@casual-simulation/aux-records 3.2.13 → 3.2.14-alpha.7890390188

package/PolicyController.js

@@ -7,21 +7,12 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-var __rest = (this && this.__rest) || function (s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-};
 import { isRecordKey, } from './RecordsController';
-import { ADMIN_ROLE_NAME, ACCOUNT_MARKER, } from '@casual-simulation/aux-common';
-import { getExpireTime, } from './PolicyStore';
-import { intersectionBy, isEqual, sortBy, union } from 'lodash';
+import { ADMIN_ROLE_NAME, PUBLIC_READ_MARKER, ACCOUNT_MARKER, } from '@casual-simulation/aux-common';
+import { getExpireTime, getPublicMarkersPermission, } from './PolicyStore';
+import { sortBy, without } from 'lodash';
+import { getRootMarker, getRootMarkersOrDefault } from './Utils';
+import { normalizeInstId, parseInstId } from './websockets';
 /**
  * The maximum number of instances that can be authorized at once.
  */
@@ -30,25 +21,105 @@ export const MAX_ALLOWED_INSTANCES = 2;
  * The maximum number of markers that can be placed on a resource at once.
  */
 export const MAX_ALLOWED_MARKERS = 2;
+const ALLOWED_RECORD_KEY_RESOURCES = [
+    ['data', ['read', 'create', 'delete', 'update', 'list']],
+    ['file', ['read', 'create', 'delete']],
+    ['event', ['create', 'count', 'increment', 'update']],
+    [
+        'inst',
+        ['read', 'create', 'delete', 'update', 'updateData', 'sendAction'],
+    ],
+];
+const ALLOWED_STUDIO_MEMBER_RESOURCES = [
+    ['data', ['read', 'create', 'delete', 'update', 'list']],
+    ['file', ['read', 'create', 'delete', 'list']],
+    ['event', ['create', 'count', 'increment', 'list']],
+    [
+        'inst',
+        [
+            'read',
+            'create',
+            'delete',
+            'update',
+            'updateData',
+            'sendAction',
+            'list',
+        ],
+    ],
+];
+function constructAllowedResourcesLookup(allowedResources) {
+    const lookup = new Set();
+    for (let [resourceKind, actions] of allowedResources) {
+        for (let action of actions) {
+            lookup.add(`${resourceKind}.${action}`);
+        }
+    }
+    return lookup;
+}
+const ALLOWED_RECORD_KEY_RESOURCES_LOOKUP = constructAllowedResourcesLookup(ALLOWED_RECORD_KEY_RESOURCES);
+const ALLOWED_STUDIO_MEMBER_RESOURCES_LOOKUP = constructAllowedResourcesLookup(ALLOWED_STUDIO_MEMBER_RESOURCES);
 /**
- * A generic not_authorized result.
+ * Determines if the given resource kind and action are allowed to be accessed by a record key.
+ * @param resourceKind The kind of the resource kind.
+ * @param action The action.
  */
-export const NOT_AUTHORIZED_RESULT = {
-    allowed: false,
-    errorCode: 'not_authorized',
-    errorMessage: 'You are not authorized to perform this action.',
-};
+function isAllowedRecordKeyResource(resourceKind, action) {
+    return ALLOWED_RECORD_KEY_RESOURCES_LOOKUP.has(`${resourceKind}.${action}`);
+}
 /**
- * A not_authorized result that indicates too many instances were used.
+ * Determines if the given resource kind and action are allowed to be accessed by a studio member.
+ * @param resourceKind The kind of the resource kind.
+ * @param action The action.
  */
-export const NOT_AUTHORIZED_TO_MANY_INSTANCES_RESULT = {
-    allowed: false,
-    errorCode: 'not_authorized',
-    errorMessage: `This action is not authorized because more than ${MAX_ALLOWED_INSTANCES} instances are loaded.`,
-    reason: {
-        type: 'too_many_insts',
-    },
-};
+function isAllowedStudioMemberResource(resourceKind, action) {
+    return ALLOWED_STUDIO_MEMBER_RESOURCES_LOOKUP.has(`${resourceKind}.${action}`);
+}
+/**
+ * Gets the resources that need to be authorized when creating a resource with the given markers.
+ * @param markers The markers that will be placed on the resource.
+ */
+export function getMarkerResourcesForCreation(markers) {
+    // If the resource has the PUBLIC_READ_MARKER, then we only need the "create" permission and not the "assign" permission.
+    return markers
+        .filter((m) => m !== PUBLIC_READ_MARKER)
+        .map((m) => ({
+        resourceKind: 'marker',
+        resourceId: m,
+        action: 'assign',
+        markers: [ACCOUNT_MARKER],
+    }));
+}
+/**
+ * Gets the resources that need to be authorized when updating a resource with the given markers.
+ * @param existingMarkers The markers that already exist on the resource.
+ * @param newMarkers The markers that will replace the existing markers. If null, then no markers will be added or removed.
