        if (!user.groups) {
+            Adminizer.log.error("User has no groups");
+            return false;
+        }
+        return user.groups.some((group) => group.tokens?.some((groupToken) => groupToken === tokenId || parseGroupPermissionGrant(groupToken)?.tokenId === tokenId));
+    }
+    async runTokenCheck(token, user, context) {
+        try {
+            const rights = this.getPermissionRights(token.id, user) ?? [];
+            return await token.check(user, { ...context, rights });
+        }
+        catch (error) {
+            Adminizer.log.error("AccessRightsHelper > token check failed", token.id, error);
             return false;
         }
-        return user.groups.some((group) => group.tokens?.includes(tokenId));
     }
 }
 export class GroupsAccessRightsHelper {

package/helpers/assetVersionHelper.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Adminizer package version. Some built entries keep stable file names because
+ * they are imported by a hard-coded path and so cannot be looked up in the
+ * manifest (agent.es.js, controls/*.es.js and controls/*.css); for those this
+ * version is appended as a query string to invalidate browser caches on release.
+ *
+ * Only ever put this on a *self-contained* bundle. An entry whose split chunks
+ * import it back by name (app.js) must be content-hashed instead — a query
+ * string there makes the browser instantiate the module twice.
+ */
+export declare function getAssetVersion(): string;
+/** Appends ?v=<version> to a production asset URL; dev URLs pass through untouched. */
+export declare function withAssetVersion(url: string): string;
+export declare function withAssetVersion(url: string | undefined): string | undefined;

package/helpers/assetVersionHelper.js

@@ -0,0 +1,42 @@
+import fs from "fs";
+import path from "node:path";
+let cachedVersion = null;
+/**
+ * Adminizer package version. Some built entries keep stable file names because
+ * they are imported by a hard-coded path and so cannot be looked up in the
+ * manifest (agent.es.js, controls/*.es.js and controls/*.css); for those this
+ * version is appended as a query string to invalidate browser caches on release.
+ *
+ * Only ever put this on a *self-contained* bundle. An entry whose split chunks
+ * import it back by name (app.js) must be content-hashed instead — a query
+ * string there makes the browser instantiate the module twice.
+ */
+export function getAssetVersion() {
+    if (cachedVersion !== null) {
+        return cachedVersion;
+    }
+    let version = "";
+    // Compiled sources sit one level below the package root in the published
+    // package (helpers/) and two below it in the repo (dist/helpers/).
+    for (const candidate of ["../package.json", "../../package.json"]) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(path.resolve(import.meta.dirname, candidate), "utf-8"));
+            if (pkg?.name === "adminizer" && typeof pkg.version === "string") {
+                version = pkg.version;
+                break;
+            }
+        }
+        catch {
+            // Missing or unreadable package.json: try the next candidate.
+        }
+    }
+    cachedVersion = version;
+    return version;
+}
+export function withAssetVersion(url) {
+    const version = getAssetVersion();
+    if (!url || !version || process.env.ADMINIZER_ENV === "dev") {
+        return url;
+    }
+    return `${url}${url.includes("?") ? "&" : "?"}v=${version}`;
+}

