adminizer 5.0.0-build.9 → 5.1.0-build.25

package/helpers/inertiaListHelper.js

@@ -1,5 +1,5 @@
 import inertiaActionsHelper from "./inertiaActionsHelper.js";
-export function inertiaListHelper(modelResource, req, fields, activeFilterName) {
+export async function inertiaListHelper(modelResource, req, fields, activeFilterName) {
     const actionType = 'list';
     // Check if filters are enabled for this model
     // Preferred: model-level `models.<Model>.filters`; fallback: legacy top-level `modelFilters.<Model>`
@@ -31,23 +31,22 @@ export function inertiaListHelper(modelResource, req, fields, activeFilterName)
         defaultPageSize: req.adminizer.config.list?.defaultPageSize ?? 50,
         pageSizeOptions: [5, 20, 50],
     };
-    if (modelResource.config.add && req.adminizer.accessRightsHelper.hasPermission(`create-${modelResource.name}-model`, req.user, `CRUD create on model "${modelResource.name}"`)) {
+    if (modelResource.config.add && await req.adminizer.accessRightsHelper.checkPermission(`create-${modelResource.name}-model`, req.user)) {
         props.crudActions.createTitle = req.i18n.__('create');
     }
-    if (modelResource.config.edit && req.adminizer.accessRightsHelper.hasPermission(`update-${modelResource.name}-model`, req.user, `CRUD update on model "${modelResource.name}"`)) {
+    if (modelResource.config.edit && await req.adminizer.accessRightsHelper.checkPermission(`update-${modelResource.name}-model`, req.user)) {
         props.crudActions.editTitle = req.i18n.__('Edit');
     }
-    if (modelResource.config.view && req.adminizer.accessRightsHelper.hasPermission(`read-${modelResource.name}-model`, req.user, `CRUD read on model "${modelResource.name}"`)) {
+    if (modelResource.config.view && await req.adminizer.accessRightsHelper.checkPermission(`read-${modelResource.name}-model`, req.user)) {
         props.crudActions.viewsTitle = req.i18n.__('View');
     }
-    if (modelResource.config.remove && req.adminizer.accessRightsHelper.hasPermission(`delete-${modelResource.name}-model`, req.user, `CRUD delete on model "${modelResource.name}"`)) {
+    if (modelResource.config.remove && await req.adminizer.accessRightsHelper.checkPermission(`delete-${modelResource.name}-model`, req.user)) {
         props.crudActions.deleteTitle = req.i18n.__('Delete');
     }
-    props.actions = inertiaActionsHelper(actionType, modelResource, req);
+    props.actions = await inertiaActionsHelper(actionType, modelResource, req);
     if (req.adminizer.menuHelper.hasInlineActions(modelResource.config, 'list')) {
         for (const inlineAction of req.adminizer.menuHelper.getInlineActions(modelResource.config, 'list')) {
-            const context = `inline action "${inlineAction.title}" (${inlineAction.id}) on model "${modelResource.name}"`;
-            if (req.adminizer.accessRightsHelper.hasPermission(inlineAction.accessRightsToken, req.user, context)) {
+            if (await req.adminizer.accessRightsHelper.checkPermission(inlineAction.accessRightsToken, req.user)) {
                 props.inlineActions.push({
                     icon: inlineAction.icon,
                     id: inlineAction.id,

package/helpers/inertiaMenuHelper.d.ts

@@ -1,12 +1,17 @@
 import { Adminizer } from "../lib/Adminizer.js";
+import { NavbarSectionConfig } from "../interfaces/adminpanelConfig.js";
 import { MenuItem } from "./menuHelper.js";
 export declare class InertiaMenuHelper {
     private adminizer;
     constructor(adminizer: Adminizer);
-    getMenuItems(req: ReqType): MenuItem[];
-    private filterAccessibleItems;
+    getMenuItems(req: ReqType): Promise<MenuItem[]>;
     private translateMenuItem;
     private translateHrefItem;
+    /**
+     * Navbar section metadata keyed by the *translated* section name, so the UI
+     * can look it up with the already-translated `section` of a menu item.
+     */
+    getSections(req: ReqType): Record<string, NavbarSectionConfig>;
     getBrandTitle(): string;
     getLogoutUrl(): string;
 }