+ */
+export function getMarkerResourcesForUpdate(existingMarkers, newMarkers) {
+    const addedMarkers = newMarkers
+        ? without(newMarkers, ...existingMarkers)
+        : [];
+    const removedMarkers = newMarkers
+        ? without(existingMarkers, ...newMarkers)
+        : [];
+    const resources = [];
+    for (let marker of addedMarkers) {
+        resources.push({
+            resourceKind: 'marker',
+            resourceId: marker,
+            action: 'assign',
+            markers: [ACCOUNT_MARKER],
+        });
+    }
+    for (let marker of removedMarkers) {
+        resources.push({
+            resourceKind: 'marker',
+            resourceId: marker,
+            action: 'unassign',
+            markers: [ACCOUNT_MARKER],
+        });
+    }
+    return resources;
+}
 /**
  * Defines a class that is able to calculate the policies and permissions that are allowed for specific actions.
  */
@@ -67,6 +138,7 @@ export class PolicyController {
         return __awaiter(this, void 0, void 0, function* () {
             let recordKeyResult = null;
             let recordName;
+            let recordKeyCreatorId;
             let ownerId;
             let studioId;
             let studioMembers = undefined;
@@ -76,6 +148,7 @@ export class PolicyController {
                 if (recordKeyResult.success === true) {
                     recordName = recordKeyResult.recordName;
                     ownerId = recordKeyResult.ownerId;
+                    recordKeyCreatorId = recordKeyResult.keyCreatorId;
                 }
                 else {
                     return {
@@ -102,14 +175,43 @@ export class PolicyController {
             const subjectPolicy = !!recordKeyResult && recordKeyResult.success
                 ? recordKeyResult.policy
                 : 'subjectfull';
+            let recordOwnerPrivacyFeatures = null;
+            let userPrivacyFeatures = null;
+            if (ownerId) {
+                recordOwnerPrivacyFeatures =
+                    yield this._policies.getUserPrivacyFeatures(ownerId);
+            }
+            if (!recordOwnerPrivacyFeatures) {
+                recordOwnerPrivacyFeatures = {
+                    allowAI: true,
+                    allowPublicData: true,
+                    allowPublicInsts: true,
+                    publishData: true,
+                };
+            }
+            if (request.userId) {
+                userPrivacyFeatures = yield this._policies.getUserPrivacyFeatures(request.userId);
+            }
+            if (!userPrivacyFeatures) {
+                userPrivacyFeatures = {
+                    allowAI: true,
+                    allowPublicData: true,
+                    allowPublicInsts: true,
+                    publishData: true,
+                };
+            }
             const context = {
                 recordName,
                 recordKeyResult,
                 subjectPolicy,
                 recordKeyProvided,
+                recordKeyCreatorId,
                 recordOwnerId: ownerId,
+                recordOwnerPrivacyFeatures,
                 recordStudioId: studioId,
                 recordStudioMembers: studioMembers,
+                userId: request.userId,
+                userPrivacyFeatures,
             };
             return {
                 success: true,
@@ -118,28 +220,40 @@ export class PolicyController {
         });
     }
     /**
-     * Attempts to authorize the given request.
-     * Returns a promise that resolves with information about the security properties of the request.
+     * Attempts to authorize the given user and instances for the action and resource(s).
      * @param context The authorization context for the request.
      * @param request The request.
      */
-    authorizeRequest(request) {
+    authorizeUserAndInstances(context, request) {
+        var _a;
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                const context = yield this.constructAuthorizationContext(request);
-                if (context.success === false) {
-                    return {
-                        allowed: false,
-                        errorCode: context.errorCode,
-                        errorMessage: context.errorMessage,
-                    };
+                const authorization = yield this.authorizeSubjects(context, {
+                    action: request.action,
+                    markers: request.markers,
+                    resourceKind: request.resourceKind,
+                    resourceId: request.resourceId,
+                    subjects: [
+                        {
+                            subjectType: 'user',
+                            subjectId: request.userId,
+                        },
+                        ...((_a = request.instances) !== null && _a !== void 0 ? _a : []).map((i) => ({
+                            subjectType: 'inst',
+                            subjectId: i,
+                        })),
+                    ],
+                });
+                if (authorization.success === false) {
+                    return authorization;
                 }
-                return yield this._authorizeRequestUsingContext(context.context, request);
+                const userResult = authorization.results.find((r) => r.subjectType === 'user' && r.subjectId === request.userId);
+                return Object.assign(Object.assign({}, authorization), { user: userResult });
             }
             catch (err) {
-                console.error('[PolicyController] A server error occurred.', err);
+                console.error('[PolicyController] A server error occurred while authorizing user and instances.', err);
                 return {
-                    allowed: false,
+                    success: false,
                     errorCode: 'server_error',
                     errorMessage: 'A server error occurred.',
                 };
@@ -147,20 +261,131 @@ export class PolicyController {
         });
     }
     /**
-     * Attempts to authorize the given request.
-     * Returns a promise that resolves with information about the security properties of the request.
+     * Attempts to authorize the given user and instances for the given resources.
      * @param context The authorization context for the request.
      * @param request The request.
