Skip to content

fix: resolve function-valued backendOnly and project the record it re… #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Romsik788 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix: resolve function-valued backendOnly and project the record it re… #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
083537f
fix: resolve function-valued backendOnly and project the record it re…
Romsik788 Sep 9, 2026
b1cec8f
fix: stop adding _label to the in-place edit response
Romsik788 Sep 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 13 additions & 8 deletions index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
import { AdminForthPlugin, interpretResource, ActionCheckSource, AllowedActionsEnum } from "adminforth";
import { AdminForthPlugin, interpretResource, ActionCheckSource, AllowedActionsEnum, recordWriteError, stripBackendOnly } from "adminforth";
import type { IAdminForth, IHttpServer, AdminForthResourcePages, AdminForthResourceColumn, AdminForthDataTypes, AdminForthResource } from "adminforth";
import type { PluginOptions } from './types.js';
import { z } from "zod";
Expand Down Expand Up @@ -82,12 +82,6 @@ export default class ListInPlaceEditPlugin extends AdminForthPlugin {
if (column.primaryKey) {
return { error: 'Primary key field cannot be edited' };
}
if (column.backendOnly === true) {
return { error: 'Field is not editable, because it is marked as backendOnly' };
}
if (column.editReadonly === true) {
return { error: 'Field is not editable, because it is marked as editReadonly' };
}
// Create update object with just the single field
const updateRecord = { [field]: value };

Expand All @@ -98,12 +92,15 @@ export default class ListInPlaceEditPlugin extends AdminForthPlugin {
return { error: 'Record not found' };
}

const editMeta = { requestBody: body, newRecord: updateRecord, oldRecord, pk: recordId };
const editCtx = { adminUser, resource, meta: editMeta, source: ActionCheckSource.EditRequest, adminforth: this.adminforth };

// Enforce the resource's edit permission for this specific record
// (mirrors the core /update_record access check, since updateResourceRecord does not check ACL).
const { allowedActions } = await interpretResource(
adminUser,
resource,
{ requestBody: body, newRecord: updateRecord, oldRecord, pk: recordId },
editMeta,
ActionCheckSource.EditRequest,
this.adminforth
);
Expand All @@ -112,6 +109,11 @@ export default class ListInPlaceEditPlugin extends AdminForthPlugin {
return { error: typeof editAllowed === 'string' ? editAllowed : 'You do not have permission to edit this record' };
}

const writeError = await recordWriteError(updateRecord, 'edit', editCtx);
if (writeError) {
return { error: writeError };
}

const result = await this.adminforth.updateResourceRecord({
resource,
recordId,
Expand All @@ -125,6 +127,9 @@ export default class ListInPlaceEditPlugin extends AdminForthPlugin {
}

const updatedRecord = await connector.getRecordByPrimaryKey(resource, recordId as string);
if (updatedRecord) {
await stripBackendOnly(updatedRecord, { ...editCtx, meta: { requestBody: body, pk: recordId }, source: ActionCheckSource.EditLoadRequest });

@ivictbor ivictbor Sep 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Romsik788 I see that logic here changes from validation at start of update, to a setting bcakendOnly after hooks executed? But Why? Setting backendOnly field in hook is fine and always was core concept. Please test this plugin on inplace edit for password field for example - I feel liek it will not set password hash because this will totally strip it

@Romsik788 Romsik788 Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The main idea it's moving some checks to one side (adminforth core). Because it has a lot of the same code in different plugins and we need to maintain it (instead of maintaining one place).

I feel liek it will not set password hash because this will totally strip it

Please look 112 line.

devforth/adminforth#717

@Romsik788 Romsik788 Sep 10, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/devforth/adminforth-list-in-place-edit/blob/main/index.ts#L85
Here's good example in this plugin. Now it has a bug with checking of backendOnly. Because backendOnly can be function.

@ivictbor ivictbor Sep 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

image

Here is what I see

@Romsik788 Romsik788 Sep 10, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

112 line in this file (https://github.com/devforth/adminforth-list-in-place-edit/pull/2/changes/BASE..083537ff4bbebe28c89443c02fd1a0d6d973bce3#diff-dcdc3e0b3362edb8fec2a51d3fa51f8fb8af8f70247e06d9887fa934834c9122R112)

devforth/adminforth#717 - in this PR you find an implementation of these helpers functions.

}
return { record: updatedRecord };
}
});
Expand Down
4 changes: 2 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
"description": "AdminForth List In Place Edit Plugin",
"devDependencies": {
"@types/node": "^22.10.7",
"adminforth": "^3.8.2",
"adminforth": "^3.18.0",
"semantic-release": "^24.2.1",
"semantic-release-slack-bot": "^4.0.2",
"typescript": "^5.7.3"
Expand All @@ -33,7 +33,7 @@
"zod": "^4.3.6"
},
"peerDependencies": {
"adminforth": "^3.8.2"
"adminforth": "^3.18.0"
},
"release": {
"plugins": [
Expand Down