v1.18.1

v1.18.1

Patch release on the v1.18 line. Fixes authorisation and query defects found by running the package against a live
instance, and removes the two frontend entry points that had no backend behind them.

• Requires: Go 1.25+, goravel/framework v1.18.x
• Upgrade: go get github.com/wcz0/goravel-admin@v1.18.1, then re-run go run . artisan admin:init to backfill the
  permission/menu links (the command is idempotent, so it is safe on an existing database).

Security

• Anonymous access to the user list. config/admin.go listed system/admin_users in both auth.except and
  permission.except, so GET /admin-api/system/admin_users returned every account without a token. Both allow-lists
  are now empty; unauthenticated requests get 401.
• Non-super-admins received 403 on every endpoint. AdminUser.AllPermissions() tried to fill []AdminPermission
  from the AdminRoles relation, which can never match, so it always returned nil. It now aggregates permissions
  across all roles and de-duplicates by permission id.

Fixed

• Permission wildcards never matched. The pattern was stripped of its leading slash before matching, while
  ctx.Request().Path() is /admin-api/.... Matching now goes through tools.MatchPath, which normalises both sides.
• Blank sidebar for regular admins. The seeded permissions pointed at paths this package does not serve
  (/auth/roles and friends), and admin_permission_menu had no rows at all. Seeds now use the real routes and create
  the permission-to-menu links; admin:init backfills them.
• Every list filter was silently ignored. Goravel's Where/WhereIn/Order return a new Query; 13 call sites
  dropped the return value, so search boxes returned the full table and the id != ? uniqueness check never applied.
  All sites assign the result, and OR groups use WhereAny.
• admin:init was not idempotent. A raw INSERT and a Create each inserted the same user-role row, and the
  permission/menu/relationship steps duplicated on every run. Everything is FirstOrCreate now; three consecutive runs
  keep the data constant (role_users=1 / perms=8 / menus=7 / role_perms=12 / perm_menus=18).
• User list had no pagination. The response carried only items, so amis could not render a pager, and roles were
  queried per row. The list now returns total / page / perPage (capped at 500) and preloads AdminRoles.
• Upgrading kept stale permission paths. admin:init used FirstOrCreate for the eight built-in permissions, so an
  existing database kept the old http_path values (/auth/roles and friends) and non-super-admins stayed blocked.
  It now compares and updates name and http_path for those slugs when they differ. Verified by resetting one row to
  ["/auth/users"] and re-running the command: the row came back with the real route.

Removed

• "Get PHP Code" button and the /dev_tools/editor page. Both called POST /dev_tools/editor_parse, which was never
  implemented — Go has no equivalent of owl-admin's amis()->Xxx() codegen — so the call returned an empty 200. The
  amis schema editor (custom-amis-editor) is unchanged and still edits admin_pages schemas.
• The code generator leftovers. admin_code_generators was a table with no model, controller or route behind it,
  plus a dead /dev_tools/code_generator menu entry and ~100 lines of unused copy in both language packs. The migration,
  the admin:doctor table check and the menu entry are gone; the migration count drops from 13 to 12. Existing
  databases can DROP TABLE admin_code_generators and delete its row from the migrations table.
• core.Menu.Extra() and devToolMenus(). Both were dead code: nothing ever called Extra(), and the routes it
  built pointed at frontend pages that do not exist (user_setting, /dev_tools/editor, /dev_tools/code_generator).
  Dev-tools pages are reached through menu records like any other admin page.
• The "Differences from owl-admin" table in the README. Runtime extension install, the PHP code generator and
  multi-module sub-admins are out of scope for this package rather than gaps; the README states the scope in one
  paragraph. dev_tools/extensions still stores the extension registry and enable/disable state.

Verification

• go build ./..., go vet ./... and go test ./... pass on this branch; example/ compiles.
• example/smoke_admin.py passes 20/20 contract checks against a live instance and can be re-run on the same database
  (each run uses a fresh unique suffix).
• Live checks: anonymous → 401; a non-super-admin sees the dashboard and system menus, gets 200 on
  system/admin_users and system/admin_roles, and 403 on system/admin_menus and system/permissions.
• The embedded frontend build contains no editor_parse reference.

