From 14978385ddca7279b1d5e110aba0de9d58991322 Mon Sep 17 00:00:00 2001
From: Roman Malenko <romamalenko241@gmail.com>
Date: Wed, 9 Sep 2026 17:27:07 +0300
Subject: [PATCH] fix: refuse columns hidden from the create page and project
 the response

---
 index.ts     | 34 ++++++++++++++++++----------------
 package.json |  4 ++--
 2 files changed, 20 insertions(+), 18 deletions(-)

diff --git a/index.ts b/index.ts
index 867c278..0da4400 100644
--- a/index.ts
+++ b/index.ts
@@ -1,4 +1,4 @@
-import { ActionCheckSource, AdminForthPlugin, interpretResource } from "adminforth";
+import { ActionCheckSource, AdminForthPlugin, interpretResource, recordWriteError, stripBackendOnly } from "adminforth";
 import type { IAdminForth, IHttpServer, AdminForthResourcePages, AdminForthResourceColumn, AdminForthDataTypes, AdminForthResource } from "adminforth";
 import type { PluginOptions } from './types.js';
 import { z } from "zod";
@@ -96,12 +96,17 @@ export default class InlineCreatePlugin extends AdminForthPlugin {
           return { error: 'User does not have permission to create records for this resource' };
         }
 
-        for (const column of resource.columns) {
-          if (column.backendOnly) {
-            if (record[column.name] !== undefined) {
-              return { error: `Column "${column.name}" is backend-only and cannot be set by the user` };
-            }
-          };
+        const ctx = {
+          adminUser,
+          resource,
+          meta: { requestBody: body },
+          source: ActionCheckSource.CreateRequest,
+          adminforth: this.adminforth,
+        };
+
+        const writeError = await recordWriteError(record, 'create', ctx);
+        if (writeError) {
+          return { error: writeError };
         }
 
         const cleanRecord = resource.columns.reduce((acc, field) => {
@@ -121,15 +126,12 @@ export default class InlineCreatePlugin extends AdminForthPlugin {
           return { error: result.error };
         }
 
-        const createdRecord = result.createdRecord;
-
-        //filter createdRecord to only include columns that are not backendOnly
-        const safe = {};
-        for (const col of resource.columns) {
-          if (col.backendOnly) continue;
-          if (col.showIn?.list === false && col.showIn?.show === false) continue;
-          safe[col.name] = result.createdRecord[col.name];
-        }
+        const pkColumn = resource.columns.find((col) => col.primaryKey);
+        const safe = await stripBackendOnly(result.createdRecord, {
+          ...ctx,
+          meta: { requestBody: body, pk: result.createdRecord[pkColumn.name] },
+          source: ActionCheckSource.ListRequest,
+        });
         return { record: safe };
       }
     });
diff --git a/package.json b/package.json
index 42e3094..defb916 100644
--- a/package.json
+++ b/package.json
@@ -23,14 +23,14 @@
   "license": "MIT",
   "description": "Inline create plugin for adminforth",
   "peerDependencies": {
-    "adminforth": "^3.8.2"
+    "adminforth": "^3.18.0"
   },
   "dependencies": {
     "zod": "^4.3.6"
   },
   "devDependencies": {
     "@types/node": "^22.10.7",
-    "adminforth": "^3.8.2",
+    "adminforth": "^3.18.0",
     "semantic-release": "^24.2.1",
     "semantic-release-slack-bot": "^4.0.2",
     "typescript": "^5.7.3"