      */
-    authorizeRequestUsingContext(context, request) {
+    authorizeUserAndInstancesForResources(context, request) {
+        var _a;
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                return this._authorizeRequestUsingContext(context, request);
+                const subjects = [
+                    {
+                        subjectType: 'user',
+                        subjectId: request.userId,
+                    },
+                    ...((_a = request.instances) !== null && _a !== void 0 ? _a : []).map((i) => ({
+                        subjectType: 'inst',
+                        subjectId: i,
+                    })),
+                ];
+                const subjectPermission = new Map();
+                const results = [];
+                const recordName = context.recordName;
+                for (let resource of request.resources) {
+                    let subjectsToAuthorize = [];
+                    let authorizations = [];
+                    for (let subject of subjects) {
+                        const subjectKey = `${subject.subjectType}.${subject.subjectId}`;
+                        const authorizedSubject = subjectPermission.get(subjectKey);
+                        if (authorizedSubject) {
+                            const permission = authorizedSubject.permission;
+                            const isCorrectResourceKind = permission.resourceKind === null ||
+                                permission.resourceKind === resource.resourceKind;
+                            const isCorrectAction = permission.action === null ||
+                                permission.action === resource.action;
+                            const isCorrectMarker = !('marker' in permission) ||
+                                resource.markers.includes(permission.marker);
+                            const isCorrectResource = !('resourceId' in permission) ||
+                                permission.resourceId === null ||
+                                permission.resourceId === resource.resourceId;
+                            if (isCorrectResourceKind &&
+                                isCorrectAction &&
+                                isCorrectMarker &&
+                                isCorrectResource) {
+                                // Record the authorization
+                                authorizations.push(authorizedSubject);
+                            }
+                            else {
+                                subjectsToAuthorize.push(subject);
+                            }
+                        }
+                        else {
+                            subjectsToAuthorize.push(subject);
+                        }
+                    }
+                    if (subjectsToAuthorize.length > 0) {
+                        const result = yield this.authorizeSubjects(context, {
+                            action: resource.action,
+                            markers: resource.markers,
+                            resourceKind: resource.resourceKind,
+                            resourceId: resource.resourceId,
+                            subjects: subjectsToAuthorize,
+                        });
+                        if (result.success === false) {
+                            return result;
+                        }
+                        for (let authorization of result.results) {
+                            const subjectKey = `${authorization.subjectType}.${authorization.subjectId}`;
+                            authorizations.push(authorization);
+                            const permission = authorization.permission;
+                            const existingAuthorization = subjectPermission.get(subjectKey);
+                            if (!existingAuthorization) {
+                                subjectPermission.set(subjectKey, authorization);
+                            }
+                            else {
+                                const existingPermission = existingAuthorization.permission;
+                                const isResourceKindMoreGeneral = permission.resourceKind === null &&
+                                    existingPermission.resourceKind !== null;
+                                const isActionMoreGeneral = permission.action === null &&
+                                    existingPermission.action !== null;
+                                const isMarkerMoreGeneral = 'marker' in permission &&
+                                    'marker' in existingPermission &&
+                                    permission.marker === null &&
+                                    existingPermission.marker !== null;
+                                const isResourceMoreGeneral = 'resourceId' in permission &&
+                                    'resourceId' in existingPermission &&
+                                    permission.resourceId === null &&
+                                    existingPermission.resourceId !== null;
+                                if (isResourceKindMoreGeneral ||
+                                    isActionMoreGeneral ||
+                                    isMarkerMoreGeneral ||
+                                    isResourceMoreGeneral) {
+                                    subjectPermission.set(subjectKey, authorization);
+                                }
+                            }
+                        }
+                    }
+                    if (authorizations.length !== subjects.length) {
+                        console.error('[PolicyController] [authorizeUserAndInstancesForResources] The number of authorizations does not match the number of subjects!');
+                        return {
+                            success: false,
+                            errorCode: 'server_error',
+                            errorMessage: 'A server error occurred.',
+                        };
+                    }
+                    results.push({
+                        success: true,
+                        recordName: recordName,
+                        resourceKind: resource.resourceKind,
+                        resourceId: resource.resourceId,
+                        action: resource.action,
+                        markers: resource.markers,
+                        results: authorizations,
+                        user: authorizations.find((r) => r.subjectType === 'user' &&
+                            r.subjectId === request.userId),
+                    });
+                }
+                return {
+                    success: true,
+                    recordName: recordName,
+                    results,
+                };
             }
             catch (err) {
-                console.error('[PolicyController] A server error occurred.', err);
+                console.error('[PolicyController] A server error occurred while authorizing user and instances for resources.', err);
                 return {
-                    allowed: false,
+                    success: false,
                     errorCode: 'server_error',
                     errorMessage: 'A server error occurred.',
                 };
@@ -168,65 +393,36 @@ export class PolicyController {
         });
     }
     /**
-     * Attempts to grant a permission to a marker.
-     * @param request The request for the operation.
+     * Attempts to authorize the given subjects for the action and resource(s).
+     * @param context The authorization context for the request.
+     * @param request The request.
