@balena/pinejs 15.0.0-true-boolean-7896b116c446d891d7a0d5e4085c02a13bc9c725 → 15.0.1-build-migrations-clarify-marking-sbvr-optional-d6d0ded8eccc6eadb2492f4697918cf0afd00215-1

package/out/sbvr-api/permissions.js

@@ -42,7 +42,7 @@ const methodPermissions = {
     MERGE: 'update',
     DELETE: 'delete',
 };
-const $parsePermissions = memoize((filter) => {
+const $parsePermissions = env.createCache('parsePermissions', (filter) => {
     const { tree, binds } = ODataParser.parse(filter, {
         startRule: 'ProcessRule',
         rule: 'FilterByExpression',
@@ -53,9 +53,8 @@ const $parsePermissions = memoize((filter) => {
     };
 }, {
     primitive: true,
-    max: env.cache.parsePermissions.max,
 });
-const rewriteBinds = ({ tree, extraBinds }, odataBinds) => {
+const rewriteODataBinds = ({ tree, extraBinds }, odataBinds) => {
     const bindsLength = odataBinds.length;
     odataBinds.push(...extraBinds);
     return _.cloneDeepWith(tree, (value) => {
@@ -69,9 +68,9 @@ const rewriteBinds = ({ tree, extraBinds }, odataBinds) => {
 };
 const parsePermissions = (filter, odataBinds) => {
     const odata = $parsePermissions(filter);
-    return rewriteBinds(odata, odataBinds);
+    return rewriteODataBinds(odata, odataBinds);
 };
-const isAnd = (x) => _.isObject(x) && 'and' in x;
+const isAnd = (x) => typeof x === 'object' && 'and' in x;
 const isOr = (x) => typeof x === 'object' && 'or' in x;
 function nestedCheck(check, stringCallback) {
     if (typeof check === 'string') {
@@ -183,7 +182,10 @@ const namespaceRelationships = (relationships, alias) => {
         namespaceRelationships(relationship, alias);
     });
 };
-const getPermissionsLookup = memoize((permissions) => {
+const getPermissionsLookup = env.createCache('permissionsLookup', (permissions, guestPermissions) => {
+    if (guestPermissions != null) {
+        permissions = [...guestPermissions, ...permissions];
+    }
     const permissionsLookup = {};
     for (const permission of permissions) {
         const [target, condition] = permission.split('?');
@@ -191,16 +193,19 @@ const getPermissionsLookup = memoize((permissions) => {
             permissionsLookup[target] = true;
         }
         else if (permissionsLookup[target] !== true) {
-            if (permissionsLookup[target] == null) {
-                permissionsLookup[target] = [];
-            }
+            permissionsLookup[target] ??= [];
             permissionsLookup[target].push(condition);
         }
     }
+    for (const target of Object.keys(permissionsLookup)) {
+        const conditions = permissionsLookup[target];
+        if (conditions !== true) {
+            permissionsLookup[target] = _.uniq(conditions);
+        }
+    }
     return permissionsLookup;
 }, {
-    primitive: true,
-    max: env.cache.permissionsLookup.max,
+    normalizer: ([permissions, guestPermissions]) => `${permissions}${guestPermissions == null}`,
 });
 const $checkPermissions = (permissionsLookup, actionList, vocabulary, resourceName) => {
     const checkObject = {
@@ -245,9 +250,9 @@ const convertToLambda = (filter, identifier) => {
             return;
         }
         if (Array.isArray(object)) {
-            object.forEach((element) => {
+            for (const element of object) {
                 replaceObject(element);
-            });
+            }
         }
         if (object.hasOwnProperty('name')) {
             object.property = { ...object };
@@ -265,7 +270,7 @@ const rewriteSubPermissionBindings = (filter, counter) => {
         if (typeof object.bind === 'number') {
             object.bind = counter + object.bind;
         }
-        if (Array.isArray(object) || _.isObject(object)) {
+        if (Array.isArray(object) || typeof object === 'object') {
             _.forEach(object, (v) => {
                 rewrite(v);
             });
@@ -279,7 +284,7 @@ const buildODataPermission = (permissionsLookup, actionList, vocabulary, resourc
         throw constrainedPermissionError;
     }
     if (conditionalPerms === true) {
-        return false;
+        return;
     }
     const permissionFilters = nestedCheck(conditionalPerms, (permissionCheck) => {
         try {
@@ -300,32 +305,66 @@ const generateConstrainedAbstractSql = (permissionsLookup, actionList, vocabular
     const abstractSQLModel = sbvrUtils.getAbstractSqlModel({
         vocabulary,
     });
-    const odata = uri_parser_1.memoizedParseOdata(`/${resourceName}`);
+    const odata = (0, uri_parser_1.memoizedParseOdata)(`/${resourceName}`);
     const collapsedPermissionFilters = buildODataPermission(permissionsLookup, actionList, vocabulary, resourceName, odata);
+    if (collapsePermissionFilters == null) {
+        return;
+    }
     _.set(odata, ['tree', 'options', '$filter'], collapsedPermissionFilters);
     const lambdaAlias = randomstring.generate(20);
     let inc = 0;
     const canAccessTrace = [resourceName];
+    const resolveBind = (maybeBind, extraBinds) => {
+        if ((0, odata_to_abstract_sql_1.isBindReference)(maybeBind)) {
+            const { bind } = maybeBind;
+            if (typeof bind === 'string' || bind < odata.binds.length) {
+                return odata.binds[bind];
+            }
+            return extraBinds[bind - odata.binds.length];
+        }
+        return maybeBind;
+    };
     const canAccessFunction = function (property) {
-        delete property.method;
+        const { method, ...resolvedProperty } = property;
         if (!this.defaultResource) {
             throw new Error(`No resource selected in AST.`);
         }
-        const targetResource = this.NavigateResources(this.defaultResource, property.name);
-        const targetResourceName = odata_to_abstract_sql_1.sqlNameToODataName(targetResource.resource.name);
-        if (canAccessTrace.includes(targetResourceName)) {
-            throw new errors_1.PermissionError(`Permissions for ${resourceName} form a circle by the following path: ${canAccessTrace.join(' -> ')} -> ${targetResourceName}`);
+        const targetResource = this.NavigateResources(this.defaultResource, resolvedProperty.name);
+        const lambdaId = `${lambdaAlias}+${inc}`;
+        inc = inc + 1;
+        const targetResourceName = (0, odata_to_abstract_sql_1.sqlNameToODataName)(targetResource.resource.name);
+        const traceIndex = canAccessTrace.findIndex((rName) => rName === targetResourceName);
