Next

adminforth/commands/createApp/templates/index.ts.hbs

@@ -3,6 +3,7 @@ import AdminForth from 'adminforth';
 import usersResource from "./resources/adminuser.js";
 import { fileURLToPath } from 'url';
 import path from 'path';
+import { Filters } from 'adminforth';
 
 const ADMIN_BASE_URL = '';
 
@@ -15,6 +16,12 @@ export const admin = new AdminForth({
     rememberMeDays: 30,
     loginBackgroundImage: 'https://images.unsplash.com/photo-1534239697798-120952b76f2b?q=80&w=3389&auto=format&fit=crop&ixlib=rb-4.0.3&ixid=M3wxMjA3fDB8MHxwaG90by1wYWdlfHx8fGVufDB8fHx8fA%3D%3D',
     loginBackgroundPosition: '1/2',
+    loginPromptHTML: async () => { 
+      const adminforthUserExists = await admin.resource("adminuser").count(Filters.EQ('email', 'adminforth')) > 0;
+      if (adminforthUserExists) {
+        return "Please use <b>adminforth</b> as username and <b>adminforth</b> as password"
+      }
+    },
   },
   customization: {
     brandName: "{{appName}}",

adminforth/commands/createCustomComponent/configLoader.js

@@ -2,7 +2,10 @@ import fs from 'fs/promises';
 import path from 'path';
 import chalk from 'chalk';
 import jiti from 'jiti';
+import dotenv from "dotenv";
 
+dotenv.config({ path: '.env.local', override: true });
+dotenv.config({ path: '.env', override: true });
 
 export async function loadAdminForthConfig() {
   const configFileName = 'index.ts';

adminforth/dataConnectors/baseConnector.ts

@@ -114,7 +114,23 @@ export default class AdminForthBaseConnector implements IAdminForthDataSourceCon
       const fieldObj = resource.dataSourceColumns.find((col) => col.name == (filters as IAdminForthSingleFilter).field);
       if (!fieldObj) {
         const similar = suggestIfTypo(resource.dataSourceColumns.map((col) => col.name), (filters as IAdminForthSingleFilter).field);
-        throw new Error(`Field '${(filters as IAdminForthSingleFilter).field}' not found in resource '${resource.resourceId}'. ${similar ? `Did you mean '${similar}'?` : ''}`);
+
+        let isPolymorphicTarget = false;
+        if (global.adminforth?.config?.resources) {
+          isPolymorphicTarget = global.adminforth.config.resources.some(res => 
+            res.dataSourceColumns.some(col => 
+              col.foreignResource?.polymorphicResources?.some(pr => 
+                pr.resourceId === resource.resourceId
+              )
+            )
+          );
+        }
+        if (isPolymorphicTarget) {
+          process.env.HEAVY_DEBUG && console.log(`⚠️  Field '${(filters as IAdminForthSingleFilter).field}' not found in polymorphic target resource '${resource.resourceId}', allowing query to proceed.`);
+          return { ok: true, error: '' };
+        } else {
+          throw new Error(`Field '${(filters as IAdminForthSingleFilter).field}' not found in resource '${resource.resourceId}'. ${similar ? `Did you mean '${similar}'?` : ''}`);
+        }
       }
       // value normalization
       if (filters.operator == AdminForthFilterOperators.IN || filters.operator == AdminForthFilterOperators.NIN) {

adminforth/dataConnectors/mongo.ts

@@ -69,6 +69,7 @@ class MongoConnector extends AdminForthBaseConnector implements IAdminForthDataS
             return Number.isInteger(value) ? 'integer' : 'float';
           }
           if (value instanceof Date) return 'datetime';
+          if (value && typeof value === 'object' && ('$numberDecimal' in value || value._bsontype === 'Decimal128')) return 'decimal';
           if (typeof value === 'object') return 'json';
           return 'string';
         }
@@ -89,13 +90,18 @@ class MongoConnector extends AdminForthBaseConnector implements IAdminForthDataS
               sampleValues.set(fullKey, value);
             }
 
-            if (
-              value instanceof Buffer ||
-              (value && typeof value === 'object' && (value as any)._bsontype === 'Decimal128')
-            ) {
+            if (value instanceof Buffer) {
               addType(fullKey, 'json');
               return;
             }
+            if (
+                value &&
+                typeof value === 'object' &&
+                ('$numberDecimal' in value || (value as any)._bsontype === 'Decimal128')
+              ) {
+              addType(fullKey, 'decimal');
+              return;
+            }
 
             if (
               value && 
@@ -104,9 +110,10 @@ class MongoConnector extends AdminForthBaseConnector implements IAdminForthDataS
               !(value instanceof Date)
             ) {
               addType(fullKey, 'json');
-            } else {
-              addType(fullKey, detectType(value));
+              return
             }
+
+            addType(fullKey, detectType(value));
           });
         }
 
@@ -117,7 +124,7 @@ class MongoConnector extends AdminForthBaseConnector implements IAdminForthDataS
         return Array.from(fieldTypes.entries()).map(([name, types]) => {
           const primaryKey = name === '_id';
 
