dev-demo: setup crud-approve plugin on dev-demo

AdminForth/1897/show-view-column-nama-renderer

Author: yaroslav8765

dev-demo/Taskfile.yaml

@@ -36,6 +36,7 @@ vars:
     - "adminforth-dashboard"
     - "adminforth-json-editor"
     - "adminforth-json-form"
+    - "af-crud-approve-plugin" 
 
   ADAPTERS:
     - "adminforth-email-adapter-aws-ses"

dev-demo/index.ts

@@ -33,6 +33,7 @@ import carsDescriptionImage from './resources/cars_description_image.js';
 import translations from "./resources/translations.js";
 import adminExternalIdentitiesResource from './resources/adminUserExternalIdentities.js';
 import key_value_resource from './resources/key_value_resource.js';
+import crudManualApproveResource from './resources/crud_manual_approve.js';
 
 import { logger } from '../adminforth/modules/logger.js';
 
@@ -163,6 +164,7 @@ export const admin = new AdminForth({
     dashboardConfigsResource,
     adminExternalIdentitiesResource,
     key_value_resource,
+    crudManualApproveResource,
   ],
   menu: [
     { type: 'heading', label: 'SYSTEM' },
@@ -261,6 +263,11 @@ export const admin = new AdminForth({
       label: 'Key-Value Store',
       icon: 'material-symbols:key',
       resourceId: 'key_values',
+    },
+    {
+      label: 'Approvals',
+      icon: 'flowbite:clipboard-check-solid',
+      resourceId: 'crud_manual_approve',
     }
   ],
   globalPlugins: globalPlugins,

dev-demo/migrations/prisma/sqlite/migrations/20260810140436_add_crud_manual_approve/migration.sql

@@ -0,0 +1,19 @@
+-- CreateTable
+CREATE TABLE "crud_manual_approve" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "record_id" TEXT,
+    "resource_id" TEXT NOT NULL,
+    "action" TEXT NOT NULL,
+    "data" JSONB NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "responser_id" TEXT,
+    "status" INTEGER NOT NULL DEFAULT 1,
+    "created_at" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "extra" JSONB
+);
+
+-- CreateIndex
+CREATE INDEX "crud_manual_approve_status_created_at_idx" ON "crud_manual_approve"("status", "created_at");
+
+-- CreateIndex
+CREATE INDEX "crud_manual_approve_resource_id_idx" ON "crud_manual_approve"("resource_id");

dev-demo/migrations/prisma/sqlite/schema.prisma

@@ -203,4 +203,20 @@ model key_values {
   value       String
   collection  String?
   expire_at   DateTime?
-}
+}
+
+model crud_manual_approve {
+  id           String   @id
+  record_id    String?
+  resource_id  String
+  action       String
+  data         Json
+  user_id      String
+  responser_id String?
+  status       Int      @default(1)
+  created_at   DateTime @default(now())
+  extra        Json?
+
+  @@index([status, created_at])
+  @@index([resource_id])
+}

dev-demo/resources/adminuser.ts

@@ -11,11 +11,49 @@ import OAuthPlugin from './configs/oauthPluginConfig.js';
 import TwoFactorsAuthPlugin from './configs/twoFactorAuthPluginConfig.js';
 import EmailInvitePlugin from '../../plugins/adminforth-email-invite/index.js';
 import EmailPasswordResetPlugin from '../../plugins/adminforth-email-password-reset/index.js';
+import { crudApprovePlugin } from './crud_manual_approve.js';
 
 async function allowedForSuperAdmin({ adminUser }: { adminUser: AdminUser }): Promise<boolean> {
   return adminUser.dbUser.role === 'superadmin';
 }
 
+/**
+ * Sends the mutation to the CRUD approve queue instead of applying it right away.
+ * Returns `{ ok: true }` when the change must proceed normally: either the plugin
+ * itself is re-applying an already approved change, or the request was queued and
+ * the caller should stop.
+ */
+async function sendChangeToApproval({
+  resource, action, record, updates, oldRecord, recordId, adminUser, extra,
+}: any) {
+  // when the plugin applies an approved change it marks the call with this flag,
+  // otherwise we would queue the very same change again, forever
+  if (extra?.adminforth_plugin_crud_approve?.callingFromApprovalPlugin) {
+    return { ok: true };
+  }
+
+  const pkColumnName = resource.columns.find((c: AdminForthResourceColumn) => c.primaryKey)?.name || 'id';
+  const data = recordId ? { [pkColumnName]: recordId } : record;
+
+  const result = await crudApprovePlugin.createApprovalRequest({
+    resource,
+    action,
+    data,
+    user: adminUser,
+    record,
+    oldRecord,
+    updates,
+    extra,
+  });
+  console.log('sendChangeToApproval result', result);
+  if (result.error) {
+    return { ok: false, error: result.error };
+  }
+
+  // stop the original mutation, it will be executed only if a reviewer approves it
+  return { ok: true, error: 'Action sent for manual approval', redirectTo: '/adminuser' };
+}
+
 const fakeEmailAdapter = {
   validate: async () => {
     // Implement validation logic if needed
@@ -197,27 +235,46 @@ export default {
       userResetTokensKeyValueAdapter: new KeyValueAdapterRam(),
       expectedOrigin: process.env.RESET_PASSWORD_ORIGIN || 'http://localhost:3123',
     }),
-  ],
+    // each plugin repo installs its own copy of adminforth (and of @types/express
+    // through it), so their IAdminForthPlugin is a different type identity than the
+    // one of the core we import from source here. Cast only the plugins array, so
+    // the rest of the resource is still checked against AdminForthResourceInput
+  ] as any,
   hooks: {
     create: {
-      beforeSave: async ({ record, adminUser, resource }: { record: any, adminUser: AdminUser, resource: AdminForthResource }) => {
+      beforeSave: async (args: any) => {
+        const approval = await sendChangeToApproval({ ...args, action: 'create' });
+        if (approval.error) {
+          return approval;
+        }
+        const { record }: { record: any } = args;
         if (record.password) {
           record.password_hash = await AdminForth.Utils.generatePasswordHash(record.password);
         }
         return { ok: true };
       }
     },
     edit: {
-      beforeSave: async ({ oldRecord, updates, adminUser, resource }: { oldRecord: any, updates: any, adminUser: AdminUser, resource: AdminForthResource }) => {
+      beforeSave: async (args: any) => {
+        const { oldRecord, updates, adminUser }: { oldRecord: any, updates: any, adminUser: AdminUser } = args;
         logger.info('Updating user', updates);
         if (oldRecord.id === adminUser.dbUser.id && updates.role) {
           return { ok: false, error: 'You cannot change your own role' };
         }
+        const approval = await sendChangeToApproval({ ...args, action: 'edit' });
+        if (approval.error) {
+          return approval;
+        }
         if (updates.password) {
           updates.password_hash = await AdminForth.Utils.generatePasswordHash(updates.password);
         }
         return { ok: true }
       },
     },
+    delete: {
+      beforeSave: async (args: any) => {
+        return sendChangeToApproval({ ...args, action: 'delete' });
+      },
+    },
   },
 } as AdminForthResourceInput;