      */
-    grantMarkerPermission(request) {
+    authorizeSubjects(context, request) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                const baseRequest = {
-                    recordKeyOrRecordName: request.recordKeyOrRecordName,
-                    userId: request.userId,
-                };
-                const context = yield this.constructAuthorizationContext(baseRequest);
-                if (context.success === false) {
-                    return {
-                        success: false,
-                        errorCode: context.errorCode,
-                        errorMessage: context.errorMessage,
-                    };
-                }
-                const authorization = yield this.authorizeRequestUsingContext(context.context, Object.assign(Object.assign({ action: 'policy.grantPermission' }, baseRequest), { policy: request.marker, instances: request.instances }));
-                if (authorization.allowed === false) {
-                    return returnAuthorizationResult(authorization);
-                }
-                const policyResult = yield this._policies.getUserPolicy(context.context.recordName, request.marker);
-                if (policyResult.success === false &&
-                    policyResult.errorCode !== 'policy_not_found') {
-                    console.log(`[PolicyController] Failure while retrieving policy for ${context.context.recordName} and ${request.marker}.`, policyResult);
+                if (request.subjects.length <= 0) {
                     return {
                         success: false,
-                        errorCode: policyResult.errorCode,
-                        errorMessage: policyResult.errorMessage,
+                        errorCode: 'unacceptable_request',
+                        errorMessage: 'You must provide at least one subject to authorize.',
                     };
                 }
-                const policy = policyResult.success
-                    ? policyResult
-                    : {
-                        document: {
-                            permissions: [],
-                        },
-                        markers: [ACCOUNT_MARKER],
-                    };
-                const alreadyExists = policy.document.permissions.some((p) => isEqual(p, request.permission));
-                if (!alreadyExists) {
-                    console.log(`[PolicyController] Adding permission to policy for ${context.context.recordName} and ${request.marker}.`, request.permission);
-                    policy.document.permissions.push(request.permission);
-                    const updateResult = yield this._policies.updateUserPolicy(context.context.recordName, request.marker, {
-                        document: policy.document,
-                        markers: policy.markers,
-                    });
-                    if (updateResult.success === false) {
-                        console.log(`[PolicyController] Policy update failed:`, updateResult);
-                        return updateResult;
+                const results = [];
+                for (let subject of request.subjects) {
+                    const subjectResult = yield this.authorizeSubjectUsingContext(context, Object.assign(Object.assign({}, subject), { action: request.action, resourceKind: request.resourceKind, resourceId: request.resourceId, markers: request.markers }));
+                    if (subjectResult.success === false) {
+                        return subjectResult;
                     }
+                    results.push(Object.assign(Object.assign({}, subjectResult), { subjectType: subject.subjectType, subjectId: subject.subjectId }));
                 }
                 return {
                     success: true,
+                    recordName: context.recordName,
+                    results: results,
                 };
             }
             catch (err) {
-                console.error('[PolicyController] A server error occurred.', err);
+                console.error('[PolicyController] A server error occurred while authorizing subjects.', err);
                 return {
                     success: false,
                     errorCode: 'server_error',
@@ -236,69 +432,457 @@ export class PolicyController {
         });
     }
     /**
-     * Attempts to revoke a permission from a marker.
-     * @param request The request for the operation.
+     * Attempts to authorize the given subject for the action and resource(s).
+     * Returns a promise that resolves with information about the security properties of the request.
+     * @param context The context for the request.
+     * @param request The request to authorize.
      */
-    revokeMarkerPermission(request) {
+    authorizeSubject(context, request) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                const baseRequest = {
-                    recordKeyOrRecordName: request.recordKeyOrRecordName,
-                    userId: request.userId,
-                };
-                const context = yield this.constructAuthorizationContext(baseRequest);
                 if (context.success === false) {
+                    return context;
+                }
+                return yield this.authorizeSubjectUsingContext(context.context, request);
+            }
+            catch (err) {
+                console.error('[PolicyController] A server error occurred while authorizing a subject.', err);
+                return {
+                    success: false,
+                    errorCode: 'server_error',
+                    errorMessage: 'A server error occurred.',
+                };
+            }
+        });
+    }
+    /**
+     * Attempts to authorize the given subject for the action and resource(s).
+     * Returns a promise that resolves with information about the security properties of the request.
+     * @param context The context for the request.
+     * @param request The request to authorize.
+     */
+    authorizeSubjectUsingContext(context, request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const result = yield this._authorizeSubjectUsingContext(context, request);
+            if (result.success) {
+                console.log(`[PolicyController] [action: ${request.resourceKind}.${request.action} resourceId: ${request.resourceId} recordName: ${context.recordName}, userId: ${context.userId}] Request authorized.`);
+            }
+            else {
+                console.log(`[PolicyController] [action: ${request.resourceKind}.${request.action} resourceId: ${request.resourceId} recordName: ${context.recordName}, userId: ${context.userId}] Request denied:`, result);
+            }
+            return result;
+        });
+    }
+    /**
+     * Attempts to authorize the given subject for the action and resource(s).
+     * Returns a promise that resolves with information about the security properties of the request.
+     * @param context The context for the request.
+     * @param request The request to authorize.