+        if (traceIndex !== -1) {
+            if (canAccessTrace[canAccessTrace.length - 1] !== targetResourceName) {
+                throw new Error(`Indirectly circular 'canAccess()' permissions are not supported, currently permissions for ${resourceName} form an indirect circle by the following path: ${canAccessTrace.join(' -> ')} -> ${targetResourceName}`);
+            }
+            const { args } = method[1];
+            const depthArg = resolveBind(args[0], this.extraBindVars);
+            if (depthArg == null) {
+                throw new Error(`You must specify a depth if you want to enable directly circular 'canAccess()' permissions, currently permissions for ${resourceName} form a direct circle by the following path: ${canAccessTrace.join(' -> ')} -> ${targetResourceName}`);
+            }
+            const [type, depth] = depthArg;
+            if (type !== 'Real' || !Number.isInteger(depth) || depth < 1) {
+                throw new Error('The depth for `canAccess` must be an integer >= 1');
+            }
+            if (canAccessTrace.length > depth &&
+                canAccessTrace[canAccessTrace.length - depth] === targetResourceName) {
+                resolvedProperty.lambda = {
+                    method: 'any',
+                    identifier: lambdaId,
+                    expression: ['eq', true, false],
+                };
+                return this.Property(resolvedProperty);
+            }
         }
-        const parentOdata = uri_parser_1.memoizedParseOdata(`/${targetResourceName}`);
+        const parentOdata = (0, uri_parser_1.memoizedParseOdata)(`/${targetResourceName}`);
         const collapsedParentPermissionFilters = buildODataPermission(permissionsLookup, actionList, vocabulary, targetResourceName, parentOdata);
-        if (collapsedParentPermissionFilters === false) {
-            throw constrainedPermissionError;
+        if (collapsedParentPermissionFilters == null) {
+            return ['Equals', ['Boolean', true], ['Boolean', true]];
         }
-        const lambdaId = `${lambdaAlias}+${inc}`;
-        inc = inc + 1;
         rewriteSubPermissionBindings(collapsedParentPermissionFilters, this.bindVarsLength + this.extraBindVars.length);
         convertToLambda(collapsedParentPermissionFilters, lambdaId);
-        property.lambda = {
+        resolvedProperty.lambda = {
             method: 'any',
             identifier: lambdaId,
             expression: collapsedParentPermissionFilters,
@@ -333,41 +372,32 @@ const generateConstrainedAbstractSql = (permissionsLookup, actionList, vocabular
         this.extraBindVars.push(...parentOdata.binds);
         canAccessTrace.push(targetResourceName);
         try {
-            return this.Property(property);
+            return this.Property(resolvedProperty);
         }
         finally {
             canAccessTrace.pop();
         }
     };
-    const { tree, extraBindVars } = uri_parser_1.memoizedGetOData2AbstractSQL(abstractSQLModel).match(odata.tree, 'GET', [], odata.binds.length, {
+    const { tree, extraBindVars } = (0, uri_parser_1.memoizedGetOData2AbstractSQL)(abstractSQLModel).match(odata.tree, 'GET', [], odata.binds.length, {
         canAccess: canAccessFunction,
     });
     odata.binds.push(...extraBindVars);
     const odataBinds = odata.binds;
     const abstractSqlQuery = [...tree];
-    const selectIndex = abstractSqlQuery.findIndex((v) => v[0] === 'Select');
-    const select = (abstractSqlQuery[selectIndex] = [
-        ...abstractSqlQuery[selectIndex],
-    ]);
+    const select = abstractSqlQuery.find((v) => v[0] === 'Select');
     select[1] = select[1].map((selectField) => {
         if (selectField[0] === 'Alias') {
+            const sqlName = (0, odata_to_abstract_sql_1.odataNameToSqlName)(selectField[2]);
             const maybeField = selectField[1];
-            const fieldType = maybeField[0];
-            if (fieldType === 'ReferencedField' || fieldType === 'Field') {
+            if ((maybeField[0] === 'ReferencedField' && maybeField[2] === sqlName) ||
+                (maybeField[0] === 'Field' && maybeField[1] === sqlName)) {
                 return maybeField;
             }
-            return [
-                'Alias',
-                maybeField,
-                odata_to_abstract_sql_1.odataNameToSqlName(selectField[2]),
-            ];
-        }
-        if (selectField.length === 2 && Array.isArray(selectField[0])) {
-            return selectField[0];
+            return ['Alias', maybeField, sqlName];
         }
         return selectField;
     });
-    return { extraBinds: odataBinds, abstractSqlQuery };
+    return { binds: odataBinds, abstractSql: abstractSqlQuery };
 };
 const onceGetter = (obj, propName, fn) => {
     let nullableFn = fn;
@@ -396,14 +426,14 @@ const onceGetter = (obj, propName, fn) => {
 };
 const deepFreezeExceptDefinition = (obj) => {
     Object.freeze(obj);
-    Object.getOwnPropertyNames(obj).forEach((prop) => {
+    for (const prop of Object.getOwnPropertyNames(obj)) {
         if (prop !== 'definition' &&
             obj.hasOwnProperty(prop) &&
             obj[prop] !== null &&
             !['object', 'function'].includes(typeof obj[prop])) {
             deepFreezeExceptDefinition(obj);
         }
-    });
+    }
 };
 const createBypassDefinition = (definition) => _.cloneDeepWith(definition, (abstractSql) => {
     if (Array.isArray(abstractSql) &&
@@ -423,12 +453,11 @@ const getAlias = (name) => {
     return `permissions${permissionsJSON}`;
 };
 const rewriteRelationship = memoizeWeak((value, name, abstractSqlModel, permissionsLookup, vocabulary, odata2AbstractSQL) => {
-    let escapedName = odata_to_abstract_sql_1.sqlNameToODataName(name);
+    let escapedName = (0, odata_to_abstract_sql_1.sqlNameToODataName)(name);
     if (abstractSqlModel.tables[name]) {
-        escapedName = odata_to_abstract_sql_1.sqlNameToODataName(abstractSqlModel.tables[name].name);
+        escapedName = (0, odata_to_abstract_sql_1.sqlNameToODataName)(abstractSqlModel.tables[name].name);
     }
     const rewrite = (object) => {
-        var _a, _b;
         if ('$' in object && Array.isArray(object.$)) {
             const mapping = object.$;
             if (mapping.length === 2 &&
@@ -439,14 +468,18 @@ const rewriteRelationship = memoizeWeak((value, name, abstractSqlModel, permissi