-          const priority = ['datetime', 'date', 'integer', 'float', 'boolean', 'json', 'string'];
+          const priority = ['datetime', 'date', 'integer', 'float', 'boolean', 'json', 'decimal',  'string'];
 
           const matched = priority.find(t => types.has(t)) || 'string';
 
@@ -129,8 +136,8 @@ class MongoConnector extends AdminForthBaseConnector implements IAdminForthDataS
             datetime: 'DATETIME',
             date: 'DATE',
             json: 'JSON',
+            decimal: 'DECIMAL',
           };
-
           return {
             name,
             type: typeMap[matched] ?? 'STRING',

adminforth/documentation/blog/2024-10-01-ai-blog/index.md

@@ -199,7 +199,7 @@ model ContentImage {
 Create a migration:
 
 ```bash
-npm run makemigration -- --name add-posts && npm run migrate:local
+npm run makemigration -- --name add-posts ; npm run migrate:local
 ```
 
 

adminforth/documentation/docs/tutorial/001-gettingStarted.md

@@ -89,7 +89,7 @@ This will create a migration file in `migrations` and apply it to the database.
 In future, when you need to add new resources, you need to modify `schema.prisma` (add models, change fields, etc.). After doing any modification you need to create a new migration using next command:
 
 ```bash
-npm run makemigration -- --name init && npm run migrate:local
+npm run makemigration -- --name init ; npm run migrate:local
 ```
 
 Other developers need to pull migration and run `npm run migrateLocal` to apply any unapplied migrations.
@@ -173,7 +173,7 @@ model apartments {
 Run the following command to create a new migration:
 
 ```bash
-npm run makemigration -- --name add-apartments && npm run migrate:local
+npm run makemigration -- --name add-apartments ; npm run migrate:local
 ```
 
 ### Step3. Create the `apartments` resource
@@ -292,6 +292,7 @@ export default {
       name: 'realtor_id',
       foreignResource: {
         resourceId: 'adminuser',
+        searchableFields: ["id", "email"], // fields available for search in filter
       }
     }
   ],

adminforth/documentation/docs/tutorial/01-helloWorld.md

@@ -122,7 +122,7 @@ model Post {
 Create database using `prisma migrate`:
 
 ```bash
-npm run makemigration --name init && npm run migrate:local
+npm run makemigration --name init ; npm run migrate:local
 ```
 
 ## Setting up AdminForth

adminforth/documentation/docs/tutorial/03-Customization/01-branding.md

@@ -94,6 +94,26 @@ const admin = new AdminForth({
 Here is how it looks:
 ![AdminForth Themes](image-10.png)
 
+## Single theme
+
+If you want to enforce a consistent theme and disable the theme switcher, you can configure AdminForth to use only one theme variant. 
+
+```ts title='./index.ts'
+
+const admin = new AdminForth({
+  ...
+  customization: {
+  //diff-add
+    singleTheme: "light",
+    styles: {
+      ...
+      }
+    } 
+  },
+  ...
+});
+```
+
 
 ## Square vs rounded buttons?
 
@@ -149,4 +169,52 @@ auth: {
 `loginBackgroundPosition` accepts values:
 
 - `over` - image will be over the whole login page with cover mode
-- `1/2`(default), `3/4`, `2/5`, `3/5` etc. - image will be in the left side of the login page with cover mode
+- `1/2`(default), `3/4`, `2/5`, `3/5` etc. - image will be in the left side of the login page with cover mode
+
+### Disabling background blend mode
+
+When using `loginBackgroundPosition: 'over'`, AdminForth applies a background blend mode by default to ensure text readability over the background image. If you want to disable this blend mode and display the background image without any overlay effects, you can add:
+
+```ts title='./index.ts'
+auth: {
+  ...
+  loginBackgroundImage: '@@/photo-1516501312919-d0cb0b7b60b8.jpeg',
+  loginBackgroundPosition: 'over',
+//diff-add
+  removeBackgroundBlendMode: true,
+}
+
+```
+
+## Custom items in html head
+
+If you want to add custom elements to the HTML head, you can define them in the configuration:
+
+```ts title='./index.ts'
+customization: {
+  customHeadItems: [
+    {
+      tagName: 'link',
+      attributes: {
+        rel: 'stylesheet',
+        href: 'https://example.com/custom.css'
+      }
+    },
+    {
+      tagName: 'script',
+      attributes: {
+        src: 'https://example.com/custom.js',
+        defer: true
+      }
+    },
+    {
+      tagName: 'meta',
+      attributes: {
+        name: 'theme-color',
+        content: ' #000000'
+      }
+    }
+  ]
+}
+
+```

adminforth/documentation/docs/tutorial/03-Customization/02-customFieldRendering.md

@@ -194,6 +194,7 @@ const props = defineProps<{
   meta: any;
   resource: AdminForthResourceCommon;
   adminUser: AdminUser;
+  readonly: boolean;
 }>();
 
 const emit = defineEmits(["update:value"]);

adminforth/documentation/docs/tutorial/03-Customization/03-virtualColumns.md

@@ -235,21 +235,4 @@ Hook still has access to the virtual field `updates.password`, and we use built-
 After hook is executed, `updates.password` will be removed from the record since it is virtual, so password itself will not be saved to the database.
 