+     */
+    _authorizeSubjectUsingContext(context, request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const markers = getRootMarkersOrDefault(request.markers);
+                if (request.action === 'list' && markers.length > 1) {
                     return {
                         success: false,
-                        errorCode: context.errorCode,
-                        errorMessage: context.errorMessage,
+                        errorCode: 'not_authorized',
+                        errorMessage: `The "${request.action}" action cannot be used with multiple markers.`,
+                        reason: {
+                            type: 'too_many_markers',
+                        },
+                    };
+                }
+                if (!context.userPrivacyFeatures.publishData) {
+                    return {
+                        success: false,
+                        errorCode: 'not_authorized',
+                        errorMessage: 'You are not authorized to perform this action.',
+                        reason: {
+                            type: 'disabled_privacy_feature',
+                            recordName: context.recordName,
+                            subjectType: 'user',
+                            subjectId: context.userId,
+                            resourceKind: request.resourceKind,
+                            action: request.action,
+                            resourceId: request.resourceId,
+                            privacyFeature: 'publishData',
+                        },
                     };
                 }
-                const authorization = yield this.authorizeRequestUsingContext(context.context, Object.assign(Object.assign({ action: 'policy.revokePermission' }, baseRequest), { policy: request.marker, instances: request.instances }));
-                if (authorization.allowed === false) {
-                    return returnAuthorizationResult(authorization);
+                const recordName = context.recordName;
+                const subjectType = request.subjectType;
+                let subjectId = request.subjectId;
+                if (subjectType === 'inst') {
+                    subjectId = normalizeInstId(subjectId);
                 }
-                const policyResult = yield this._policies.getUserPolicy(context.context.recordName, request.marker);
-                if (policyResult.success === false) {
-                    if (policyResult.errorCode === 'policy_not_found') {
+                const publicPermission = getPublicMarkersPermission(markers, request.resourceKind, request.action);
+                if (context.recordOwnerId &&
+                    context.userId !== context.recordOwnerId) {
+                    if (!context.recordOwnerPrivacyFeatures.allowPublicData) {
                         return {
-                            success: true,
+                            success: false,
+                            errorCode: 'not_authorized',
+                            errorMessage: 'You are not authorized to perform this action.',
+                            reason: {
+                                type: 'disabled_privacy_feature',
+                                recordName: context.recordName,
+                                subjectType: 'user',
+                                subjectId: context.userId,
+                                resourceKind: request.resourceKind,
+                                action: request.action,
+                                resourceId: request.resourceId,
+                                privacyFeature: 'allowPublicData',
+                            },
+                        };
+                    }
+                    if (request.resourceKind === 'inst' &&
+                        (!context.recordOwnerPrivacyFeatures.allowPublicInsts ||
+                            !context.userPrivacyFeatures.allowPublicInsts)) {
+                        return {
+                            success: false,
+                            errorCode: 'not_authorized',
+                            errorMessage: 'You are not authorized to perform this action.',
+                            reason: {
+                                type: 'disabled_privacy_feature',
+                                recordName: context.recordName,
+                                subjectType: 'user',
+                                subjectId: context.userId,
+                                resourceKind: request.resourceKind,
+                                action: request.action,
+                                resourceId: request.resourceId,
+                                privacyFeature: 'allowPublicInsts',
+                            },
+                        };
+                    }
+                }
+                if (publicPermission) {
+                    if (!context.userPrivacyFeatures.allowPublicData) {
+                        return {
+                            success: false,
+                            errorCode: 'not_authorized',
+                            errorMessage: 'You are not authorized to perform this action.',
+                            reason: {
+                                type: 'disabled_privacy_feature',
+                                recordName: context.recordName,
+                                subjectType: 'user',
+                                subjectId: context.userId,
+                                resourceKind: request.resourceKind,
+                                action: request.action,
+                                resourceId: request.resourceId,
+                                privacyFeature: 'allowPublicData',
+                            },
                         };
                     }
-                    console.log(`[PolicyController] Failure while retrieving policy for ${context.context.recordName} and ${request.marker}.`, policyResult);
                     return {
-                        success: false,
-                        errorCode: policyResult.errorCode,
-                        errorMessage: policyResult.errorMessage,
+                        success: true,
+                        recordName,
+                        permission: {
+                            id: null,
+                            recordName: recordName,
+                            userId: null,
+                            subjectType: subjectType,
+                            subjectId: subjectId,
+                            resourceKind: publicPermission.resourceKind,
+                            action: publicPermission.action,
+                            marker: publicPermission.marker,
+                            options: {},
+                            expireTimeMs: null,
+                        },
+                        explanation: publicPermission.marker === PUBLIC_READ_MARKER
+                            ? 'Resource has the publicRead marker.'
+                            : 'Resource has the publicWrite marker.',
+                    };
+                }
+                if (subjectType === 'role' && subjectId === ADMIN_ROLE_NAME) {
+                    return {
+                        success: true,
+                        recordName: recordName,
+                        permission: {
+                            id: null,
+                            recordName: recordName,
+                            userId: null,
+                            // Record owners are treated as if they are admins in the record
+                            subjectType: 'role',
+                            subjectId: ADMIN_ROLE_NAME,
+                            // Admins get all access to all resources in a record
+                            resourceKind: null,
+                            action: null,
+                            marker: markers[0],
+                            options: {},
+                            expireTimeMs: null,
+                        },
+                        explanation: `Role is "${ADMIN_ROLE_NAME}".`,
+                    };
+                }
+                if (context.recordKeyProvided &&
+                    context.recordKeyResult &&
+                    context.recordKeyResult.success &&
+                    isAllowedRecordKeyResource(request.resourceKind, request.action)) {
+                    if (context.subjectPolicy === 'subjectfull' &&
+                        subjectType === 'user' &&
+                        !subjectId) {
+                        return {
+                            success: false,
+                            errorCode: 'not_logged_in',
+                            errorMessage: 'You must be logged in in order to use this record key.',
+                        };
+                    }
+                    return {
+                        success: true,
+                        recordName: context.recordName,
+                        permission: {
+                            id: null,
+                            recordName: recordName,
+                            userId: null,
+                            // Record owners are treated as if they are admins in the record
+                            subjectType: 'role',
+                            subjectId: ADMIN_ROLE_NAME,
+                            // Admins get all access to all resources in a record
+                            resourceKind: request.resourceKind,
+                            action: request.action,
+                            marker: markers[0],
+                            options: {},
+                            expireTimeMs: null,
+                        },
+                        explanation: 'A recordKey was used.',
                     };
                 }
-                const policy = policyResult;
-                let hasUpdate = false;
-                for (let i = 0; i < policy.document.permissions.length; i++) {
-                    const p = policy.document.permissions[i];
-                    if (isEqual(p, request.permission)) {
-                        hasUpdate = true;
-                        policy.document.permissions.splice(i, 1);
-                        i--;
+                if (subjectType === 'user' && subjectId) {
+                    if (subjectId === context.recordOwnerId) {
+                        return {