                 if (possibleTargetResourceName.endsWith('$bypass')) {
                     return;
                 }
-                const targetResourceEscaped = odata_to_abstract_sql_1.sqlNameToODataName((_b = (_a = abstractSqlModel.tables[possibleTargetResourceName]) === null || _a === void 0 ? void 0 : _a.name) !== null && _b !== void 0 ? _b : possibleTargetResourceName);
+                const targetResourceEscaped = (0, odata_to_abstract_sql_1.sqlNameToODataName)(abstractSqlModel.tables[possibleTargetResourceName]?.name ??
+                    possibleTargetResourceName);
                 if (targetResourceEscaped.includes('$')) {
                     return;
                 }
                 let foundCanAccessLink = false;
                 try {
-                    const odata = uri_parser_1.memoizedParseOdata(`/${targetResourceEscaped}`);
+                    const odata = (0, uri_parser_1.memoizedParseOdata)(`/${targetResourceEscaped}`);
                     const collapsedPermissionFilters = buildODataPermission(permissionsLookup, methodPermissions.GET, vocabulary, targetResourceEscaped, odata);
+                    if (collapsedPermissionFilters == null) {
+                        return;
+                    }
                     _.set(odata, ['tree', 'options', '$filter'], collapsedPermissionFilters);
                     const canAccessFunction = function (property) {
                         delete property.method;
@@ -454,8 +487,8 @@ const rewriteRelationship = memoizeWeak((value, name, abstractSqlModel, permissi
                             throw new Error(`No resource selected in AST.`);
                         }
                         const targetResourceAST = this.NavigateResources(this.defaultResource, property.name);
-                        const targetResourceName = odata_to_abstract_sql_1.sqlNameToODataName(targetResourceAST.resource.name);
-                        const currentResourceName = odata_to_abstract_sql_1.sqlNameToODataName(this.defaultResource.name);
+                        const targetResourceName = (0, odata_to_abstract_sql_1.sqlNameToODataName)(targetResourceAST.resource.name);
+                        const currentResourceName = (0, odata_to_abstract_sql_1.sqlNameToODataName)(this.defaultResource.name);
                         if (currentResourceName === targetResourceEscaped &&
                             targetResourceName === escapedName) {
                             foundCanAccessLink = true;
@@ -485,7 +518,7 @@ const rewriteRelationship = memoizeWeak((value, name, abstractSqlModel, permissi
                 }
             }
         }
-        if (Array.isArray(object) || _.isObject(object)) {
+        if (Array.isArray(object) || typeof object === 'object') {
             _.forEach(object, (v) => {
                 if (typeof v !== 'string') {
                     rewrite(v);
@@ -499,7 +532,7 @@ const rewriteRelationships = (abstractSqlModel, relationships, permissionsLookup
     const originalAbstractSQLModel = sbvrUtils.getAbstractSqlModel({
         vocabulary,
     });
-    const odata2AbstractSQL = uri_parser_1.memoizedGetOData2AbstractSQL(originalAbstractSQLModel);
+    const odata2AbstractSQL = (0, uri_parser_1.memoizedGetOData2AbstractSQL)(originalAbstractSQLModel);
     const newRelationships = _.cloneDeep(relationships);
     _.forOwn(newRelationships, (value, name) => rewriteRelationship(value, name, abstractSqlModel, permissionsLookup, vocabulary, odata2AbstractSQL));
     return newRelationships;
@@ -507,9 +540,12 @@ const rewriteRelationships = (abstractSqlModel, relationships, permissionsLookup
 const stringifiedGetPermissions = JSON.stringify(methodPermissions.GET);
 const getBoundConstrainedMemoizer = memoizeWeak((abstractSqlModel) => memoizeWeak((permissionsLookup, vocabulary) => {
     const constrainedAbstractSqlModel = _.cloneDeep(abstractSqlModel);
-    const origSynonyms = Object.keys(constrainedAbstractSqlModel.synonyms);
+    const origSynonyms = Object.entries(constrainedAbstractSqlModel.synonyms);
     constrainedAbstractSqlModel.synonyms = new Proxy(constrainedAbstractSqlModel.synonyms, {
-        get: (synonyms, permissionSynonym) => {
+        get(synonyms, permissionSynonym, receiver) {
+            if (typeof permissionSynonym === 'symbol') {
+                return Reflect.get(synonyms, permissionSynonym, receiver);
+            }
             if (synonyms[permissionSynonym]) {
                 return synonyms[permissionSynonym];
             }
@@ -517,9 +553,9 @@ const getBoundConstrainedMemoizer = memoizeWeak((abstractSqlModel) => memoizeWea
             if (!alias) {
                 return;
             }
-            origSynonyms.forEach((canonicalForm, synonym) => {
+            for (const [synonym, canonicalForm] of origSynonyms) {
                 synonyms[`${synonym}$${alias}`] = `${canonicalForm}$${alias}`;
-            });
+            }
             return synonyms[permissionSynonym];
         },
     });
@@ -529,20 +565,25 @@ const getBoundConstrainedMemoizer = memoizeWeak((abstractSqlModel) => memoizeWea
         constrainedAbstractSqlModel.tables[bypassResourceName] = {
             ...table,
         };
-        constrainedAbstractSqlModel.tables[bypassResourceName].resourceName = bypassResourceName;
+        constrainedAbstractSqlModel.tables[bypassResourceName].resourceName =
+            bypassResourceName;
         if (table.definition) {
-            constrainedAbstractSqlModel.tables[bypassResourceName].definition = createBypassDefinition(table.definition);
+            constrainedAbstractSqlModel.tables[bypassResourceName].definition =
+                createBypassDefinition(table.definition);
         }
         else {
             onceGetter(table, 'definition', () => constrainedAbstractSqlModel.tables[`${resourceName}$permissions${stringifiedGetPermissions}`].definition);
         }
     });
     constrainedAbstractSqlModel.tables = new Proxy(constrainedAbstractSqlModel.tables, {
-        get: (tables, permissionResourceName) => {
+        get(tables, permissionResourceName, receiver) {
+            if (typeof permissionResourceName === 'symbol') {
+                return Reflect.get(tables, permissionResourceName, receiver);
+            }
             if (tables[permissionResourceName]) {
