webspresso 0.0.99 → 0.0.101

package/index.js

@@ -191,6 +191,31 @@ module.exports = {
   RouteTable,
   mountDiscoveredRoutes,
   resolveMiddlewares: require('./src/routing/middleware-resolver').resolveMiddlewares,
+
+  // Forms & Flash subsystem (AdonisJS & Django-inspired)
+  createFlashMiddleware: require('./core/forms').createFlashMiddleware,
+  normalizeErrors: require('./core/forms').normalizeErrors,
+  renderField: require('./core/forms').renderField,
+  renderFormFor: require('./core/forms').renderFormFor,
+
+  // Authorization & Policies (AdonisJS Bouncer & Django Permissions-inspired)
+  Bouncer: require('./core/auth/bouncer').Bouncer,
+  createBouncer: require('./core/auth/bouncer').createBouncer,
+  createBouncerMiddleware: require('./core/auth/bouncer').createBouncerMiddleware,
+  definePolicy: require('./core/auth/policy').definePolicy,
+  defineGate: require('./core/auth/policy').defineGate,
+  can: require('./core/auth/policy').can,
+  cannot: require('./core/auth/policy').cannot,
+  authorize: require('./core/auth/policy').authorize,
+
+  // Decoupled Events & Signals (AdonisJS Events & Django Signals-inspired)
+  EventDispatcher: require('./core/events').EventDispatcher,
+  createEventDispatcher: require('./core/events').createEventDispatcher,
+  events: require('./core/events').events,
+  Signal: require('./core/events').Signal,
+  defineSignal: require('./core/events').defineSignal,
+  defineListener: require('./core/events').defineListener,
+  loadListeners: require('./core/events').loadListeners,
 };
 
 // Define lazy getters for plugins and heavy core subsystems
@@ -272,5 +297,24 @@ Object.defineProperties(module.exports, {
   createDevProfilerMiddleware: { get: () => require('./src/dev').createDevProfilerMiddleware, enumerable: true, configurable: true },
   generateTypes: { get: () => require('./src/dev/typegen').generateTypes, enumerable: true, configurable: true },
   typegen: { get: () => require('./src/dev/typegen'), enumerable: true, configurable: true },
+
+  // Webhooks plugin
+  webhooks: { get: () => require('./plugins/webhooks'), enumerable: true, configurable: true },
+  webhooksPlugin: { get: () => require('./plugins/webhooks').webhooksPlugin, enumerable: true, configurable: true },
+
+  // Mail & Mailable (AdonisJS & Django-inspired)
+  mail: { get: () => require('./core/mail'), enumerable: true, configurable: true },
+  Mailable: { get: () => require('./core/mail').Mailable, enumerable: true, configurable: true },
+  createMailer: { get: () => require('./core/mail').createMailer, enumerable: true, configurable: true },
+  Mailer: { get: () => require('./core/mail').Mailer, enumerable: true, configurable: true },
+  MemoryTransport: { get: () => require('./core/mail').MemoryTransport, enumerable: true, configurable: true },
+  ConsoleTransport: { get: () => require('./core/mail').ConsoleTransport, enumerable: true, configurable: true },
+  FileTransport: { get: () => require('./core/mail').FileTransport, enumerable: true, configurable: true },
+
+  // Commands & CLI (Django manage.py & Adonis Ace-inspired)
+  commands: { get: () => require('./core/commands'), enumerable: true, configurable: true },
+  defineCommand: { get: () => require('./core/commands').defineCommand, enumerable: true, configurable: true },
+  createCommandRegistry: { get: () => require('./core/commands').createCommandRegistry, enumerable: true, configurable: true },
+  executeCommand: { get: () => require('./core/commands').executeCommand, enumerable: true, configurable: true },
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.99",
+  "version": "0.0.101",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",
@@ -51,6 +51,9 @@
     "test:fast": "vitest run tests/unit/*branches.test.js tests/unit/auth.test.js tests/unit/services.test.js tests/unit/server.test.js",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
+    "test:coverage:quick": "vitest run --coverage",
+    "test:coverage:changed": "vitest run --coverage --changed",
+    "test:coverage:full": "FULL_REPORT=true vitest run --coverage",
     "test:coverage:branches": "vitest run tests/unit/*branches.test.js --coverage",
     "test:coverage:unit": "vitest run tests/unit/ --coverage",
     "test:coverage:core": "vitest run tests/unit/core* tests/unit/server* tests/unit/routing* tests/unit/template* --coverage",
@@ -111,6 +114,7 @@
     "alpinejs": "^3.15.11",
     "bcrypt": "^5.1.1",
     "commander": "^11.1.0",
+    "compression": "^1.8.2",
     "connect-timeout": "^1.9.1",
     "cookie-parser": "^1.4.7",
     "csv-parse": "^7.0.2",
@@ -126,7 +130,7 @@
     "nodemailer": "^10.0.10",
     "nunjucks": "^3.2.4",
     "sanitize-html": "^2.17.7",
-    "sharp": "^0.35.4",
+    "sharp": "^0.35.5",
     "swup": "^4.8.3",
     "yaml": "^2.8.3",
     "zod": "^3.23.0",
@@ -167,7 +171,7 @@
     "@types/node": "^20.14.0",
     "@vitest/coverage-v8": "^4.1.11",
     "better-sqlite3": "^11.10.0",
-    "chokidar": "^3.5.3",
+    "chokidar": "^4.0.3",
     "docboot": "^0.3.0",
     "dotenv": "^16.3.1",
     "express-rate-limit": "^8.4.1",
@@ -181,9 +185,11 @@
     "node": ">=20.0.0"
   },
   "overrides": {
-    "basic-ftp": "^5.3.0",
+    "basic-ftp": "^6.2.1",
+    "chokidar": "^4.0.3",
+    "katex": "^0.18.2",
     "tar": "^7.5.11",
-    "undici": "^6.24.0",
+    "undici": "^6.28.1",
     "uuid": "^11.1.1",
     "js-yaml": "^5.4.2",
     "qs": "^6.16.0"