+                            success: true,
+                            recordName: recordName,
+                            permission: {
+                                id: null,
+                                recordName: recordName,
+                                userId: null,
+                                // Record owners are treated as if they are admins in the record
+                                subjectType: 'role',
+                                subjectId: ADMIN_ROLE_NAME,
+                                // Admins get all access to all resources in a record
+                                resourceKind: null,
+                                action: null,
+                                marker: markers[0],
+                                options: {},
+                                expireTimeMs: null,
+                            },
+                            explanation: 'User is the owner of the record.',
+                        };
+                    }
+                    else if (context.recordStudioMembers) {
+                        const member = context.recordStudioMembers.find((m) => m.userId === subjectId);
+                        if (member) {
+                            if (member.role === 'admin') {
+                                return {
+                                    success: true,
+                                    recordName: recordName,
+                                    permission: {
+                                        id: null,
+                                        recordName: recordName,
+                                        userId: null,
+                                        // Admins in a studio are treated as if they are admins in the record.
+                                        subjectType: 'role',
+                                        subjectId: ADMIN_ROLE_NAME,
+                                        // Admins get all access to all resources in a record
+                                        resourceKind: null,
+                                        action: null,
+                                        marker: markers[0],
+                                        options: {},
+                                        // No expiration
+                                        expireTimeMs: null,
+                                    },
+                                    explanation: "User is an admin in the record's studio.",
+                                };
+                            }
+                            else if (member.role === 'member' &&
+                                isAllowedStudioMemberResource(request.resourceKind, request.action)) {
+                                return {
+                                    success: true,
+                                    recordName: recordName,
+                                    permission: {
+                                        id: null,
+                                        recordName: recordName,
+                                        // Members in a studio are treated as if they are granted direct access to most resources
+                                        // in the record.
+                                        userId: subjectId,
+                                        subjectType: 'user',
+                                        subjectId: subjectId,
+                                        // Not all actions or resources are granted though
+                                        resourceKind: request.resourceKind,
+                                        action: request.action,
+                                        marker: markers[0],
+                                        options: {},
+                                        expireTimeMs: null,
+                                    },
+                                    explanation: "User is a member in the record's studio.",
+                                };
+                            }
+                        }
                     }
                 }
-                if (hasUpdate) {
-                    console.log(`[PolicyController] Removing permission from policy for ${context.context.recordName} and ${request.marker}.`, request.permission);
-                    const updateResult = yield this._policies.updateUserPolicy(context.context.recordName, request.marker, {
-                        document: policy.document,
-                        markers: policy.markers,
-                    });
-                    if (updateResult.success === false) {
-                        console.log(`[PolicyController] Policy update failed:`, updateResult);
-                        return updateResult;
+                else if (subjectType === 'inst' && subjectId) {
+                    const instId = parseInstId(subjectId);
+                    if (!instId) {
+                        return {
+                            success: false,
+                            errorCode: 'unacceptable_request',
+                            errorMessage: 'Invalid inst ID. It must contain a forward slash',
+                        };
+                    }
+                    if (instId.recordName) {
+                        if (instId.recordName === recordName) {
+                            return {
+                                success: true,
+                                recordName: recordName,
+                                permission: {
+                                    id: null,
+                                    recordName: recordName,
+                                    userId: null,
+                                    subjectType: 'inst',
+                                    subjectId: subjectId,
+                                    // resourceKind and action are specified
+                                    // because insts don't necessarily have all permissions in the record
+                                    resourceKind: request.resourceKind,
+                                    action: request.action,
+                                    marker: markers[0],
+                                    options: {},
+                                    expireTimeMs: null,
+                                },
+                                explanation: `Inst is owned by the record.`,
+                            };
+                        }
+                        const instRecord = yield this._records.validateRecordName(instId.recordName, context.userId);
+                        if (instRecord.success === false) {
+                            return instRecord;
+                        }
+                        else if (instRecord.ownerId &&
+                            instRecord.ownerId === context.recordOwnerId) {
+                            return {
+                                success: true,
+                                recordName: recordName,
+                                permission: {
+                                    id: null,
+                                    recordName: recordName,
+                                    userId: null,
+                                    subjectType: 'inst',
+                                    subjectId: subjectId,
+                                    // resourceKind and action are specified
+                                    // because insts don't necessarily have all permissions in the record
+                                    resourceKind: request.resourceKind,
+                                    action: request.action,
+                                    marker: markers[0],
+                                    options: {},
+                                    expireTimeMs: null,
+                                },
+                                explanation: `Inst is owned by the record's (${recordName}) owner (${context.recordOwnerId}).`,
+                            };
+                        }
+                        else if (instRecord.studioId &&
+                            instRecord.studioId === context.recordStudioId) {
+                            return {
+                                success: true,
+                                recordName: recordName,
+                                permission: {
+                                    id: null,
+                                    recordName: recordName,
+                                    userId: null,
+                                    subjectType: 'inst',
+                                    subjectId: subjectId,
+                                    // resourceKind and action are specified
+                                    // because insts don't necessarily have all permissions in the record
+                                    resourceKind: request.resourceKind,
+                                    action: request.action,
+                                    marker: markers[0],
+                                    options: {},
+                                    expireTimeMs: null,
+                                },
+                                explanation: `Inst is owned by the record's (${recordName}) studio (${context.recordStudioId}).`,
+                            };
+                        }
+                    }
+                }
+                if (subjectId) {
+                    if (subjectType === 'inst' || subjectType === 'user') {
+                        // check for admin role
+                        const roles = subjectType === 'user'
+                            ? yield this._policies.listRolesForUser(recordName, subjectId)
+                            : yield this._policies.listRolesForInst(recordName, subjectId);
+                        const role = roles.find((r) => r.role === ADMIN_ROLE_NAME);
+                        if (role) {
+                            const kindString = subjectType === 'user' ? 'User' : 'Inst';
+                            return {
+                                success: true,
+                                recordName: recordName,
+                                permission: {
+                                    id: null,
+                                    recordName: recordName,
+                                    userId: null,
+                                    // Admins in a studio are treated as if they are admins in the record.