                 return tables[permissionResourceName];
             }
-            const [resourceName, permissionsJSON,] = permissionResourceName.split('$permissions');
+            const [resourceName, permissionsJSON] = permissionResourceName.split('$permissions');
             if (!permissionsJSON) {
                 return;
             }
@@ -552,13 +593,16 @@ const getBoundConstrainedMemoizer = memoizeWeak((abstractSqlModel) => memoizeWea
                 ...table,
             });
             permissionsTable.resourceName = permissionResourceName;
-            onceGetter(permissionsTable, 'definition', () => generateConstrainedAbstractSql(permissionsLookup, permissions, vocabulary, odata_to_abstract_sql_1.sqlNameToODataName(permissionsTable.name)));
+            onceGetter(permissionsTable, 'definition', () => generateConstrainedAbstractSql(permissionsLookup, permissions, vocabulary, (0, odata_to_abstract_sql_1.sqlNameToODataName)(permissionsTable.modifyName ?? permissionsTable.name)));
             return permissionsTable;
         },
     });
     constrainedAbstractSqlModel.relationships = rewriteRelationships(constrainedAbstractSqlModel, constrainedAbstractSqlModel.relationships, permissionsLookup, vocabulary);
     constrainedAbstractSqlModel.relationships = new Proxy(constrainedAbstractSqlModel.relationships, {
-        get: (relationships, permissionResourceName) => {
+        get(relationships, permissionResourceName, receiver) {
+            if (typeof permissionResourceName === 'symbol') {
+                return Reflect.get(relationships, permissionResourceName, receiver);
+            }
             if (relationships[permissionResourceName]) {
                 return relationships[permissionResourceName];
             }
@@ -606,7 +650,7 @@ const checkPassword = async (username, password) => {
     if (!res) {
         throw new Error('Passwords do not match');
     }
-    const permissions = await exports.getUserPermissions(userId);
+    const permissions = await (0, exports.getUserPermissions)(userId);
     return {
         id: userId,
         actor: actorId,
@@ -615,58 +659,60 @@ const checkPassword = async (username, password) => {
     };
 };
 exports.checkPassword = checkPassword;
-const getUserPermissionsQuery = _.once(() => sbvrUtils.api.Auth.prepare({
-    resource: 'permission',
-    passthrough: {
-        req: exports.rootRead,
-    },
-    options: {
-        $select: 'name',
-        $filter: {
-            $or: {
-                is_of__user: {
-                    $any: {
-                        $alias: 'uhp',
-                        $expr: {
-                            uhp: { user: { '@': 'userId' } },
-                            $or: [
-                                {
-                                    uhp: { expiry_date: null },
-                                },
-                                {
-                                    uhp: {
-                                        expiry_date: { $gt: { $now: null } },
+const $getUserPermissions = (() => {
+    const getUserPermissionsQuery = _.once(() => sbvrUtils.api.Auth.prepare({
+        resource: 'permission',
+        passthrough: {
+            req: exports.rootRead,
+        },
+        options: {
+            $select: 'name',
+            $filter: {
+                $or: {
+                    is_of__user: {
+                        $any: {
+                            $alias: 'uhp',
+                            $expr: {
+                                uhp: { user: { '@': 'userId' } },
+                                $or: [
+                                    {
+                                        uhp: { expiry_date: null },
                                     },
-                                },
-                            ],
+                                    {
+                                        uhp: {
+                                            expiry_date: { $gt: { $now: null } },
+                                        },
+                                    },
+                                ],
+                            },
                         },
                     },
-                },
-                is_of__role: {
-                    $any: {
-                        $alias: 'rhp',
-                        $expr: {
-                            rhp: {
-                                role: {
-                                    $any: {
-                                        $alias: 'r',
-                                        $expr: {
-                                            r: {
-                                                is_of__user: {
-                                                    $any: {
-                                                        $alias: 'uhr',
-                                                        $expr: {
-                                                            uhr: { user: { '@': 'userId' } },
-                                                            $or: [
-                                                                {
-                                                                    uhr: { expiry_date: null },
-                                                                },
-                                                                {
-                                                                    uhr: {
-                                                                        expiry_date: { $gt: { $now: null } },
+                    is_of__role: {
+                        $any: {
+                            $alias: 'rhp',
+                            $expr: {
+                                rhp: {
+                                    role: {
+                                        $any: {
+                                            $alias: 'r',
+                                            $expr: {
+                                                r: {
+                                                    is_of__user: {
+                                                        $any: {
+                                                            $alias: 'uhr',
+                                                            $expr: {
+                                                                uhr: { user: { '@': 'userId' } },