package/helpers/configHelper.js

@@ -34,23 +34,17 @@ export class ConfigHelper {
         if (!modelName) {
             throw new Error("Model name is not defined");
         }
-        let config = this.adminizer.config;
-        let modelConfig;
-        Object.keys(config.models).forEach((modelResourceName) => {
-            const model = config.models[modelResourceName];
-            if (typeof model !== "boolean") {
-                if (model.model === modelName.toLowerCase()) {
-                    if (typeof config.models[modelResourceName] !== "boolean") {
-                        modelConfig = config.models[modelResourceName];
-                    }
-                }
-            }
-        });
+        const resourceName = this.adminizer.modelHandler.getResourceRecord(modelName)?.name
+            ?? this.adminizer.modelHandler.resolveResourceByHostModel(modelName);
+        const modelConfig = resourceName && typeof this.adminizer.config.models[resourceName] !== "boolean"
+            ? this.adminizer.config.models[resourceName]
+            : undefined;
+        const model = resourceName ? this.adminizer.modelHandler.getResource(resourceName) : undefined;
         if (modelConfig && modelConfig.identifierField) {
             return modelConfig.identifierField;
         }
-        else if (this.adminizer.modelHandler.model.get(modelName.toLowerCase()).primaryKey) {
-            return this.adminizer.modelHandler.model.get(modelName.toLowerCase()).primaryKey;
+        else if (model?.primaryKey) {
+            return model.primaryKey;
         }
         else {
             throw new Error("ConfigHelper > Identifier field was not found");
@@ -87,12 +81,13 @@ export class ConfigHelper {
             let displayField;
             try {
                 const associatedModelName = config.type === "association"
-                    ? modelField.model?.toLowerCase()
-                    : modelField.collection?.toLowerCase();
+                    ? modelField.model
+                    : modelField.collection;
                 if (!associatedModelName) {
                     throw new Error(`No model/collection defined for association field: ${key}`);
                 }
-                const associatedModel = adminizer.modelHandler.model.get(associatedModelName);
+                const resourceName = adminizer.modelHandler.resolveAssociationResource(associatedModelName, modelField.resourceName);
+                const associatedModel = resourceName ? adminizer.modelHandler.getResource(resourceName) : undefined;
                 if (!associatedModel) {
                     throw new Error(`Can not add relations to unloaded models; Config: ${JSON.stringify(config, null, 2)}`);
                 }
@@ -139,7 +134,13 @@ export class ConfigHelper {
                 additionalLinks: [
                     ...builtinLinks,
                     ...(config.navbar?.additionalLinks || [])
-                ]
+                ],
+                // Merged per section name so an app declaring its own sections
+                // keeps the built-in ones, while still being able to override them.
+                sections: {
+                    ...defaultConfig.navbar?.sections,
+                    ...config.navbar?.sections
+                }
             }
         };
         // Normalize auth config if it's a boolean

package/helpers/controllerHelper.d.ts

@@ -51,6 +51,7 @@ export declare class ControllerHelper {
      * @returns {?string}
      */
     static findModelResourceName(req: ReqType): string;
+    private static resolveConfiguredResourceName;
     /**
      * Searches for config from admin panel
      *

package/helpers/controllerHelper.js

@@ -89,19 +89,27 @@ export class ControllerHelper {
      * @returns {?string}
      */
     static findModelResourceName(req) {
-        if (req.params.modelResourceName) {
-            return req.params.modelResourceName;
+        const models = req.adminizer.config.models;
+        const requestedName = req.params.modelResourceName
+            ?? req.params.model
+            ?? req.originalUrl.split('/')[3];
+        return this.resolveConfiguredResourceName(models, requestedName);
+    }
+    static resolveConfiguredResourceName(models, requestedName) {
+        if (!models || !requestedName) {
+            throw new Error(`Model "${requestedName}" not found`);
         }
-        if (req.params.model) {
-            return req.params.model;
+        if (Object.prototype.hasOwnProperty.call(models, requestedName)) {
+            return requestedName;
         }
-        const urlParts = req.originalUrl.split('/');
-        const modelResourceName = urlParts[3];
-        const models = req.adminizer.config.models;
-        if (!models || !Object.keys(models).some(key => key.toLowerCase() === modelResourceName.toLowerCase())) {
-            throw new Error(`Model "${modelResourceName}" not found`);
+        const candidates = Object.keys(models).filter((key) => key.toLowerCase() === requestedName.toLowerCase());
+        if (candidates.length === 1) {
+            return candidates[0];
+        }
+        if (candidates.length > 1) {
+            throw new Error(`Model resource "${requestedName}" is ambiguous: ${candidates.join(", ")}`);
         }
-        return Object.keys(models).find(key => key.toLowerCase() === modelResourceName.toLowerCase());
+        throw new Error(`Model "${requestedName}" not found`);
     }
     /**
      * Searches for config from admin panel
@@ -116,12 +124,14 @@ export class ControllerHelper {
             Adminizer.log.error('No models configuration found');
             return null;
         }
-        const foundKey = Object.keys(models).find(key => key.toLowerCase() === modelResourceName.toLowerCase());
-        if (!foundKey) {
-            Adminizer.log.error(`No such route exists: ${modelResourceName}`);
+        try {
+            const foundKey = this.resolveConfiguredResourceName(models, modelResourceName);
+            return this._normalizeModelConfig(foundKey, models[foundKey]);
+        }
+        catch (error) {
+            Adminizer.log.error(error);
             return null;
         }
-        return this._normalizeModelConfig(foundKey, models[foundKey]);
     }
     /**
      * Will get action config from configuration file depending to given action
@@ -197,7 +207,7 @@ export class ControllerHelper {
         modelResource.config = this.findModelConfig(req, modelResourceName);
         // Find and add the model itself to the ModelResource
         if (this._isValidModelConfig(modelResource.config)) {
-            modelResource.model = req.adminizer.modelHandler.model.get(modelResource.config.model);
+            modelResource.model = req.adminizer.modelHandler.getResource(modelResourceName);
         }
         // Return the completed ModelResource object
         return modelResource;