+                                    subjectType: 'role',
+                                    subjectId: ADMIN_ROLE_NAME,
+                                    // Admins get all access to all resources in a record
+                                    resourceKind: null,
+                                    action: null,
+                                    marker: markers[0],
+                                    options: {},
+                                    // No expiration
+                                    expireTimeMs: role.expireTimeMs,
+                                },
+                                explanation: `${kindString} is assigned the "${ADMIN_ROLE_NAME}" role.`,
+                            };
+                        }
+                    }
+                    let permission = null;
+                    if (request.resourceId) {
+                        const result = yield this._policies.getPermissionForSubjectAndResource(subjectType, subjectId, recordName, request.resourceKind, request.resourceId, request.action, Date.now());
+                        if (result.success === false) {
+                            return result;
+                        }
+                        permission = result.permissionAssignment;
+                    }
+                    if (!permission) {
+                        const result = yield this._policies.getPermissionForSubjectAndMarkers(subjectType, subjectId, recordName, request.resourceKind, markers, request.action, Date.now());
+                        if (result.success === false) {
+                            return result;
+                        }
+                        permission = result.permissionAssignment;
+                    }
+                    if (permission) {
+                        return {
+                            success: true,
+                            recordName,
+                            permission: permission,
+                            explanation: explainationForPermissionAssignment(subjectType, permission),
+                        };
                     }
                 }
+                if (!subjectId &&
+                    (!context.recordKeyProvided ||
+                        !isAllowedRecordKeyResource(request.resourceKind, request.action))) {
+                    return {
+                        success: false,
+                        errorCode: 'not_logged_in',
+                        errorMessage: 'The user must be logged in. Please provide a sessionKey or a recordKey.',
+                    };
+                }
                 return {
-                    success: true,
+                    success: false,
+                    errorCode: 'not_authorized',
+                    errorMessage: 'You are not authorized to perform this action.',
+                    reason: {
+                        type: 'missing_permission',
+                        recordName: recordName,
+                        subjectType: subjectType,
+                        subjectId: subjectId,
+                        resourceKind: request.resourceKind,
+                        resourceId: request.resourceId,
+                        action: request.action,
+                    },
                 };
             }
             catch (err) {
-                console.error('[PolicyController] A server error occurred.', err);
+                console.error('[PolicyController] A server error occurred while authorizing a subject.', err);
                 return {
                     success: false,
                     errorCode: 'server_error',
@@ -308,45 +892,65 @@ export class PolicyController {
         });
     }
     /**
-     * Attempts to read the policy for a marker.
-     * @param recordKeyOrRecordName The record key or record name.
-     * @param userId The ID of the user that is currently logged in.
-     * @param marker The marker.
-     * @param instances The instances that the request is being made from.
+     * Gets the list of permissions in the given record.
+     * @param recordKeyOrRecordName The name of the record.
+     * @param userId The ID of the currently logged in user.
+     * @param instances The instances that are loaded.