+                                                                $or: [
+                                                                    {
+                                                                        uhr: { expiry_date: null },
                                                                     },
-                                                                },
-                                                            ],
+                                                                    {
+                                                                        uhr: {
+                                                                            expiry_date: { $gt: { $now: null } },
+                                                                        },
+                                                                    },
+                                                                ],
+                                                            },
                                                         },
                                                     },
                                                 },
@@ -679,13 +725,23 @@ const getUserPermissionsQuery = _.once(() => sbvrUtils.api.Auth.prepare({
                     },
                 },
             },
+            $orderby: {
+                name: 'asc',
+            },
         },
-        $orderby: {
-            name: 'asc',
-        },
-    },
-}));
-const getUserPermissions = async (userId) => {
+    }));
+    return env.createCache('userPermissions', async (userId, tx) => {
+        const permissions = (await getUserPermissionsQuery()({
+            userId,
+        }, undefined, { tx }));
+        return permissions.map((permission) => permission.name);
+    }, {
+        primitive: true,
+        promise: true,
+        normalizer: ([userId]) => `${userId}`,
+    });
+})();
+const getUserPermissions = async (userId, tx) => {
     if (typeof userId === 'string') {
         userId = parseInt(userId, 10);
     }
@@ -693,10 +749,7 @@ const getUserPermissions = async (userId) => {
         throw new Error(`User ID has to be numeric, got: ${typeof userId}`);
     }
     try {
-        const permissions = (await getUserPermissionsQuery()({
-            userId,
-        }));
-        return permissions.map((permission) => permission.name);
+        return await $getUserPermissions(userId, tx);
     }
     catch (err) {
         sbvrUtils.api.Auth.logger.error('Error loading user permissions', err);
@@ -704,52 +757,76 @@ const getUserPermissions = async (userId) => {
     }
 };
 exports.getUserPermissions = getUserPermissions;
-const getApiKeyPermissionsQuery = _.once(() => sbvrUtils.api.Auth.prepare({
-    resource: 'permission',
-    passthrough: {
-        req: exports.rootRead,
-    },
-    options: {
-        $select: 'name',
-        $filter: {
-            $or: {
-                is_of__api_key: {
-                    $any: {
-                        $alias: 'khp',
-                        $expr: {
-                            khp: {
-                                api_key: {
-                                    $any: {
-                                        $alias: 'k',
-                                        $expr: {
-                                            k: { key: { '@': 'apiKey' } },
+const $getApiKeyPermissions = (() => {
+    const getApiKeyPermissionsQuery = _.once(() => sbvrUtils.api.Auth.prepare({
+        resource: 'permission',
+        passthrough: {
+            req: exports.rootRead,
+        },
+        options: {
+            $select: 'name',
+            $filter: {
+                $or: {
+                    is_of__api_key: {
+                        $any: {
+                            $alias: 'khp',
+                            $expr: {
+                                khp: {
+                                    api_key: {
+                                        $any: {
+                                            $alias: 'k',
+                                            $expr: {
+                                                k: { key: { '@': 'apiKey' } },
+                                                $or: [
+                                                    {
+                                                        k: { expiry_date: null },
+                                                    },
+                                                    {
+                                                        k: {
+                                                            expiry_date: { $gt: { $now: null } },
+                                                        },
+                                                    },
+                                                ],
+                                            },
                                         },
                                     },
                                 },
                             },
                         },
                     },
-                },
-                is_of__role: {
-                    $any: {
-                        $alias: 'rhp',
-                        $expr: {
-                            rhp: {
-                                role: {
-                                    $any: {
-                                        $alias: 'r',
-                                        $expr: {
-                                            r: {
-                                                is_of__api_key: {
-                                                    $any: {
-                                                        $alias: 'khr',
-                                                        $expr: {
-                                                            khr: {
-                                                                api_key: {
-                                                                    $any: {
-                                                                        $alias: 'k',
-                                                                        $expr: {
-                                                                            k: { key: { '@': 'apiKey' } },
+                    is_of__role: {
+                        $any: {
+                            $alias: 'rhp',