package/plugins/admin-panel/api.js

@@ -66,6 +66,14 @@ function createApiHandlers(options) {
     return getModel(modelName);
   }
 
+  // Helper to check if model has column (supports zdb and zod shapes)
+  function hasColumn(model, colName) {
+    if (!model || !colName) return false;
+    if (model.columns && typeof model.columns.has === 'function' && model.columns.has(colName)) return true;
+    if (model.schema?.shape && colName in model.schema.shape) return true;
+    return false;
+  }
+
   // Get AdminUser repository
   let AdminUserRepo = null;
   if (db && AdminUser) {
@@ -282,6 +290,10 @@ function createApiHandlers(options) {
             permissions: model.admin.permissions || null,
             displayField: model.admin.displayField || null,
             defaultSort: model.admin.defaultSort || null,
+            inlines: model.admin.inlines || null,
+            listEditable: model.admin.listEditable || null,
+            dateHierarchy: model.admin.dateHierarchy || null,
+            listFilter: model.admin.listFilter || null,
           });
         }
       }
@@ -375,6 +387,10 @@ function isColumnSortable(name, meta, model) {
         group: model.admin.group || null,
         columnsConfig: model.admin.columns || null,
         relationsConfig: model.admin.relations || null,
+        inlines: model.admin.inlines || null,
+        listEditable: model.admin.listEditable || null,
+        dateHierarchy: model.admin.dateHierarchy || null,
+        listFilter: model.admin.listFilter || null,
         actions: [
           ...(registry && typeof registry.getActionsForModel === 'function' ? registry.getActionsForModel(model.name) : []),
           ...(Array.isArray(model.admin.actions) ? model.admin.actions : []),
@@ -445,6 +461,37 @@ function isColumnSortable(name, meta, model) {
         }
       }
 
+      // Date hierarchy filter (Django date_hierarchy-inspired)
+      const dateHierarchyCol = req.query.date_field || model.admin?.dateHierarchy;
+      if (dateHierarchyCol && hasColumn(model, dateHierarchyCol)) {
+        const { year, month, day, date_from, date_to } = req.query;
+        if (year) {
+          const yr = String(year);
+          if (month) {
+            const mo = String(month).padStart(2, '0');
+            if (day) {
+              const da = String(day).padStart(2, '0');
+              query = query.where(dateHierarchyCol, 'like', `${yr}-${mo}-${da}%`);
+              countQuery = countQuery.where(dateHierarchyCol, 'like', `${yr}-${mo}-${da}%`);
+            } else {
+              query = query.where(dateHierarchyCol, 'like', `${yr}-${mo}%`);
+              countQuery = countQuery.where(dateHierarchyCol, 'like', `${yr}-${mo}%`);
+            }
+          } else {
+            query = query.where(dateHierarchyCol, 'like', `${yr}%`);
+            countQuery = countQuery.where(dateHierarchyCol, 'like', `${yr}%`);
+          }
+        }
+        if (date_from) {
+          query = query.where(dateHierarchyCol, '>=', date_from);
+          countQuery = countQuery.where(dateHierarchyCol, '>=', date_from);
+        }
+        if (date_to) {
+          query = query.where(dateHierarchyCol, '<=', date_to);
+          countQuery = countQuery.where(dateHierarchyCol, '<=', date_to);
+        }
+      }
+
       // Parse filter parameters from query string
       // Express's qs library automatically parses filter[column][prop] into nested objects
       // So req.query.filter is already { column: { op: '...', value: '...' } }
@@ -646,13 +693,72 @@ function isColumnSortable(name, meta, model) {
         await registry.runHooks('onRecordView', { model: model.name, id, record, req, user: req.session?.adminUser, db });
       }
 