Compatibility

• No API additions or signature changes; existing hosts only need go get plus admin:init.
• Goravel 1.17 users should use v1.17.1 from the goravel-1.17 branch.

v1.18.0

v1.18.0

First release of goravel-admin as an installable Goravel package on the v1.18 support line, and the first release that
reaches feature parity with owl-admin v4.7.5 on the backend contract.

• Requires: Go 1.25+, goravel/framework v1.18.x
• Frontend: owl-admin v4.7.5 build (amis 6.13.0) — no frontend changes needed
• Database: SQLite, MySQL, PostgreSQL or SQL Server

Highlights

• Installable package. go run github.com/wcz0/goravel-admin/setup install registers the service provider and
  writes an optional config/admin.go skeleton. Migrations mount themselves during Boot; the installer no longer
  touches bootstrap/migrations.go.
• Captcha on login. GET /captcha issues a data-URI image and a single-use session id; enable it with
  ADMIN_LOGIN_CAPTCHA=true.
• Custom amis pages. Page schemas are stored in admin_pages and served through GET /page_schema?sign=; menus of
  type url_type=4 render them.
• Chunked upload. upload_chunk_start / upload_chunk / upload_chunk_finish with md5 verification per part, a
  target directory allow-list and script extensions rejected.
• xlsx export. List pages get "export all / this page / selected" actions; downloads go through an HMAC-signed,
  expiring _download_export URL with path traversal protection.
• Dev tools. Pages, dynamic APIs (10 built-in templates), relationships (9 types with preview_code) and an
  extension registry, enabled with ADMIN_SHOW_DEVELOPMENT_TOOLS=true.
• Icon search. GET /_iconify_search serves 220k iconify names embedded in the binary.
• Console commands. admin:create-user, admin:reset-password and admin:doctor.
• English docs. README.md (English) and README.zh-CN.md (Chinese); this changelog is English only.

Breaking changes

The repository is no longer a skeleton application. If you forked or copied app/** from an earlier commit:

• controllers, middleware, models, migrations, commands and routes now live at the package root with imports under
  github.com/wcz0/goravel-admin/...
• the host main.go, bootstrap/ and config/ skeletons moved to example/
• default configuration is provided by config.New() and merged into host configuration (host wins) during
  ServiceProvider.Register
• routes, assets and the embedded entry page are registered in ServiceProvider.Boot; prefixes remain /admin,
  /admin-assets and /admin-api
• goravel-authz is gone; permissions are handled by the built-in RBAC and the permission column value was renamed
  to slug

Upgrade guide

go get github.com/wcz0/goravel-admin@v1.18.0
go run github.com/wcz0/goravel-admin/setup install
go run . artisan migrate
go run . artisan admin:doctor

admin:doctor verifies APP_KEY, database connectivity, the 13 core tables, admin accounts, home menu uniqueness and
broken menu parents. If you upgraded from a version that used goravel-authz, drop the casbin_rules table and the
admin_rule model — both are no longer used.

Compatibility

• admin.auth.guard defaults to admin and is now used for both token issuing and middleware verification. If you
  customised config/auth.go, keep this key in sync.
• Goravel 1.17 users should stay on the goravel-1.17 branch (v1.17.x). Goravel 1.16 is not supported: it lacks
  foundation.Setup(), packages.Setup.Paths() and modify.RegisterProvider.
• owl-admin capabilities with no Go equivalent (runtime extension install, PHP code generator, amis DSL editor,
  multi-module) are documented in the README under "Differences from owl-admin".

Verification

• go build ./..., go vet ./..., go test ./... pass; example/ compiles.
• example/smoke_admin.py passes 17/17 contract checks against a live instance: login, _settings, captcha, iconify
  search, page create + page_schema + duplicate sign, rejected ghost ids, dynamic API duplicate path, relationship
  types and preview, extension registry with id=0 rejection, chunked upload, export download plus tampered-signature
  rejection, profile update, menus, and the schema of the four built-in list pages.

v1.17.1

v1.17.1

Patch release on the v1.17 line. Fixes authorisation and query defects found by running the package against a live
instance, and removes the two frontend entry points that had no backend behind them.