dev-demo/resources/crud_manual_approve.ts

@@ -0,0 +1,118 @@
+import CRUDApprovePlugin from '../../plugins/af-crud-approve-plugin/index.js';
+import { AdminForthDataTypes } from '../../adminforth/index.js';
+import type { AdminForthResourceInput, AdminUser } from '../../adminforth/index.js';
+
+async function allowedForSuperAdmin({ adminUser }: { adminUser: AdminUser }): Promise<boolean> {
+  return adminUser.dbUser.role === 'superadmin';
+}
+
+export const crudApprovePlugin = new CRUDApprovePlugin({
+  resourceColumns: {
+    idColumnName: 'id',
+    recordIdColumnName: 'record_id',
+    resourceIdColumnName: 'resource_id',
+    actionColumnName: 'action',
+    dataColumnName: 'data',
+    userIdColumnName: 'user_id',
+    responserIdColumnName: 'responser_id',
+    statusColumnName: 'status',
+    createdAtColumnName: 'created_at',
+    extraColumnName: 'extra',
+  },
+  // dev-demo is usually used with a single superadmin login, so allow the author
+  // of the request to approve it himself. Never do this in production: it makes
+  // the four-eyes principle void.
+  allowSelfApproval: true,
+});
+
+export default {
+  dataSource: 'sqlite',
+  table: 'crud_manual_approve',
+  resourceId: 'crud_manual_approve',
+  label: 'CRUD approvals',
+  recordLabel: (r: any) => `${r.resource_id} / ${r.action}`,
+  columns: [
+    {
+      name: 'id',
+      primaryKey: true,
+      showIn: { list: false, show: true, edit: false, create: false },
+    },
+    {
+      name: 'record_id',
+      label: 'Record ID',
+      showIn: { all: true, edit: false, create: false },
+    },
+    {
+      name: 'resource_id',
+      label: 'Resource',
+      showIn: { all: true, edit: false, create: false },
+    },
+    {
+      name: 'action',
+      enum: [
+        { value: 'create', label: 'Create' },
+        { value: 'edit', label: 'Edit' },
+        { value: 'delete', label: 'Delete' },
+      ],
+      showIn: { all: true, edit: false, create: false },
+    },
+    {
+      name: 'data',
+      type: AdminForthDataTypes.JSON,
+      sortable: false,
+      showIn: { all: true, edit: false, create: false },
+    },
+    {
+      name: 'user_id',
+      label: 'Requested by',
+      foreignResource: {
+        resourceId: 'adminuser',
+      },
+      showIn: { all: true, edit: false, create: false },
+    },
+    {
+      name: 'responser_id',
+      label: 'Responded by',
+      foreignResource: {
+        resourceId: 'adminuser',
+      },
+      showIn: { all: true, edit: false, create: false },
+    },
+    {
+      name: 'status',
+      enum: [
+        { value: 1, label: 'Pending' },
+        { value: 2, label: 'Approved' },
+        { value: 3, label: 'Rejected' },
+      ],
+      showIn: { all: true, edit: false, create: false },
+    },
+    {
+      name: 'created_at',
+      type: AdminForthDataTypes.DATETIME,
+      allowMinMaxQuery: true,
+      showIn: { all: true, edit: false, create: false },
+    },
+    {
+      name: 'extra',
+      type: AdminForthDataTypes.JSON,
+      showIn: { all: false },
+      backendOnly: true,
+    },
+  ],
+  options: {
+    listPageSize: 10,
+    allowedActions: {
+      create: false,
+      edit: false,
+      delete: false,
+      // this is not only a UI matter: the plugin resolves `show` on every
+      // approve/reject request, so it is the actual approval permission
+      show: allowedForSuperAdmin,
+      filter: allowedForSuperAdmin,
+    },
+  },
+  // cast for the same reason as in adminuser.ts: the plugin repo has its own
+  // adminforth copy, so its IAdminForthPlugin is a different type identity
+  plugins: [crudApprovePlugin] as any,
+} as AdminForthResourceInput;