sveltekit-admin 0.5.3 → 0.8.1

package/dist/server/handler.d.ts

@@ -2,11 +2,21 @@
  * SvelteKit Admin - Standalone Handler
  * Zero files needed in routes - everything handled via hook
  */
+import type { DataAdapter, SchemaIntrospector } from './adapters/types.js';
+import type { AuditEvent } from './audit.js';
+import { type CsrfConfig } from './csrf.js';
+import type { AdminPlugin } from './plugin.js';
 export interface AdminHandlerConfig {
-    /** Prisma client instance */
-    prisma: any;
-    /** Path to Prisma schema file */
-    prismaSchemaPath?: string;
+    /**
+     * Explicit `{ introspector, data }` pair, from `createPrismaAdapter`,
+     * `createDrizzleAdapter`, or a custom implementation. The `{ prisma,
+     * prismaSchemaPath }` shortcut lives on the Prisma wrapper exported by
+     * the package root, not here.
+     */
+    adapter: {
+        introspector: SchemaIntrospector;
+        data: DataAdapter;
+    };
     /** Base path for admin routes (default: /admin) */
     basePath?: string;
     /** Authentication check - return true if user can access admin */
@@ -32,12 +42,50 @@ export interface AdminHandlerConfig {
     logout?: (event: any) => void | Promise<void>;
     /** Where to redirect after logout (default: '/') */
     logoutRedirectTo?: string;
+    /**
+     * Cross-site protection for every state-changing admin request (create /
+     * update / delete, `_logout`, `_search`). On by default; a missing `Origin`
+     * is rejected, as SvelteKit does. `trustedOrigins` allows a second
+     * legitimate origin, `csrf: false` opts out entirely.
+     *
+     * Why this isn't left to `kit.csrf.checkOrigin`, and the same-origin threat
+     * it does not cover: see `csrf.ts` and /docs/csrf.
+     */
+    csrf?: CsrfConfig;
+    /**
+     * Audit sink — same "bring your own" philosophy as `authCheck` / `logout`.
+     * The library has no log table and no session of its own, so it cannot
+     * know where to persist "admin X changed row Y" (your `AuditLog` model,
+     * a logger, an HTTP sink…). You provide the side effect; the handler
+     * calls it **after a successful create / update / delete** with a
+     * redacted `AuditEvent`. No callback means no behaviour change: no
+     * extra reads, no calls.
+     *
+     * The actor is whatever you already put on `event.locals` (the same
+     * object `authCheck` sees). Sensitive field names (`password` / `hash` /
+     * `secret` / `token`) and per-model `hidden` fields are stripped from
+     * `values` / `before` / `after` / `changes` so the sink cannot become a
+     * second oracle for secrets. Reads (GET), logout, and `_search` are
+     * not audited.
+     *
+     * Awaited before the 303 so a `prisma.auditLog.create(...)` inside the
+     * callback commits before the redirect. If the callback throws, the
+     * mutation still redirects — the write is the source of truth, the log
+     * is a sidecar (`console.error` with prefix
+     * `[sveltekit-admin] audit callback failed:`). There is no way to wrap
+     * the adapter write and your sink in one transaction without owning
+     * both stores.
+     */
+    audit?: (entry: AuditEvent) => void | Promise<void>;
     /** Per-model configuration */
     models?: Record<string, {
         hidden?: string[];
         readonly?: string[];
         listFields?: string[];
         label?: string;
+        scope?: (ctx: {
+            locals?: any;
+        }) => Record<string, unknown> | import('./adapters/types.js').Filter;
         /**
          * Scoping `where` applied to the LIST VIEW ONLY of this model
          * (search, sidebar filters, FK filter, pagination count) — composed
@@ -129,23 +177,22 @@ export interface AdminHandlerConfig {
         linkThreshold?: number;
         autoDetect?: boolean;
     };
-    /**
-     * Recherche texte libre : configuration globale.
-     * `mode`: 'auto' détecte le provider du schéma et n'émet `mode: 'insensitive'`
-     * que sur postgresql/cockroachdb/mongodb (les seuls où Prisma le supporte —
-     * l'émettre sur sqlite/mysql/sqlserver lève une erreur Prisma). 'insensitive'
-     * et 'default' forcent le comportement, pour un provider non détectable
-     * (`provider = env(...)`) ou un besoin spécifique (index `citext`, etc.).
-     * Voir docs/design/list-search-filters.md §2.5.
-     */
-    search?: {
-        mode?: 'auto' | 'insensitive' | 'default';
-    };
     /** Custom branding */
     branding?: {
         title?: string;
         primaryColor?: string;
     };
+    /**
+     * Optional admin plugins (new pages + record actions). Omitted or `[]`
+     * keeps every builtin view byte-identical to a build without plugins.
+     * Plugin routes are matched before builtins, so a registered pattern
+     * with a literal token in a `:model`/`:id` position can take over a
+     * builtin path when it matches first (e.g. `['user']` shadows the User
+     * list); only an identical, token-for-token overlay throws at boot.
+     * See `AdminPlugin`. Options like graph `depth` belong on the author's
+     * factory, not here.
+     */
+    plugins?: AdminPlugin[];
 }
 export declare function createAdminHandler(config: AdminHandlerConfig): ({ event, resolve }: {
     event: any;