package/helpers/fieldsHelper.d.ts

@@ -1,5 +1,6 @@
 import { ActionType, BaseFieldConfig, FieldsTypes, ModelConfig } from "../interfaces/adminpanelConfig.js";
 import { Attribute } from "../lib/model/AbstractModel.js";
+import { RecordAccessCache } from "../lib/access-graph/RecordAccessCache.js";
 export type Field = {
     config: BaseFieldConfig & {
         /** @deprecated record should not be in config anymore */
@@ -30,5 +31,5 @@ export declare class FieldsHelper {
      * @param action
      * @deprecated this method has overload association tree on each request that is not optimize
      */
-    static loadAssociations(req: ReqType, fields: Fields, action?: ActionType): Promise<Fields>;
+    static loadAssociations(req: ReqType, fields: Fields, action?: ActionType, recordAccessCache?: RecordAccessCache): Promise<Fields>;
 }

package/helpers/fieldsHelper.js

@@ -1,4 +1,5 @@
 import { DataAccessor } from "../lib/DataAccessor.js";
+import { RecordAccessCache } from "../lib/access-graph/RecordAccessCache.js";
 import { Adminizer } from "../lib/Adminizer.js";
 export class FieldsHelper {
     /**
@@ -11,7 +12,11 @@ export class FieldsHelper {
      * @deprecated this method has overload association tree on each request that is not optimize
      */
     // TODO: make separate request for all dropdown relations by api call
-    static async loadAssociations(req, fields, action) {
+    static async loadAssociations(req, fields, action, recordAccessCache = new RecordAccessCache()) {
+        // `getFieldsConfig()` returns undefined when the user has no rights on the model at all
+        if (!fields) {
+            return {};
+        }
         /**
          * Load all associated records for given field key
          *
@@ -30,9 +35,9 @@ export class FieldsHelper {
                 Adminizer.log.error('No model found for field: ', fields[key]);
                 return;
             }
-            const resolvedModelName = req.adminizer.modelHandler.resolveModelName(modelName);
-            let Model = req.adminizer.modelHandler.model.get(resolvedModelName);
-            if (!Model) {
+            const resolvedModelName = req.adminizer.modelHandler.resolveAssociationResource(modelName, fields[key].model.resourceName);
+            let Model = resolvedModelName ? req.adminizer.modelHandler.getResource(resolvedModelName) : undefined;
+            if (!Model || !resolvedModelName) {
                 return;
             }
             let list;
@@ -46,7 +51,8 @@ export class FieldsHelper {
                     model: Model,
                     uri: `${req.adminizer.config.routePrefix}/model/${resolvedModelName}`
                 };
-                let dataAccessor = new DataAccessor(req.adminizer, req.user, modelResource, "view");
+                // One cache for every dropdown of the page: the record-access lookups are identical
+                let dataAccessor = new DataAccessor(req.adminizer, req.user, modelResource, "view", recordAccessCache);
                 list = await Model.find({}, dataAccessor);
             }
             catch (e) {