-      res.json({ data: sanitizeForOutput(record, model) });
+      const sanitized = sanitizeForOutput(record, model);
+
+      // Auto-load inlines (Django Inlines-inspired)
+      if (model.admin?.inlines && Array.isArray(model.admin.inlines)) {
+        const inlinesData = {};
+        for (const inlineDef of model.admin.inlines) {
+          const targetModel = getModelFromDb(inlineDef.model);
+          if (targetModel) {
+            const targetRepo = db.getRepository(targetModel.name);
+            const fk = inlineDef.foreignKey || `${model.name.toLowerCase()}_id`;
+            const rows = await targetRepo.query().where(fk, id).find();
+            inlinesData[inlineDef.model] = sanitizeForOutput(rows, targetModel);
+          }
+        }
+        sanitized._inlines = inlinesData;
+      }
+
+      res.json({ data: sanitized });
     } catch (error) {
       const statusCode = error.statusCode || error.status || 500;
       res.status(statusCode).json({ error: error.message });
     }
   }
 
+  /**
+   * Sync inline child records for a parent record (Django Inlines-inspired)
+   */
+  async function syncInlines(parentRecord, inlinesPayload, model) {
+    if (!model.admin?.inlines || !inlinesPayload || typeof inlinesPayload !== 'object') {
+      return;
+    }
+    for (const inlineDef of model.admin.inlines) {
+      const inlineModelName = inlineDef.model;
+      const items = inlinesPayload[inlineModelName];
+      if (!Array.isArray(items)) continue;
+
+      const targetModel = getModelFromDb(inlineModelName);
+      if (!targetModel) continue;
+
+      const targetRepo = db.getRepository(targetModel.name);
+      const fk = inlineDef.foreignKey || `${model.name.toLowerCase()}_id`;
+      const parentId = parentRecord[model.primaryKey || 'id'];
+
+      for (const item of items) {
+        if (!item || typeof item !== 'object') continue;
+        const itemId = item[targetModel.primaryKey || 'id'];
+
+        if (item._delete === true || item._destroy === true) {
+          if (itemId) {
+            await targetRepo.delete(itemId);
+          }
+        } else if (itemId) {
+          const cleanItem = { ...item };
+          delete cleanItem._delete;
+          delete cleanItem._destroy;
+          await targetRepo.update(itemId, cleanItem);
+        } else {
+          const cleanItem = { ...item, [fk]: parentId };
+          delete cleanItem._delete;
+          delete cleanItem._destroy;
+          await targetRepo.create(cleanItem);
+        }
+      }
+    }
+  }
+
   /** Extract structured field errors from Zod, ORM or database validation exceptions */
   function extractValidationErrors(error) {
     if (!error) return null;
@@ -717,8 +823,17 @@ function isColumnSortable(name, meta, model) {
         }
       }
 
+      const payload = { ...req.body };
+      const inlinesData = payload._inlines || payload.inlines;
+      delete payload._inlines;
+      delete payload.inlines;
+
       const repo = db.getRepository(model.name);
-      const record = await repo.create(req.body);
+      const record = await repo.create(payload);
+
+      if (inlinesData) {
+        await syncInlines(record, inlinesData, model);
+      }
 
       if (registry && typeof registry.runHooks === 'function') {
         await registry.runHooks('afterCreate', { model: model.name, record, data: req.body, req, user: req.session?.adminUser, db });
@@ -770,13 +885,22 @@ function isColumnSortable(name, meta, model) {
         }
       }
 
+      const payload = { ...req.body };
+      const inlinesData = payload._inlines || payload.inlines;
+      delete payload._inlines;
+      delete payload.inlines;
+
       const repo = db.getRepository(model.name);
-      const record = await repo.update(id, req.body);
+      const record = await repo.update(id, payload);
 
       if (!record) {
         return res.status(404).json({ error: 'Record not found' });
       }
 