+                            $expr: {
+                                rhp: {
+                                    role: {
+                                        $any: {
+                                            $alias: 'r',
+                                            $expr: {
+                                                r: {
+                                                    is_of__api_key: {
+                                                        $any: {
+                                                            $alias: 'khr',
+                                                            $expr: {
+                                                                khr: {
+                                                                    api_key: {
+                                                                        $any: {
+                                                                            $alias: 'k',
+                                                                            $expr: {
+                                                                                k: { key: { '@': 'apiKey' } },
+                                                                                $or: [
+                                                                                    {
+                                                                                        k: { expiry_date: null },
+                                                                                    },
+                                                                                    {
+                                                                                        k: {
+                                                                                            expiry_date: {
+                                                                                                $gt: { $now: null },
+                                                                                            },
+                                                                                        },
+                                                                                    },
+                                                                                ],
+                                                                            },
                                                                         },
                                                                     },
                                                                 },
@@ -766,21 +843,28 @@ const getApiKeyPermissionsQuery = _.once(() => sbvrUtils.api.Auth.prepare({
                     },
                 },
             },
+            $orderby: {
+                name: 'asc',
+            },
         },
-        $orderby: {
-            name: 'asc',
-        },
-    },
-}));
-const getApiKeyPermissions = async (apiKey) => {
+    }));
+    return env.createCache('apiKeyPermissions', async (apiKey, tx) => {
+        const permissions = (await getApiKeyPermissionsQuery()({
+            apiKey,
+        }, undefined, { tx }));
+        return permissions.map((permission) => permission.name);
+    }, {
+        primitive: true,
+        promise: true,
+        normalizer: ([apiKey]) => apiKey,
+    });
+})();
+const getApiKeyPermissions = async (apiKey, tx) => {
     if (typeof apiKey !== 'string') {
         throw new Error('API key has to be a string, got: ' + typeof apiKey);
     }
     try {
-        const permissions = (await getApiKeyPermissionsQuery()({
-            apiKey,
-        }));
-        return permissions.map((permission) => permission.name);
+        return await $getApiKeyPermissions(apiKey, tx);
     }
     catch (err) {
         sbvrUtils.api.Auth.logger.error('Error loading api key permissions', err);
@@ -788,58 +872,54 @@ const getApiKeyPermissions = async (apiKey) => {
     }
 };
 exports.getApiKeyPermissions = getApiKeyPermissions;
-const getApiKeyActorIdQuery = _.once(() => sbvrUtils.api.Auth.prepare({
-    resource: 'api_key',
-    passthrough: {
-        req: exports.rootRead,
-    },
-    id: {
-        key: { '@': 'apiKey' },
-    },
-    options: {
-        $select: 'is_of__actor',
-    },
-}));
-const apiActorPermissionError = new errors_1.PermissionError();
-const getApiKeyActorId = async (apiKey) => {
-    const apiKeyResult = await getApiKeyActorIdQuery()({
-        apiKey,
+const getApiKeyActorId = (() => {
+    const getApiKeyActorIdQuery = _.once(() => sbvrUtils.api.Auth.prepare({
+        resource: 'api_key',
+        passthrough: {
+            req: exports.rootRead,
+        },
+        id: {
+            key: { '@': 'apiKey' },
+        },
+        options: {
+            $select: 'is_of__actor',
+            $filter: {
+                $or: [
+                    { expiry_date: null },
+                    { expiry_date: { $gt: { $now: null } } },
+                ],
+            },
+        },
+    }));
+    const apiActorPermissionError = new errors_1.PermissionError();
+    return env.createCache('apiKeyActorId', async (apiKey, tx) => {
+        const apiKeyResult = await getApiKeyActorIdQuery()({
+            apiKey,
+        }, undefined, { tx });
+        if (apiKeyResult == null) {
+            throw apiActorPermissionError;
+        }
+        const apiKeyActorID = apiKeyResult.is_of__actor.__id;
+        if (apiKeyActorID == null) {
+            throw new Error('API key is not linked to a actor?!');
+        }
+        return apiKeyActorID;
+    }, {
+        promise: true,
+        primitive: true,
+        normalizer: ([apiKey]) => apiKey,
     });
-    if (apiKeyResult == null) {
-        throw apiActorPermissionError;
-    }
-    const apiKeyActorID = apiKeyResult.is_of__actor.__id;
-    if (apiKeyActorID == null) {
-        throw new Error('API key is not linked to a actor?!');
-    }
-    return apiKeyActorID;
-};
-const checkApiKey = async (req, apiKey) => {
-    if (apiKey == null || req.apiKey != null) {
-        return;
-    }
-    let permissions;
-    try {
-        permissions = await exports.getApiKeyPermissions(apiKey);
-    }
-    catch (err) {
-        console.warn('Error with API key:', err);
-        permissions = [];
-    }
-    let actor;
-    if (permissions.length > 0) {
-        actor = await getApiKeyActorId(apiKey);