package/helpers/inertiaMenuHelper.js

@@ -1,35 +1,12 @@
+import { listAccessibleMenuItems } from "./navigationAccessHelper.js";
 export class InertiaMenuHelper {
     adminizer;
     constructor(adminizer) {
         this.adminizer = adminizer;
     }
-    getMenuItems(req) {
-        const menu = [];
-        for (const menuItem of this.adminizer.menuHelper.getMenuItems(req.user)) {
-            const filteredActions = this.filterAccessibleItems(menuItem.actions ?? [], req);
-            const menuItemTokens = filteredActions.map(item => {
-                return item.accessRightsToken;
-            }).filter(item => {
-                return item;
-            });
-            if (menuItem.accessRightsToken)
-                menuItemTokens.push(menuItem.accessRightsToken);
-            if (this.adminizer.accessRightsHelper.enoughPermissions(menuItemTokens, req.user)) {
-                menu.push(this.translateMenuItem(req, {
-                    ...menuItem,
-                    actions: filteredActions
-                }));
-            }
-        }
-        return menu;
-    }
-    filterAccessibleItems(items, req) {
-        return items
-            .filter((item) => !item.accessRightsToken || this.adminizer.accessRightsHelper.hasPermission(item.accessRightsToken, req.user))
-            .map((item) => ({
-            ...item,
-            subItems: item.subItems ? this.filterAccessibleItems(item.subItems, req) : item.subItems
-        }));
+    async getMenuItems(req) {
+        return (await listAccessibleMenuItems(this.adminizer, req.user))
+            .map((menuItem) => this.translateMenuItem(req, menuItem));
     }
     translateMenuItem(req, menuItem) {
         return {
@@ -47,6 +24,14 @@ export class InertiaMenuHelper {
             subItems: item.subItems?.map((subItem) => this.translateHrefItem(req, subItem)),
         };
     }
+    /**
+     * Navbar section metadata keyed by the *translated* section name, so the UI
+     * can look it up with the already-translated `section` of a menu item.
+     */
+    getSections(req) {
+        const sections = this.adminizer.menuHelper.getSections();
+        return Object.fromEntries(Object.entries(sections).map(([name, section]) => [req.i18n.__(name), section]));
+    }
     getBrandTitle() {
         return this.adminizer.menuHelper.getBrandTitle();
     }

package/helpers/menuHelper.d.ts

@@ -4,7 +4,7 @@
  * @constructor
  */
 import { User } from "../models/User.js";
-import { ActionType, AdminpanelConfig, HrefConfig, ModelConfig } from "../interfaces/adminpanelConfig.js";
+import { ActionType, AdminpanelConfig, HrefConfig, ModelConfig, NavbarSectionConfig } from "../interfaces/adminpanelConfig.js";
 export type MenuItem = {
     link: string;
     title: string;
@@ -28,6 +28,16 @@ export declare class MenuHelper {
      * @returns {string}
      */
     getBrandTitle(): string;
+    /**
+     * Presentation metadata of navbar sections, keyed by section name.
+     *
+     * Only sections declared under `navbar.sections` are present: a section
+     * used by links but never configured simply has no entry, and the UI falls
+     * back to its default rendering.
+     *
+     * @returns {Record<string, NavbarSectionConfig>}
+     */
+    getSections(): Record<string, NavbarSectionConfig>;
     /**
      * Check if global actions buttons added to action
      *

package/helpers/menuHelper.js

@@ -63,6 +63,18 @@ export class MenuHelper {
         }
         return 'Adminizer';
     }
+    /**
+     * Presentation metadata of navbar sections, keyed by section name.
+     *
+     * Only sections declared under `navbar.sections` are present: a section
+     * used by links but never configured simply has no entry, and the UI falls
+     * back to its default rendering.
+     *
+     * @returns {Record<string, NavbarSectionConfig>}
+     */
+    getSections() {
+        return { ...(this.config.navbar?.sections ?? {}) };
+    }
     /**
      * Check if global actions buttons added to action
      *

package/helpers/modelResourceHelper.d.ts

@@ -0,0 +1,9 @@
+import type { ModelConfig } from '../interfaces/adminpanelConfig.js';
+import type { ModelResource } from '../interfaces/types.js';
+import type { Adminizer } from '../lib/Adminizer.js';
+/** Config defaults of a model resource declared as `true` in the panel config. */
+export declare function normalizeModelConfig(name: string, config: ModelConfig | boolean): ModelConfig;
+/** Every configured model resource whose model is actually registered. */
+export declare function listModelResources(adminizer: Adminizer): ModelResource[];
+/** Resolves a resource by its Adminizer name, then by a uniquely registered host model name. */
+export declare function resolveModelResource(adminizer: Adminizer, modelName: string): ModelResource | undefined;