+      if (inlinesData) {
+        await syncInlines(record, inlinesData, model);
+      }
+
       if (registry && typeof registry.runHooks === 'function') {
         await registry.runHooks('afterUpdate', { model: model.name, id, record, data: req.body, req, user: req.session?.adminUser, db });
       }
@@ -1074,6 +1198,379 @@ function isColumnSortable(name, meta, model) {
     }
   }
 
+
+
+  /**
+   * List inline records for a specific parent record (Django Inlines-inspired)
+   */
+  async function inlineListHandler(req, res) {
+    try {
+      const { model: modelName, id, inlineModel: inlineModelName } = req.params;
+      const model = getModelFromDb(modelName);
+      const inlineModel = getModelFromDb(inlineModelName);
+
+      if (!model || !inlineModel) {
+        return res.status(404).json({ error: 'Model or inline model not found' });
+      }
+
+      const inlineDef = (model.admin?.inlines || []).find(i => i.model === inlineModelName) || {};
+      const fk = inlineDef.foreignKey || `${model.name.toLowerCase()}_id`;
+
+      const repo = db.getRepository(inlineModel.name);
+      const records = await repo.query().where(fk, id).find();
+
+      res.json({ data: sanitizeForOutput(records, inlineModel) });
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  }
+
+  /**
+   * Create inline record for a specific parent record (Django Inlines-inspired)
+   */
+  async function inlineCreateHandler(req, res) {
+    try {
+      const { model: modelName, id, inlineModel: inlineModelName } = req.params;
+      const model = getModelFromDb(modelName);
+      const inlineModel = getModelFromDb(inlineModelName);
+
+      if (!model || !inlineModel) {
+        return res.status(404).json({ error: 'Model or inline model not found' });
+      }
+
+      const inlineDef = (model.admin?.inlines || []).find(i => i.model === inlineModelName) || {};
+      const fk = inlineDef.foreignKey || `${model.name.toLowerCase()}_id`;
+
+      const repo = db.getRepository(inlineModel.name);
+      const payload = { ...req.body, [fk]: id };
+      const record = await repo.create(payload);
+
+      res.status(201).json({ data: sanitizeForOutput(record, inlineModel) });
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  }
+
+  /**
+   * Update inline record
+   */
+  async function inlineUpdateHandler(req, res) {
+    try {
+      const { inlineModel: inlineModelName, inlineId } = req.params;
+      const inlineModel = getModelFromDb(inlineModelName);
+
+      if (!inlineModel) {
+        return res.status(404).json({ error: 'Inline model not found' });
+      }
+
+      const repo = db.getRepository(inlineModel.name);
+      const record = await repo.update(inlineId, req.body);
+
+      if (!record) {
+        return res.status(404).json({ error: 'Inline record not found' });
+      }
+
+      res.json({ data: sanitizeForOutput(record, inlineModel) });
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  }
+
+  /**
+   * Delete inline record
+   */
+  async function inlineDeleteHandler(req, res) {
+    try {
+      const { inlineModel: inlineModelName, inlineId } = req.params;
+      const inlineModel = getModelFromDb(inlineModelName);
+
+      if (!inlineModel) {
+        return res.status(404).json({ error: 'Inline model not found' });
+      }
+
+      const repo = db.getRepository(inlineModel.name);
+      await repo.delete(inlineId);
+
+      res.json({ success: true });
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  }
+
+  /**
+   * Quick-edit a single record inline without full form submission (Django list_editable-inspired)
+   */
+  async function quickEditHandler(req, res) {
+    try {
+      const { model: modelName, id } = req.params;
+      const model = getModelFromDb(modelName);
+
+      if (!model || !model.admin || model.admin.enabled !== true) {
+        return res.status(404).json({ error: 'Model not found or not enabled' });
+      }
+      if (model.admin.readOnly === true || model.admin.permissions?.edit === false) {
+        return res.status(403).json({ error: `Editing is disabled for model "${model.name}"` });
+      }
+
+      const allowedCols = Array.isArray(model.admin.listEditable) ? model.admin.listEditable : null;
+      const updates = {};
+      for (const [k, v] of Object.entries(req.body)) {
+        if (allowedCols && !allowedCols.includes(k)) {
+          return res.status(400).json({ error: `Column "${k}" is not list-editable on model "${model.name}"` });
+        }
+        if (hasColumn(model, k)) {
+          updates[k] = v;
+        }
+      }
+
+      if (Object.keys(updates).length === 0) {