-    }
-    const resolvedApiKey = {
+})();
+const checkApiKey = async (apiKey, tx) => {
+    const permissions = await (0, exports.getApiKeyPermissions)(apiKey, tx);
+    const actor = await getApiKeyActorId(apiKey, tx);
+    return {
         key: apiKey,
         permissions,
+        actor,
     };
-    if (actor != null) {
-        resolvedApiKey.actor = actor;
-    }
-    return resolvedApiKey;
 };
-const resolveAuthHeader = async (req, expectedScheme = 'Bearer') => {
+const resolveAuthHeader = async (req, expectedScheme = 'Bearer', tx) => {
     const auth = req.header('Authorization');
     if (!auth) {
         return;
@@ -852,52 +932,48 @@ const resolveAuthHeader = async (req, expectedScheme = 'Bearer') => {
     if (scheme.toLowerCase() !== expectedScheme.toLowerCase()) {
         return;
     }
-    return await checkApiKey(req, apiKey);
+    return await checkApiKey(apiKey, tx);
 };
 exports.resolveAuthHeader = resolveAuthHeader;
 const customAuthorizationMiddleware = (expectedScheme = 'Bearer') => {
     expectedScheme = expectedScheme.toLowerCase();
     return async (req, _res, next) => {
         try {
-            const apiKey = await exports.resolveAuthHeader(req, expectedScheme);
+            const apiKey = await (0, exports.resolveAuthHeader)(req, expectedScheme);
             if (apiKey) {
                 req.apiKey = apiKey;
             }
         }
         finally {
-            next === null || next === void 0 ? void 0 : next();
+            next?.();
         }
     };
 };
 exports.customAuthorizationMiddleware = customAuthorizationMiddleware;
-exports.authorizationMiddleware = exports.customAuthorizationMiddleware();
-const resolveApiKey = async (req, paramName = 'apikey') => {
-    const apiKey = req.params[paramName] != null
-        ? req.params[paramName]
-        : req.body[paramName] != null
-            ? req.body[paramName]
-            : req.query[paramName];
-    return await checkApiKey(req, apiKey);
+exports.authorizationMiddleware = (0, exports.customAuthorizationMiddleware)();
+const resolveApiKey = async (req, paramName = 'apikey', tx) => {
+    const apiKey = req.params[paramName] ?? req.body[paramName] ?? req.query[paramName];
+    if (apiKey == null) {
+        return;
+    }
+    return await checkApiKey(apiKey, tx);
 };
 exports.resolveApiKey = resolveApiKey;
 const customApiKeyMiddleware = (paramName = 'apikey') => {
-    if (paramName == null) {
-        paramName = 'apikey';
-    }
     return async (req, _res, next) => {
         try {
-            const apiKey = await exports.resolveApiKey(req, paramName);
+            const apiKey = await (0, exports.resolveApiKey)(req, paramName);
             if (apiKey) {
                 req.apiKey = apiKey;
             }
         }
         finally {
-            next === null || next === void 0 ? void 0 : next();
+            next?.();
         }
     };
 };
 exports.customApiKeyMiddleware = customApiKeyMiddleware;
-exports.apiKeyMiddleware = exports.customApiKeyMiddleware();
+exports.apiKeyMiddleware = (0, exports.customApiKeyMiddleware)();
 const checkPermissions = async (req, actionList, resourceName, vocabulary) => {
     const permissionsLookup = await getReqPermissions(req);
     return $checkPermissions(permissionsLookup, actionList, vocabulary, resourceName);
@@ -905,10 +981,10 @@ const checkPermissions = async (req, actionList, resourceName, vocabulary) => {
 exports.checkPermissions = checkPermissions;
 const checkPermissionsMiddleware = (action) => async (req, res, next) => {
     try {
-        const allowed = await exports.checkPermissions(req, action);
+        const allowed = await (0, exports.checkPermissions)(req, action);
         switch (allowed) {
             case false:
-                res.sendStatus(401);
+                res.status(401).end();
                 return;
             case true:
                 next();
@@ -918,11 +994,12 @@ const checkPermissionsMiddleware = (action) => async (req, res, next) => {
         }
     }
     catch (err) {
-        sbvrUtils.api.Auth.logger.error('Error checking permissions', err, err.stack);
-        res.sendStatus(503);
+        sbvrUtils.api.Auth.logger.error('Error checking permissions', err);
+        res.status(503).end();
     }
 };
 exports.checkPermissionsMiddleware = checkPermissionsMiddleware;
+let guestPermissionsInitialized = false;
 const getGuestPermissions = memoize(async () => {
     const result = (await sbvrUtils.api.Auth.get({
         resource: 'user',
@@ -939,75 +1016,56 @@ const getGuestPermissions = memoize(async () => {
     if (result == null) {
         throw new Error('No guest user');
     }
-    return _.uniq(await exports.getUserPermissions(result.id));
-}, { promise: true });
-const getReqPermissions = async (req, odataBinds = []) => {
-    const [guestPermissions] = await Promise.all([
-        getGuestPermissions(),
-        (async () => {
-            if (req.apiKey != null &&
-                req.apiKey.actor == null &&
-                req.apiKey.permissions != null &&
-                req.apiKey.permissions.length > 0) {
-                const actorId = await getApiKeyActorId(req.apiKey.key);
-                req.apiKey.actor = actorId;
-            }
-        })(),
-    ]);
+    const guestPermissions = _.uniq(await (0, exports.getUserPermissions)(result.id));
     if (guestPermissions.some((p) => DEFAULT_ACTOR_BIND_REGEX.test(p))) {
         throw new Error('Guest permissions cannot reference actors');
     }
-    let permissions = guestPermissions;
-    let actorIndex = 0;
-    const addActorPermissions = (actorId, actorPermissions) => {
-        let actorBind = DEFAULT_ACTOR_BIND;
-        if (actorIndex > 0) {
-            actorBind += actorIndex;
-            actorPermissions = actorPermissions.map((actorPermission) => actorPermission.replace(DEFAULT_ACTOR_BIND_REGEX, actorBind));
+    guestPermissionsInitialized = true;
+    return guestPermissions;
+}, { promise: true });
+const getReqPermissions = async (req, odataBinds = []) => {
+    const guestPermissions = await (async () => {
+        if (guestPermissionsInitialized === false &&
+            (req.user === exports.root.user || req.user === exports.rootRead.user)) {
+            return [];
         }
-        odataBinds[actorBind] = ['Real', actorId];
-        actorIndex++;