• Requires: Go 1.25+, goravel/framework v1.17.x
• Upgrade: go get github.com/wcz0/goravel-admin@v1.17.1, then re-run go run . artisan admin:init to backfill the
  permission/menu links (the command is idempotent, so it is safe on an existing database).

Security

• Anonymous access to the user list. config/admin.go listed system/admin_users in both auth.except and
  permission.except, so GET /admin-api/system/admin_users returned every account without a token. Both allow-lists
  are now empty; unauthenticated requests get 401.
• Non-super-admins received 403 on every endpoint. AdminUser.AllPermissions() tried to fill []AdminPermission
  from the AdminRoles relation, which can never match, so it always returned nil. It now aggregates permissions
  across all roles and de-duplicates by permission id.

Fixed

• Permission wildcards never matched. The pattern was stripped of its leading slash before matching, while
  ctx.Request().Path() is /admin-api/.... Matching now goes through tools.MatchPath, which normalises both sides.
• Blank sidebar for regular admins. The seeded permissions pointed at paths this package does not serve
  (/auth/roles and friends), and admin_permission_menu had no rows at all. Seeds now use the real routes and create
  the permission-to-menu links; admin:init backfills them.
• Every list filter was silently ignored. Goravel's Where/WhereIn/Order return a new Query; 13 call sites
  dropped the return value, so search boxes returned the full table and the id != ? uniqueness check never applied.
  All sites assign the result, and OR groups use WhereAny.
• admin:init was not idempotent. A raw INSERT and a Create each inserted the same user-role row, and the
  permission/menu/relationship steps duplicated on every run. Everything is FirstOrCreate now; three consecutive runs
  keep the data constant (role_users=1 / perms=8 / menus=7 / role_perms=12 / perm_menus=18).
• User list had no pagination. The response carried only items, so amis could not render a pager, and roles were
  queried per row. The list now returns total / page / perPage (capped at 500) and preloads AdminRoles.
• Upgrading kept stale permission paths. admin:init used FirstOrCreate for the eight built-in permissions, so an
  existing database kept the old http_path values (/auth/roles and friends) and non-super-admins stayed blocked.
  It now compares and updates name and http_path for those slugs when they differ. Verified by resetting one row to
  ["/auth/users"] and re-running the command: the row came back with the real route.

Removed

• "Get PHP Code" button and the /dev_tools/editor page. Both called POST /dev_tools/editor_parse, which was never
  implemented — Go has no equivalent of owl-admin's amis()->Xxx() codegen — so the call returned an empty 200. The
  amis schema editor (custom-amis-editor) is unchanged and still edits admin_pages schemas.
• The code generator leftovers. admin_code_generators was a table with no model, controller or route behind it,
  plus a dead /dev_tools/code_generator menu entry and ~100 lines of unused copy in both language packs. The migration,
  the admin:doctor table check and the menu entry are gone; the migration count drops from 13 to 12. Existing
  databases can DROP TABLE admin_code_generators and delete its row from the migrations table.
• core.Menu.Extra() and devToolMenus(). Both were dead code: nothing ever called Extra(), and the routes it
  built pointed at frontend pages that do not exist (user_setting, /dev_tools/editor, /dev_tools/code_generator).
  Dev-tools pages are reached through menu records like any other admin page.
• The "Differences from owl-admin" table in the README. Runtime extension install, the PHP code generator and
  multi-module sub-admins are out of scope for this package rather than gaps; the README states the scope in one
  paragraph. dev_tools/extensions still stores the extension registry and enable/disable state.

Verification

• go build ./..., go vet ./... and go test ./... pass on this branch; example/ compiles.
• example/smoke_admin.py passes 20/20 contract checks against a live instance and can be re-run on the same database
  (each run uses a fresh unique suffix).
• Live checks: anonymous → 401; a non-super-admin sees the dashboard and system menus, gets 200 on
  system/admin_users and system/admin_roles, and 403 on system/admin_menus and system/permissions.
• The embedded frontend build contains no editor_parse reference.

Compatibility

• No API additions or signature changes; existing hosts only need go get plus admin:init.
• This is the Goravel 1.17 line (goravel/framework v1.17.3). Goravel 1.18 users should use v1.18.1 from main.

v1.17.0

v1.17.0

First release of goravel-admin as an installable Goravel package on the v1.17 support line, and the first release that
reaches feature parity with owl-admin v4.7.5 on the backend contract.