+        return res.status(400).json({ error: 'No valid editable fields provided' });
+      }
+
+      const repo = db.getRepository(model.name);
+      const record = await repo.update(id, updates);
+      if (!record) {
+        return res.status(404).json({ error: 'Record not found' });
+      }
+
+      res.json({ success: true, data: sanitizeForOutput(record, model) });
+    } catch (error) {
+      const fields = extractValidationErrors(error);
+      const statusCode = error.statusCode || error.status || 400;
+      res.status(statusCode).json({ error: error.message, ...(fields ? { fields } : {}) });
+    }
+  }
+
+  /**
+   * Batch edit multiple records inline (Django list_editable bulk save)
+   */
+  async function batchEditHandler(req, res) {
+    try {
+      const { model: modelName } = req.params;
+      const model = getModelFromDb(modelName);
+
+      if (!model || !model.admin || model.admin.enabled !== true) {
+        return res.status(404).json({ error: 'Model not found or not enabled' });
+      }
+      if (model.admin.readOnly === true || model.admin.permissions?.edit === false) {
+        return res.status(403).json({ error: `Editing is disabled for model "${model.name}"` });
+      }
+
+      const updates = req.body.updates;
+      if (!Array.isArray(updates) || updates.length === 0) {
+        return res.status(400).json({ error: 'Array of updates is required' });
+      }
+
+      const allowedCols = Array.isArray(model.admin.listEditable) ? model.admin.listEditable : null;
+      const repo = db.getRepository(model.name);
+      const results = [];
+
+      for (const item of updates) {
+        const { id, changes } = item;
+        if (!id || !changes || typeof changes !== 'object') continue;
+
+        const cleanChanges = {};
+        for (const [k, v] of Object.entries(changes)) {
+          if (allowedCols && !allowedCols.includes(k)) continue;
+          if (hasColumn(model, k)) {
+            cleanChanges[k] = v;
+          }
+        }
+
+        if (Object.keys(cleanChanges).length > 0) {
+          const updated = await repo.update(id, cleanChanges);
+          if (updated) {
+            results.push(sanitizeForOutput(updated, model));
+          }
+        }
+      }
+
+      res.json({ success: true, count: results.length, records: results });
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  }
+
+  /**
+   * Date hierarchy drilldown aggregation (Django date_hierarchy-inspired)
+   */
+  async function dateHierarchyHandler(req, res) {
+    try {
+      const { model: modelName } = req.params;
+      const model = getModelFromDb(modelName);
+
+      if (!model || !model.admin || model.admin.enabled !== true) {
+        return res.status(404).json({ error: 'Model not found or not enabled' });
+      }
+
+      const dateField = req.query.field || model.admin.dateHierarchy || 'created_at';
+      if (!hasColumn(model, dateField)) {
+        return res.status(400).json({ error: `Date field "${dateField}" does not exist on model "${model.name}"` });
+      }
+
+      const year = req.query.year ? parseInt(req.query.year) : null;
+      const month = req.query.month ? parseInt(req.query.month) : null;
+
+      const repo = db.getRepository(model.name);
+      let query = repo.query().whereNotNull(dateField);
+
+      // If drilldown to days
+      if (year && month) {
+        const prefix = `${year}-${String(month).padStart(2, '0')}`;
+        query = query.where(dateField, 'like', `${prefix}%`);
+        const rows = await query.select(dateField).find();
+
+        const counts = {};
+        for (const r of rows) {
+          const val = String(r[dateField]);
+          const dayMatch = val.match(/^\d{4}-\d{2}-(\d{2})/);
+          if (dayMatch) {
+            const d = parseInt(dayMatch[1]);
+            counts[d] = (counts[d] || 0) + 1;
+          }
+        }
+
+        const days = Object.entries(counts)
+          .map(([d, count]) => ({ day: parseInt(d), count }))
+          .sort((a, b) => a.day - b.day);
+
+        return res.json({ level: 'days', year, month, items: days });
+      }
+
+      // If drilldown to months
+      if (year) {
+        query = query.where(dateField, 'like', `${year}%`);
+        const rows = await query.select(dateField).find();
+
+        const counts = {};
+        for (const r of rows) {
+          const val = String(r[dateField]);
+          const match = val.match(/^\d{4}-(\d{2})/);
+          if (match) {
+            const m = parseInt(match[1]);
+            counts[m] = (counts[m] || 0) + 1;
+          }
+        }
+
+        const months = Object.entries(counts)