package/helpers/modelResourceHelper.js

@@ -0,0 +1,43 @@
+/** Config defaults of a model resource declared as `true` in the panel config. */
+export function normalizeModelConfig(name, config) {
+    const baseConfig = {
+        model: name,
+        icon: "description",
+        title: name,
+        list: true,
+        add: true,
+        edit: true,
+        remove: true,
+        view: true,
+    };
+    if (typeof config === "boolean") {
+        return config ? baseConfig : { ...baseConfig, list: false, add: false, edit: false, remove: false, view: false };
+    }
+    return { ...baseConfig, ...config };
+}
+/** Every configured model resource whose model is actually registered. */
+export function listModelResources(adminizer) {
+    const resources = [];
+    for (const [configName, configValue] of Object.entries(adminizer.config.models ?? {})) {
+        const config = normalizeModelConfig(configName, configValue);
+        const model = adminizer.modelHandler.getResource(configName);
+        if (!model)
+            continue;
+        resources.push({
+            name: configName,
+            uri: `${adminizer.config.routePrefix}/model/${configName}`,
+            config,
+            model,
+        });
+    }
+    return resources;
+}
+/** Resolves a resource by its Adminizer name, then by a uniquely registered host model name. */
+export function resolveModelResource(adminizer, modelName) {
+    const requestedName = modelName.trim();
+    const resourceName = adminizer.modelHandler.getResourceRecord(requestedName)?.name
+        ?? adminizer.modelHandler.resolveResourceByHostModel(requestedName);
+    return resourceName
+        ? listModelResources(adminizer).find((resource) => resource.name === resourceName)
+        : undefined;
+}

package/helpers/navigationAccessHelper.d.ts

@@ -0,0 +1,13 @@
+import type { HrefConfig } from '../interfaces/adminpanelConfig.js';
+import type { Adminizer } from '../lib/Adminizer.js';
+import type { User } from '../models/User.js';
+import type { MenuItem } from './menuHelper.js';
+/** Drops the sub-items this user may not open, recursively. */
+export declare function filterAccessibleHrefItems(adminizer: Adminizer, user: User, items: HrefConfig[]): Promise<HrefConfig[]>;
+/**
+ * The navigation menu a user may actually open: configured models, additional
+ * links and app-contributed pages, filtered with the very same rules the
+ * sidebar uses. Titles are left untranslated, so callers that need i18n (the
+ * Inertia page props) translate on top of this.
+ */
+export declare function listAccessibleMenuItems(adminizer: Adminizer, user: User): Promise<MenuItem[]>;

package/helpers/navigationAccessHelper.js

@@ -0,0 +1,45 @@
+/** Drops the sub-items this user may not open, recursively. */
+export async function filterAccessibleHrefItems(adminizer, user, items) {
+    const accessible = [];
+    for (const item of items) {
+        if (item.accessRightsToken && !await adminizer.accessRightsHelper.checkPermission(item.accessRightsToken, user)) {
+            continue;
+        }
+        accessible.push({
+            ...item,
+            subItems: item.subItems ? await filterAccessibleHrefItems(adminizer, user, item.subItems) : item.subItems,
+        });
+    }
+    return accessible;
+}
+/**
+ * The navigation menu a user may actually open: configured models, additional
+ * links and app-contributed pages, filtered with the very same rules the
+ * sidebar uses. Titles are left untranslated, so callers that need i18n (the
+ * Inertia page props) translate on top of this.
+ */
+export async function listAccessibleMenuItems(adminizer, user) {
+    const menu = [];
+    for (const menuItem of adminizer.menuHelper.getMenuItems(user)) {
+        const actions = await filterAccessibleHrefItems(adminizer, user, menuItem.actions ?? []);
+        const tokens = actions.map((item) => item.accessRightsToken).filter(Boolean);
+        if (menuItem.accessRightsToken)
+            tokens.push(menuItem.accessRightsToken);
+        if (await adminizer.accessRightsHelper.checkAnyPermission(tokens, user)) {
+            menu.push({ ...menuItem, actions });
+        }
+    }
+    for (const link of await adminizer.adminLinkHandler.list(user)) {
+        menu.push({
+            id: link.id,
+            link: link.link,
+            title: link.title,
+            type: link.type === 'blank' ? 'blank' : 'self',
+            actions: null,
+            icon: null,
+            accessRightsToken: link.accessRightsToken ?? null,
+            section: link.section || 'Platform',
+        });
+    }
+    return menu;
+}