-        permissions = permissions.concat(actorPermissions);
+        return await getGuestPermissions();
+    })();
+    let actorPermissions = [];
+    const addActorPermissions = (actorId, perms) => {
+        odataBinds[DEFAULT_ACTOR_BIND] = ['Real', actorId];
+        actorPermissions = perms;
     };
-    if (req.user != null && req.user.permissions != null) {
+    if (req.user?.permissions != null) {
         addActorPermissions(req.user.actor, req.user.permissions);
     }
-    else if (req.apiKey != null && req.apiKey.permissions != null) {
+    else if (req.apiKey?.permissions != null) {
         addActorPermissions(req.apiKey.actor, req.apiKey.permissions);
     }
-    permissions = _.uniq(permissions);
-    return getPermissionsLookup(permissions);
+    return getPermissionsLookup(actorPermissions, guestPermissions);
 };
 const addPermissions = async (req, request) => {
-    var _a, _b, _c, _d;
-    const { vocabulary, resourceName, odataQuery, odataBinds } = request;
-    let { method } = request;
+    const { resourceName, odataQuery, odataBinds } = request;
+    const vocabulary = _.last(request.translateVersions);
     let abstractSqlModel = sbvrUtils.getAbstractSqlModel(request);
-    method = method.toUpperCase();
-    const isMetadataEndpoint = uri_parser_1.metadataEndpoints.includes(resourceName) || method === 'OPTIONS';
-    let permissionType;
-    if (request.permissionType != null) {
-        permissionType = request.permissionType;
-    }
-    else if (isMetadataEndpoint) {
-        permissionType = 'model';
-    }
-    else {
-        const methodPermission = methodPermissions[method];
-        if (methodPermission != null) {
-            permissionType = methodPermission;
+    let { permissionType } = request;
+    if (permissionType == null) {
+        const method = request.method.toUpperCase();
+        const isMetadataEndpoint = method === 'OPTIONS' || uri_parser_1.metadataEndpoints.includes(resourceName);
+        if (isMetadataEndpoint) {
+            permissionType = 'model';
         }
         else {
-            console.warn('Unknown method for permissions type check: ', method);
-            permissionType = 'all';
+            const methodPermission = methodPermissions[method];
+            if (methodPermission != null) {
+                permissionType = methodPermission;
+            }
+            else {
+                console.warn('Unknown method for permissions type check: ', method);
+                permissionType = 'all';
+            }
         }
     }
-    let permissions = (_b = (_a = req.user) === null || _a === void 0 ? void 0 : _a.permissions) !== null && _b !== void 0 ? _b : [];
-    permissions = permissions.concat((_d = (_c = req.apiKey) === null || _c === void 0 ? void 0 : _c.permissions) !== null && _d !== void 0 ? _d : []);
-    if (permissions.length > 0 &&
-        $checkPermissions(getPermissionsLookup(permissions), permissionType, vocabulary) === true) {
-        return;
-    }
     const permissionsLookup = await getReqPermissions(req, odataBinds);
     request.abstractSqlModel = abstractSqlModel = memoizedGetConstrainedModel(abstractSqlModel, permissionsLookup, vocabulary);
     if (!_.isEqual(permissionType, methodPermissions.GET)) {
@@ -1051,22 +1109,25 @@ exports.config = {
 					ALTER TABLE "role-has-permission"
 					ADD COLUMN IF NOT EXISTS "modified at" TIMESTAMP DEFAULT CURRENT_TIMESTAMP NOT NULL;
 				`,
+                '14.42.0-api-key-expiry-date': `
+					ALTER TABLE "api key"
+					ADD COLUMN IF NOT EXISTS "expiry date" TIMESTAMP NULL;
+				`,
             },
         },
     ],
 };
 const setup = () => {
-    hooks_1.addHook('all', 'all', 'all', {
+    (0, hooks_1.addHook)('all', 'all', 'all', {
         sideEffects: false,
         readOnlyTx: true,
-        PREPARSE: ({ req }) => exports.apiKeyMiddleware(req),
+        PREPARSE: ({ req }) => (0, exports.apiKeyMiddleware)(req),
         POSTPARSE: async ({ req, request, }) => {
             if (request.abstractSqlQuery != null) {
                 return;
             }
             if (request.method === 'POST' &&
-                request.odataQuery.property != null &&
-                request.odataQuery.property.resource === 'canAccess') {
+                request.odataQuery.property?.resource === 'canAccess') {
                 if (request.odataQuery.key == null) {
                     throw new errors_1.BadRequestError();
                 }
@@ -1086,6 +1147,7 @@ const setup = () => {
                 }
                 const abstractSqlModel = sbvrUtils.getAbstractSqlModel(request);
                 request.resourceName = request.resourceName.slice(0, -'#canAccess'.length);
+                request.originalResourceName = request.originalResourceName.slice(0, -'#canAccess'.length);
                 const resourceName = sbvrUtils.resolveSynonym(request);
                 const resourceTable = abstractSqlModel.tables[resourceName];
                 if (resourceTable == null) {
@@ -1101,15 +1163,18 @@ const setup = () => {
                 request.method = 'GET';
                 request.custom.isAction = 'canAccess';
             }
-            await exports.addPermissions(req, request);
+            await (0, exports.addPermissions)(req, request);
         },
-        PRERESPOND: ({ request, data }) => {
-            if (request.custom.isAction === 'canAccess' && _.isEmpty(data)) {
+        PRERESPOND: ({ request, response }) => {
+            if (request.custom.isAction === 'canAccess' &&
+                (response.body == null ||
+                    typeof response.body === 'string' ||
+                    _.isEmpty(response.body?.d))) {
                 throw new errors_1.PermissionError();
             }
         },
     });
-    hooks_1.addPureHook('POST', 'Auth', 'user', {
+    (0, hooks_1.addPureHook)('POST', 'Auth', 'user', {
         POSTPARSE: async ({ request, api }) => {
             const result = await api.post({
                 resource: 'actor',
@@ -1118,7 +1183,7 @@ const setup = () => {
             request.values.actor = result.id;
         },
     });
-    hooks_1.addPureHook('DELETE', 'Auth', 'user', {
+    (0, hooks_1.addPureHook)('DELETE', 'Auth', 'user', {
         POSTRUN: ({ request, api }) => api.delete({
             resource: 'actor',
             id: request.values.actor,