package/helpers/inertiaActionsHelper.d.ts

@@ -7,4 +7,4 @@ export interface Actions {
     title: string;
     icon: string;
 }
-export default function inertiaActionsHelper(actionType: ActionType, modelResource: ModelResource, req: ReqType): Actions[];
+export default function inertiaActionsHelper(actionType: ActionType, modelResource: ModelResource, req: ReqType): Promise<Actions[]>;

package/helpers/inertiaActionsHelper.js

@@ -1,11 +1,10 @@
-export default function inertiaActionsHelper(actionType, modelResource, req) {
+export default async function inertiaActionsHelper(actionType, modelResource, req) {
     let resActions = [];
     if (req.adminizer.menuHelper.hasGlobalActions(modelResource.config, actionType)) {
         const actions = req.adminizer.menuHelper.getGlobalActions(modelResource.config, actionType);
         if (actions && actions.length > 0) {
-            actions.forEach(function (action) {
-                const context = `global action "${action.title}" (${action.id}) on model "${modelResource.name}"`;
-                if (req.adminizer.accessRightsHelper.hasPermission(action.accessRightsToken, req.user, context)) {
+            for (const action of actions) {
+                if (await req.adminizer.accessRightsHelper.checkPermission(action.accessRightsToken, req.user)) {
                     resActions.push({
                         link: action.link,
                         id: action.id,
@@ -14,7 +13,7 @@ export default function inertiaActionsHelper(actionType, modelResource, req) {
                         icon: action.icon
                     });
                 }
-            });
+            }
         }
     }
     return resActions;

package/helpers/inertiaAddHelper.d.ts

@@ -23,7 +23,7 @@ interface FieldProps extends Record<string | number | symbol, unknown> {
     postLink: string;
     model: string;
 }
-export default function inertiaAddHelper(req: ReqType, modelResource: ModelResource, fields: Fields, record?: Record<string, string | boolean | number | string[]>, view?: boolean): FieldProps;
+export default function inertiaAddHelper(req: ReqType, modelResource: ModelResource, fields: Fields, record?: Record<string, string | boolean | number | string[]>, view?: boolean): Promise<FieldProps>;
 export declare function getControlsOptions(fieldConfig: Field["config"], req: ReqType, type: ControlType, defaultControlName: string, context?: string): {
     name: string;
     config: any;