package/index.d.ts

@@ -27,6 +27,9 @@ export * from "./lib/media-manager/AbstractMediaManager.js";
 export * from "./lib/controls/Control.js";
 export * from "./lib/controls/ControlsHandler.js";
 export * from "./lib/Adminizer.js";
+export * from "./lib/docs/AbstractDocumentation.js";
+export * from "./lib/docs/DocumentationHandler.js";
+export * from "./lib/docs/FileDocumentation.js";
 export * from "./lib/I18n.js";
 export * from "./models/Group.js";
 export * from "./models/User.js";
@@ -43,7 +46,15 @@ export * from "./lib/helper/jwt.js";
 export * from "./lib/notifications/AbstractNotificationService.js";
 export * from "./lib/POWCaptcha.js";
 export * from "./lib/ai-assistant/AbstractAiModelService.js";
+export * from "./lib/ai-assistant/AbstractAiConversationHistoryService.js";
 export * from "./lib/ai-assistant/AiAssistantHandler.js";
+export * from "./lib/ai-assistant/AiAgentRunManager.js";
+export * from "./lib/ai-assistant/jsonSafe.js";
+export * from "./lib/ai-assistant/AiAssistantUiMethodHandler.js";
+export * from "./lib/ai-assistant/AiAssistantAgentSkillHandler.js";
+export * from "./lib/admin-links/AdminLinkHandler.js";
+export * from "./helpers/modelResourceHelper.js";
+export * from "./helpers/navigationAccessHelper.js";
 export * from "./lib/DataAccessor.js";
 export * from "./lib/history-actions/AbstractHistoryAdapter.js";
 export * from "./lib/filters/CustomFilterHandler.js";

package/index.js

@@ -27,6 +27,9 @@ export * from "./lib/media-manager/AbstractMediaManager.js";
 export * from "./lib/controls/Control.js";
 export * from "./lib/controls/ControlsHandler.js";
 export * from "./lib/Adminizer.js";
+export * from "./lib/docs/AbstractDocumentation.js";
+export * from "./lib/docs/DocumentationHandler.js";
+export * from "./lib/docs/FileDocumentation.js";
 export * from "./lib/I18n.js";
 export * from "./models/Group.js";
 export * from "./models/User.js";
@@ -43,7 +46,15 @@ export * from "./lib/helper/jwt.js";
 export * from "./lib/notifications/AbstractNotificationService.js";
 export * from "./lib/POWCaptcha.js";
 export * from "./lib/ai-assistant/AbstractAiModelService.js";
+export * from "./lib/ai-assistant/AbstractAiConversationHistoryService.js";
 export * from "./lib/ai-assistant/AiAssistantHandler.js";
+export * from "./lib/ai-assistant/AiAgentRunManager.js";
+export * from "./lib/ai-assistant/jsonSafe.js";
+export * from "./lib/ai-assistant/AiAssistantUiMethodHandler.js";
+export * from "./lib/ai-assistant/AiAssistantAgentSkillHandler.js";
+export * from "./lib/admin-links/AdminLinkHandler.js";
+export * from "./helpers/modelResourceHelper.js";
+export * from "./helpers/navigationAccessHelper.js";
 export * from "./lib/DataAccessor.js";
 export * from "./lib/history-actions/AbstractHistoryAdapter.js";
 export * from "./lib/filters/CustomFilterHandler.js";