• Requires: Go 1.25+, goravel/framework v1.17.x (the example app pins gin v1.17.1, redis v1.17.1,
  sqlite v1.17.0)
• Frontend: owl-admin v4.7.5 build (amis 6.13.0) — no frontend changes needed
• Database: SQLite, MySQL, PostgreSQL or SQL Server

Highlights

• Installable package. go run github.com/wcz0/goravel-admin/setup install registers the service provider and
  writes an optional config/admin.go skeleton. Migrations mount themselves during Boot; the installer no longer
  touches bootstrap/migrations.go.
• Captcha on login. GET /captcha issues a data-URI image and a single-use session id; enable it with
  ADMIN_LOGIN_CAPTCHA=true.
• Custom amis pages. Page schemas are stored in admin_pages and served through GET /page_schema?sign=; menus of
  type url_type=4 render them.
• Chunked upload. upload_chunk_start / upload_chunk / upload_chunk_finish with md5 verification per part, a
  target directory allow-list and script extensions rejected.
• xlsx export. List pages get "export all / this page / selected" actions; downloads go through an HMAC-signed,
  expiring _download_export URL with path traversal protection.
• Dev tools. Pages, dynamic APIs (10 built-in templates), relationships (9 types with preview_code) and an
  extension registry, enabled with ADMIN_SHOW_DEVELOPMENT_TOOLS=true.
• Icon search. GET /_iconify_search serves 220k iconify names embedded in the binary.
• Console commands. admin:create-user, admin:reset-password and admin:doctor.
• English docs. README.md (English) and README.zh-CN.md (Chinese); this changelog is English only.

Breaking changes

The repository is no longer a skeleton application. If you forked or copied app/** from an earlier commit:

• controllers, middleware, models, migrations, commands and routes now live at the package root with imports under
  github.com/wcz0/goravel-admin/...
• the host main.go, bootstrap/ and config/ skeletons moved to example/
• default configuration is provided by config.New() and merged into host configuration (host wins) during
  ServiceProvider.Register
• routes, assets and the embedded entry page are registered in ServiceProvider.Boot; prefixes remain /admin,
  /admin-assets and /admin-api
• goravel-authz is gone; permissions are handled by the built-in RBAC and the permission column value was renamed
  to slug

Upgrade guide

go get github.com/wcz0/goravel-admin@v1.17.0
go run github.com/wcz0/goravel-admin/setup install
go run . artisan migrate
go run . artisan admin:doctor

admin:doctor verifies APP_KEY, database connectivity, the 13 core tables, admin accounts, home menu uniqueness and
broken menu parents. If you upgraded from a version that used goravel-authz, drop the casbin_rules table and the
admin_rule model — both are no longer used.

Compatibility

• This line targets goravel/framework v1.17.x. Compared with main (v1.18) the differences are confined to the
  framework contract: middleware is a func(ctx http.Context) closure because http.Middleware is a function type in
  1.17, and validation rules use map[string]string instead of map[string]any.
• admin.auth.guard defaults to admin and is now used for both token issuing and middleware verification. If you
  customised config/auth.go, keep this key in sync.
• Goravel 1.16 is not supported: it lacks foundation.Setup(), packages.Setup.Paths() and
  modify.RegisterProvider.
• owl-admin capabilities with no Go equivalent (runtime extension install, PHP code generator, amis DSL editor,
  multi-module) are documented in the README under "Differences from owl-admin".

Verification

• go build ./..., go vet ./..., go test ./... pass; example/ compiles against goravel/framework v1.17.3.
• example/smoke_admin.py passes 17/17 contract checks against a live instance on this branch: login, _settings,
  captcha, iconify search, page create + page_schema + duplicate sign, rejected ghost ids, dynamic API duplicate
  path, relationship types and preview, extension registry with id=0 rejection, chunked upload, export download plus
  tampered-signature rejection, profile update, menus, and the schema of the four built-in list pages.

v1.0.0

Full Changelog: v0.0.2...v1.0.0

v0.0.1: 勉强可用版本, 权限管理未完成

Full Changelog: v0.0.1...v0.0.1