package/helpers/inertiaAddHelper.js

@@ -1,5 +1,6 @@
 import inertiaActionsHelper from "./inertiaActionsHelper.js";
 import { isObject } from "./JsUtils.js";
+import { withAssetVersion } from "./assetVersionHelper.js";
 import { Adminizer } from "../lib/Adminizer.js";
 const missingControlWarnings = new Set();
 /**
@@ -14,7 +15,7 @@ function getWeekNumber(date) {
     const yearStart = new Date(Date.UTC(d.getUTCFullYear(), 0, 1));
     return Math.ceil((((d.getTime() - yearStart.getTime()) / 86400000) + 1) / 7);
 }
-export default function inertiaAddHelper(req, modelResource, fields, record, view = false) {
+export default async function inertiaAddHelper(req, modelResource, fields, record, view = false) {
     const actionType = 'add';
     let props = {
         edit: !!record,
@@ -36,7 +37,7 @@ export default function inertiaAddHelper(req, modelResource, fields, record, vie
         postLink: record ? `${modelResource.uri}/edit/${record.id}` : `${modelResource.uri}/add`,
         model: modelResource.name.toLocaleLowerCase()
     };
-    props.actions = inertiaActionsHelper(actionType, modelResource, req);
+    props.actions = await inertiaActionsHelper(actionType, modelResource, req);
     const config = req.adminizer.configHelper.getConfig();
     for (const key of Object.keys(fields)) {
         if ((!config.showORMtime) && (key === 'createdAt' || key === 'updatedAt'))
@@ -62,7 +63,7 @@ export default function inertiaAddHelper(req, modelResource, fields, record, vie
         let canCreateRelated = false;
         const controlContext = `${modelResource.name}.${key}`;
         //@ts-ignore TODO: fix field type
-        if (modelResource.config.model && req.adminizer.configHelper.isId(field, modelResource.config.model)) {
+        if (req.adminizer.configHelper.isId(field, modelResource.name)) {
             disabled = true;
         }
         if (['string', 'password', 'date', 'datetime', 'time', 'integer', 'number', 'float', 'email', 'month', 'week', 'range'].includes(type)) {
@@ -118,7 +119,7 @@ export default function inertiaAddHelper(req, modelResource, fields, record, vie
                 ? req.adminizer.modelHandler.resolveModelName(rawRelatedModel)
                 : undefined;
             if (relatedModel && req.user) {
-                canCreateRelated = req.adminizer.accessRightsHelper.hasPermission(`create-${relatedModel}-model`, req.user);
+                canCreateRelated = await req.adminizer.accessRightsHelper.checkPermission(`create-${relatedModel}-model`, req.user);
             }
             else if (relatedModel && !req.adminizer.config.auth?.enable) {
                 canCreateRelated = true;
@@ -195,8 +196,8 @@ export function getControlsOptions(fieldConfig, req, type, defaultControlName, c
             ...(control?.getConfig() || {}), // Base config of the editor
             ...(shouldUseFieldConfig ? fieldOptions?.config || {} : {}),
         },
-        path: control.getJsPath(),
-        cssPath: control.getCssPath(),
+        path: withAssetVersion(control.getJsPath()),
+        cssPath: withAssetVersion(control.getCssPath()),
     };
     // If items are provided, use them instead of the CKEditor defaults.
     if (type === 'wysiwyg'

package/helpers/inertiaGroupHelper.js

@@ -1,3 +1,4 @@
+import { parseGroupPermissionGrant } from "./accessRightsHelper.js";
 export function inertiaGroupHelper(modelResource, req, users, groupedTokens, group, view = false) {
     let props = {
         edit: !!group,
@@ -55,8 +56,15 @@ export function inertiaGroupHelper(modelResource, req, users, groupedTokens, gro
                     label: token.name,
                     tooltip: token.description,
                     name: `token-checkbox-${token.id}`,
-                    value: group ? (group.tokens && group.tokens?.includes(token.id)) : false,
-                    type: 'checkbox'
+                    value: group ? Boolean(group.tokens?.some((value) => value === token.id || parseGroupPermissionGrant(value)?.tokenId === token.id)) : false,
+                    type: 'checkbox',
+                    options: token.getOptions ? {
+                        permissionOptions: {
+                            rights: group?.tokens
+                                ?.map(parseGroupPermissionGrant)
+                                .find((value) => value?.tokenId === token.id)?.rights ?? [],
+                        },
+                    } : undefined,
                 });
             }
             props.groupedTokens.push({

package/helpers/inertiaListHelper.d.ts

@@ -28,5 +28,5 @@ interface listProps extends Record<string | number | symbol, unknown> {
     defaultPageSize: number;
     pageSizeOptions: number[];
 }
-export declare function inertiaListHelper(modelResource: ModelResource, req: ReqType, fields: Fields, activeFilterName?: string): listProps;
+export declare function inertiaListHelper(modelResource: ModelResource, req: ReqType, fields: Fields, activeFilterName?: string): Promise<listProps>;
 export {};