package/interfaces/adminpanelConfig.d.ts

@@ -75,6 +75,26 @@ export interface AdminpanelConfig {
     models: {
         [key: string]: ModelConfig;
     };
+    /**
+     * Relationship-based record access (ReBAC): each key declares one access graph —
+     * models whose records inherit visibility from a root model down parent edges.
+     * Membership is granted once, on root records (same `through` form as the membership
+     * variant of `userAccessRelation`), and every model of the graph is filtered by it
+     * transitively. The graph wins over a covered model's own `userAccessRelation`: once a
+     * graph covers a model, that declaration stops applying. Declaring both is a configuration
+     * error and is reported as one when the graph compiles.
+     * Global CRUD tokens remain the upper bound: the graph narrows visibility, it never
+     * grants access the token gates denied.
+     *
+     * EXPERIMENTAL: the configuration format and access semantics may change in a minor release.
+     * Declaring this section makes Adminizer log a warning at boot naming the graphs in use.
+     *
+     * @beta
+     *
+     */
+    accessGraph?: {
+        [graphKey: string]: AccessGraphConfig;
+    };
     /**
      * For custom adminpanel sections, displays inside header
      * */
@@ -107,6 +127,14 @@ export interface AdminpanelConfig {
         sectionHandlers?: {
             [section: string]: (user: User, links: HrefConfig[]) => HrefConfig[];
         };
+        /**
+         * Presentation metadata for navbar sections, keyed by section name.
+         * The sections themselves are declared by the `section` field of individual
+         * links; this map only controls how a section header is drawn.
+         */
+        sections?: {
+            [section: string]: NavbarSectionConfig;
+        };
     };
     /**
      * Policies that will be executed before going to every page
@@ -223,6 +251,14 @@ export interface AdminpanelConfig {
         defaultModel?: string;
         models?: string[];
     };
+    /**
+     * Knowledge base (built-in documentation). The implementation is
+     * registered separately: `adminizer.documentationHandler.register(service)`.
+     */
+    documentation?: {
+        /** Master switch of the subsystem; nothing is brought up unless `true` */
+        enabled?: boolean;
+    };
     cors?: {
         enabled: boolean;
         origin: string[] | string;
@@ -299,9 +335,14 @@ export interface ModelConfig {
     adapter?: string;
     title: string;
     /**
-     * Model name
+     * Physical host ORM model name.
      * */
     model: string;
+    /**
+     * Required only when two or more Adminizer resources use the same host model.
+     * The primary resource is selected for associations that reference the host model.
+     */
+    primary?: boolean;
     /**
      * Optional display name for history. Should be a attribute of the model, or a function.
      */
@@ -392,16 +433,117 @@ export interface ModelConfig {
      * */
     identifierField?: string;
     /** In this field we can set model field, for which we want to check user access right.
-     *  May be association or association-many to User or Group */
+     *  May be association or association-many to User or Group
+     *
+     *  @deprecated Declare record access with {@link AdminpanelConfig.accessGraph} instead.
+     *  The membership form (`{field, through, via, group}`) is a single-edge access graph
+     *  written in a second syntax — same `membership` declaration, `field` becomes the
+     *  `include` edge's `parent`. The string and `{field, via}` forms have no graph
+     *  equivalent yet (the graph seeds root ids from membership rows, not from an owner
+     *  foreign key), so this option is removed in stages rather than at once.
+     *  Note that this option is already inert wherever an `accessGraph` covers the model:
+     *  the graph wins and the declaration below is ignored.
+     *
+     *  TODO: removal plan, its prerequisites and the migration recipe live in
+     *  `.ai-notes/todo/user-access-relation-removal.md`; the reasoning behind the
+     *  deprecation — including the one behaviour the graph does not reproduce (its root
+     *  model becomes record-restricted too) — in `.ai-notes/user-access-relation-deprecation.md`.
+     */
     userAccessRelation?: {
         field: string;
         via?: string;
+        /** Membership form: a join model holding exactly one relation to the model `field` points at,
+         *  a `via` relation to User and, optionally, a `group` relation to Group. Records are then
+         *  filtered to the targets the user has a membership row for. */
+        through?: string;
+        /** Field in `through` that associates with Group. When set, a membership only counts for the
+         *  actions whose CRUD token (`<verb>-<model>-model`) that group carries, so the same user may
+         *  hold different rights in different targets. Global tokens remain the upper bound: this
+         *  narrows rows, it never grants access the token gates denied. */
+        group?: string;
     } | string;
     userAccessRelationCallback?: (userWithGroups: UserWithGroups, record: any) => boolean;
 }
 type UserWithGroups = User & {
     groups: Group[];
 };
+/** CRUD verb of the action being performed, as used in `<verb>-<model>-model` tokens. */
+export type AccessGraphActionVerb = "create" | "read" | "update" | "delete";
+/** Ids of the root records the user may see, `"all"` for an explicit bypass, or
+ *  `undefined` to fall back to the declared `membership`. */
+export type AccessGraphRootIds = unknown[] | "all" | undefined;
+/**