+          .map(([m, count]) => ({ month: parseInt(m), count }))
+          .sort((a, b) => a.month - b.month);
+
+        return res.json({ level: 'months', year, items: months });
+      }
+
+      // Top level: drilldown by year
+      const rows = await query.select(dateField).find();
+      const counts = {};
+      for (const r of rows) {
+        const val = String(r[dateField]);
+        const match = val.match(/^(\d{4})/);
+        if (match) {
+          const y = parseInt(match[1]);
+          counts[y] = (counts[y] || 0) + 1;
+        }
+      }
+
+      const years = Object.entries(counts)
+        .map(([y, count]) => ({ year: parseInt(y), count }))
+        .sort((a, b) => b.year - a.year);
+
+      return res.json({ level: 'years', field: dateField, items: years });
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  }
+
+  /**
+   * Filter facets aggregation for list_filter columns (Django list_filter-inspired)
+   */
+  async function filterFacetsHandler(req, res) {
+    try {
+      const { model: modelName } = req.params;
+      const model = getModelFromDb(modelName);
+
+      if (!model || !model.admin || model.admin.enabled !== true) {
+        return res.status(404).json({ error: 'Model not found or not enabled' });
+      }
+
+      const requestedFields = req.query.fields
+        ? req.query.fields.split(',').map(s => s.trim())
+        : (model.admin.listFilter || model.admin.filterable || []);
+
+      const repo = db.getRepository(model.name);
+      const facets = {};
+
+      for (const field of requestedFields) {
+        if (!hasColumn(model, field)) continue;
+        const rows = await repo.query().whereNotNull(field).select(field).find();
+        const counts = {};
+        for (const r of rows) {
+          const val = r[field];
+          const key = val === null || val === undefined ? '' : String(val);
+          counts[key] = (counts[key] || 0) + 1;
+        }
+        facets[field] = Object.entries(counts).map(([value, count]) => ({
+          value,
+          count,
+        })).sort((a, b) => b.count - a.count);
+      }
+
+      res.json({ facets });
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  }
+
+  /**
+   * Execute model action or bulk action (Django Actions-inspired)
+   */
+  async function modelActionHandler(req, res) {
+    try {
+      const { model: modelName, actionId } = req.params;
+      const model = getModelFromDb(modelName);
+
+      if (!model || !model.admin || model.admin.enabled !== true) {
+        return res.status(404).json({ error: 'Model not found or not enabled' });
+      }
+
+      const { ids } = req.body;
+      if (!Array.isArray(ids) || ids.length === 0) {
+        return res.status(400).json({ error: 'Array of record ids is required' });
+      }
+
+      const modelActions = Array.isArray(model.admin.actions) ? model.admin.actions : [];
+      const modelBulkActions = Array.isArray(model.admin.bulkActions) ? model.admin.bulkActions : [];
+      const action = modelActions.find(a => a.id === actionId) || modelBulkActions.find(a => a.id === actionId);
+
+      const repo = db.getRepository(model.name);
+
+      if (action && typeof action.handler === 'function') {
+        const result = await action.handler({
+          ids,
+          model,
+          repo,
+          db,
+          req,
+          user: req.session?.adminUser,
+        });
+        return res.json({ success: true, ...(typeof result === 'object' ? result : { result }) });
+      }
+
+      if (registry && typeof registry.getBulkAction === 'function') {
+        const bulkAction = registry.getBulkAction(actionId);
+        if (bulkAction && typeof bulkAction.handler === 'function') {
+          const records = await repo.query().whereIn(model.primaryKey || 'id', ids).find();
+          const result = await bulkAction.handler(records, model.name, { db, req, user: req.session?.adminUser });
+          return res.json({ success: true, ...(typeof result === 'object' ? result : { result }) });
+        }
+      }
+
+      return res.status(404).json({ error: `Action "${actionId}" not found for model "${model.name}"` });
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  }
+
   return {
     checkHandler,
     setupHandler,
@@ -1094,6 +1591,15 @@ function isColumnSortable(name, meta, model) {
     resetHandler,
     rateLimiter,
     resetLoginAttempts: (ip) => rateLimiter.reset(ip),
+    inlineListHandler,
+    inlineCreateHandler,
+    inlineUpdateHandler,
+    inlineDeleteHandler,
+    quickEditHandler,
+    batchEditHandler,
+    dateHierarchyHandler,
+    filterFacetsHandler,
+    modelActionHandler,
   };
 }