 
-### Backend-only fields
-
-Another important point is that `hashed_password` field should never be passed to frontend due to security reasons.
-
-To do it we have 2 options:
-
-1) Do not list `password_hash` in the `columns` array of the resource. If AdminForth knows nothing about field
-it will never pass this field to frontend.
-2) Define `password_hash` in columns way but set `backendOnly`. The scond option is more explicit and should be preferrred
-
-```ts
-{
-  name: 'password_hash',
-  type: AdminForthDataTypes.STRING,
-  showIn: { all: false },
-  backendOnly: true,  // will never go to frontend
-}
-```
+

adminforth/documentation/docs/tutorial/03-Customization/06-customPages.md

@@ -306,11 +306,14 @@ Open `index.ts` file and add the following code *BEFORE* `admin.express.serve(`
 
 ```ts title="/index.ts"
 
+import type { IAdminUserExpressRequest } from 'adminforth';
+import express from 'express';
+
 ....
 
 app.get(`${ADMIN_BASE_URL}/api/dashboard/`,
   admin.express.authorize(
-    async (req:any, res:any) => {
+    async (req:IAdminUserExpressRequest, res: express.Response) => {
       const days = req.body.days || 7;
       const apartsByDays = admin.resource('aparts').dataConnector.client.prepare(
         `SELECT 

adminforth/documentation/docs/tutorial/03-Customization/08-pageInjections.md

@@ -98,9 +98,14 @@ Now create file `ApartsPie.vue` in the `custom` folder of your project:
 Also we have to add an Api to get percentages:
 
 ```ts title="./index.ts"
+import type { IAdminUserExpressRequest } from 'adminforth';
+import express from 'express';
+
+....
+
   app.get(`${ADMIN_BASE_URL}/api/aparts-by-room-percentages/`,
     admin.express.authorize(
-      async (req, res) => {
+      async (req: IAdminUserExpressRequest, res: express.Response) => {
         const roomPercentages = await admin.resource('aparts').dataConnector.client.prepare(
           `SELECT 
             number_of_rooms, 

adminforth/documentation/docs/tutorial/03-Customization/09-Actions.md

@@ -95,6 +95,10 @@ To implement this limitation use `allowed`:
 If you want to prohibit the use of bulk action for user, you can do it this way:
 
 ```ts title="./resources/apartments.ts"
+import { admin } from '../index';
+
+....
+
 bulkActions: [
   {
     label: 'Mark as listed',

adminforth/documentation/docs/tutorial/03-Customization/12-security.md

@@ -140,4 +140,72 @@ server {
         proxy_set_header X-Forwarded-For $remote_addr;
     }
 }
-```
+```
+
+
+
+### Backend-only fields
+
+Some fields should never be accessed on frontend. For example, `hashed_password` field which is always created using CLI initial app, should never be passed to frontend due to security reasons.
+If any user of system can read `hashed_password` of another user, it can lead to account compromise.
+
+To eliminate it we have 2 options:
+
+1) Do not list `password_hash` in the `columns` array of the resource. If AdminForth knows nothing about field
+it will never pass this field to frontend!
+2) Define `password_hash` in columns way but set `backendOnly`. 
+
+The second option is more explicit and should be preferred. This option is used by default in CLI-bootstrapped projects:
+
+```ts
+{
+  name: 'password_hash',
+  type: AdminForthDataTypes.STRING,
+  showIn: { all: false },
+  backendOnly: true,  // will never go to frontend
+}
+```
+
+#### Dynamically hide fields depending on user ACL / role
+
+You can use `column.showIn` to show or hide column for user depending on his role.
+
+However even if `showIn` value (or value returned by showIn function) is `false`, record value will still go to frontend and will be
+visible in the Network tab, so advanced user can still access field value. We did it in this way to provide AdminForth developers with ability to quickly use any record field in custom components.
+
+However if you need securely hide only certain fields depending on role, you should use `column.backendOnly` and pass function there.
+
+Let's consider example:
+
+```ts
+{
+  name: 'email',
+  type: AdminForthDataTypes.STRING,
+  showIn: { 
+//diff-add
+    all: false, 
+//diff-add
+    list: ({ adminUser }: { adminUser: AdminUser }) => adminUser.dbUser.role === 'superadmin',
+  },
+}
+```
+
+So if you will configure the email column in user resource like this, only superadmin will be able to see emails, and only in the list view.
+However, the email will still be present in the record and can be accessed by advanced users through the Network tab.
+
+So to completely hide the email field from all users apart superadmins, you should use `column.backendOnly` and pass a function there.
+
+```ts
+{
+  name: 'email',
+  type: AdminForthDataTypes.STRING,
+//diff-add
+  backendOnly: ({ adminUser }: { adminUser: AdminUser }) => adminUser.dbUser.role === 'superadmin',
+  showIn: { 
+    all: false, 
+    list: ({ adminUser }: { adminUser: AdminUser }) => adminUser.dbUser.role === 'superadmin',
+  },
+}
+```
+
+So if you will configure the email column in user resource like this, only superadmin will be able to see emails, and only in the list view.