+ * One access graph: a root model carrying memberships plus the models that inherit
+ * its visibility down explicit parent edges.
+ */
+export interface AccessGraphConfig {
+    /** Root model of the graph; memberships are granted on its records. */
+    root: string;
+    /**
+     * Membership declaration at the root: `through` is a join model holding exactly one
+     * relation to the root model, a `via` relation to User and, optionally, a `group`
+     * relation to Group. With `group` declared, a membership only counts for the actions
+     * whose CRUD token (`<verb>-<model>-model`, checked against the model being accessed)
+     * that group carries.
+     */
+    membership?: {
+        through: string;
+        via: string;
+        group?: string;
+    };
+    /**
+     * Models covered by the graph. Each entry names the association alias the model uses
+     * to look at its parent in the graph; the parent model is derived from that alias and
+     * must itself belong to the graph (the root or another `include` entry). Exactly one
+     * edge per model — the parent is never guessed from foreign keys.
+     */
+    include?: {
+        [modelName: string]: {
+            /** Association alias on this model pointing at its parent in the graph. */
+            parent: string;
+        };
+    };
+    /**
+     * Stage 2: denormalized root-id columns. For a listed model the read filter collapses
+     * to one step — `{<column>: {in: graphRootIds}}` — instead of walking the parent chain.
+     * The column is maintained by the application; Adminizer only filters by it. The model
+     * still declares its `include` edge — writes keep validating the chosen parent.
+     */
+    graphRootField?: {
+        [modelName: string]: string;
+    };
+    /**
+     * Stage 3: compile the read filter into one nested-subquery SQL emitted by the adapter
+     * instead of materializing intermediate id lists in the application. Applies when every
+     * model on the path (and the membership model) lives on the same adapter connection;
+     * otherwise the resolver falls back to per-level materialization automatically. The SQL
+     * is generated from this declaration — no hand-written queries.
+     *
+     * Why it exists: the default walk costs one query per level of the chain, and the last of
+     * them carries every intermediate id the user can reach as a literal `IN (...)` list. The
+     * price of the filter therefore grows with the size of the user's data, not with the size
+     * of the page — a member of 500 projects ships ~25 000 task ids to render 25 rows, while
+     * the pushed-down form emits one statement of constant size whatever the account holds.
+     * The accounts it slows down first are the biggest ones.
+     *
+     * Setting it is a permission, not a guarantee: a chain that cannot be compiled goes back to
+     * materialization, and the write path never uses pushdown at all. The fallback is invisible in
+     * the result, so it is logged — one warning per model, naming the graph and the reason. Silence
+     * means the chain compiled.
+     */
+    pushdown?: boolean;
+    /**
+     * Token id that lets its holders see the whole graph unfiltered. Matched against the
+     * token grants of the user's global groups; it does not need to be a registered token.
+     */
+    bypassToken?: string;
+    /**
+     * Replaces the membership source at the root without touching the graph below it.
+     * Returning `undefined` falls back to the declared `membership`; `"all"` is the
+     * explicit bypass. The result is still bounded by global tokens.
+     */
+    resolveGraphRootIds?: (user: User, actionVerb: AccessGraphActionVerb) => Promise<AccessGraphRootIds> | AccessGraphRootIds;
+}
 export type ModelFieldConfig = (BaseFieldConfig | TuiEditorFieldConfig) & {
     groupsAccessRights?: string[];
 };
@@ -583,6 +725,22 @@ export interface HrefConfig {
      */
     section?: string;
 }
+/**
+ * Presentation of a single navbar section header.
+ */
+export interface NavbarSectionConfig {
+    /**
+     * Icon of the section header. Also used as the section's trigger in the
+     * collapsed (icon-only) sidebar.
+     */
+    icon?: MaterialIcon;
+    /**
+     * Explicit position of the section. Sections carrying an `order` are sorted
+     * ascending and placed before the ones without it, which keep the default
+     * ordering (`Platform` first, `System` last, the rest alphabetically).
+     */
+    order?: number;
+}
 export interface MediaManagerConfig {
     fileStoragePath: string;
     allowMIME?: string[];

package/interfaces/queryCriteria.d.ts

@@ -47,6 +47,19 @@ export interface QueryCriteria<TModel = any> {
     where?: CriteriaWhere<TModel>;
     select?: CriteriaSelect;
     populate?: CriteriaPopulate<TModel>;
+    /**
+     * Record-access confinement of single populated associations, keyed by association
+     * name and ANDed into the populate JOIN's ON clause: a populated record failing the
+     * condition arrives as its bare foreign-key value instead of an object, while the
+     * owning row itself stays in the result — unlike `populate.<field>.where`, which
+     * confines the owning rows.
+     *
+     * Set exclusively by `DataAccessor.pushDownPopulateAccess` for the associations the
+     * adapter declared pushdown-capable (`AbstractModel.canPushdownPopulateAccess`);
+     * `sanitizeUserRelationAccess` discards an incoming value, so hand-built criteria
+     * cannot suppress the association verification that trusts this key.
+     */
+    populateOn?: Record<string, CriteriaWhere>;
     sort?: CriteriaSort;
     limit?: number;
     skip?: number;