      */
-    readUserPolicy(recordKeyOrRecordName, userId, marker, instances) {
+    listPermissions(recordKeyOrRecordName, userId, instances) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                const baseRequest = {
-                    recordKeyOrRecordName: recordKeyOrRecordName,
-                    userId: userId,
-                };
-                const context = yield this.constructAuthorizationContext(baseRequest);
+                const context = yield this.constructAuthorizationContext({
+                    recordKeyOrRecordName,
+                    userId,
+                });
                 if (context.success === false) {
-                    return {
-                        success: false,
-                        errorCode: context.errorCode,
-                        errorMessage: context.errorMessage,
-                    };
+                    return context;
+                }
+                const authorization = yield this.authorizeUserAndInstances(context.context, {
+                    userId,
+                    instances,
+                    resourceKind: 'marker',
+                    action: 'list',
+                    markers: [ACCOUNT_MARKER],
+                });
+                if (authorization.success === false) {
+                    return authorization;
                 }
-                // Fetch the policy before authorizing because we will need to know which
-                // markers are applied to the policy
-                const result = yield this._policies.getUserPolicy(context.context.recordName, marker);
+                const recordName = context.context.recordName;
+                const result = yield this._policies.listPermissionsInRecord(recordName);
                 if (result.success === false) {
                     return result;
                 }
-                const authorization = yield this.authorizeRequestUsingContext(context.context, Object.assign(Object.assign({ action: 'policy.read' }, baseRequest), { policy: marker, instances }));
-                if (authorization.allowed === false) {
-                    return returnAuthorizationResult(authorization);
-                }
                 return {
                     success: true,
-                    document: result.document,
-                    markers: result.markers,
+                    recordName,
+                    resourcePermissions: result.resourceAssignments.map((r) => ({
+                        id: r.id,
+                        recordName: r.recordName,
+                        subjectType: r.subjectType,
+                        subjectId: r.subjectId,
+                        resourceKind: r.resourceKind,
+                        action: r.action,
+                        resourceId: r.resourceId,
+                        options: r.options,
+                        expireTimeMs: r.expireTimeMs,
+                    })),
+                    markerPermissions: result.markerAssignments.map((r) => ({
+                        id: r.id,
+                        recordName: r.recordName,
+                        subjectType: r.subjectType,
+                        subjectId: r.subjectId,
+                        resourceKind: r.resourceKind,
+                        action: r.action,
+                        marker: r.marker,
+                        options: r.options,
+                        expireTimeMs: r.expireTimeMs,
+                    })),
                 };
             }
             catch (err) {
-                console.error('[PolicyController] A server error occurred.', err);
+                console.error('[PolicyController] A server error occurred while listing permissions.', err);
                 return {
                     success: false,
                     errorCode: 'server_error',
@@ -356,43 +960,53 @@ export class PolicyController {
         });
     }
     /**
-     * Attempts to list the policies for a record.
-     * @param recordKeyOrRecordName The record key or the name of the record.
-     * @param userId The ID of the user that is currently logged in.
-     * @param startingMarker The marker that policies should be returned after.
-     * @param instances The instances that the request is being made from.
+     * Gets the list of permissions that have been assigned to the given marker.
+     * @param recordKeyOrRecordName The name of the record.
+     * @param marker The marker that the permissions should be listed for.
+     * @param userId The ID of the currently logged in user.
+     * @param instances The instances that are loaded.
      */
-    listUserPolicies(recordKeyOrRecordName, userId, startingMarker, instances) {
+    listPermissionsForMarker(recordKeyOrRecordName, marker, userId, instances) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                const baseRequest = {
-                    recordKeyOrRecordName: recordKeyOrRecordName,
-                    userId: userId,
-                };
-                const context = yield this.constructAuthorizationContext(baseRequest);
+                marker = getRootMarker(marker);
+                const context = yield this.constructAuthorizationContext({
+                    recordKeyOrRecordName,
+                    userId,
+                });
                 if (context.success === false) {
-                    return {
-                        success: false,
-                        errorCode: context.errorCode,
-                        errorMessage: context.errorMessage,
-                    };
-                }
-                const authorization = yield this.authorizeRequestUsingContext(context.context, Object.assign(Object.assign({ action: 'policy.list' }, baseRequest), { instances }));
-                if (authorization.allowed === false) {
-                    return returnAuthorizationResult(authorization);
-                }
-                const result = yield this._policies.listUserPolicies(context.context.recordName, startingMarker);
-                if (!result.success) {
-                    return result;
+                    return context;
+                }
+                const authorization = yield this.authorizeUserAndInstances(context.context, {
+                    userId,
+                    instances,
+                    resourceKind: 'marker',
+                    action: 'list',
+                    markers: [ACCOUNT_MARKER],
+                });
+                if (authorization.success === false) {
+                    return authorization;
                 }
+                const recordName = context.context.recordName;
+                const result = yield this._policies.listPermissionsForMarker(recordName, marker);
                 return {
                     success: true,
-                    policies: result.policies,
-                    totalCount: result.totalCount,
+                    recordName,
+                    markerPermissions: result.map((r) => ({
+                        id: r.id,
+                        recordName: r.recordName,
+                        subjectType: r.subjectType,
+                        subjectId: r.subjectId,
+                        resourceKind: r.resourceKind,
+                        action: r.action,
+                        marker: r.marker,
+                        options: r.options,
+                        expireTimeMs: r.expireTimeMs,
+                    })),
                 };
             }
             catch (err) {
-                console.error('[PolicyController] A server error occurred.', err);
+                console.error('[PolicyController] A server error occurred while listing permissions for marker.', err);
                 return {
                     success: false,
                     errorCode: 'server_error',
@@ -402,20 +1016,328 @@ export class PolicyController {
         });
     }
     /**
-     * Attempts to list the roles that are assigned to a user.
-     * @param recordKeyOrRecordName The record key or the name of the record.
-     * @param userId The ID of the user that is currently logged in.
-     * @param subjectId The ID of the user whose roles should be listed.
-     * @param instances The instances that the request is being made from.
+     * Gets the list of permissions that have been assigned to the given marker.
+     * @param recordKeyOrRecordName The name of the record.
+     * @param resourceKind The kind of the resource.
+     * @param resourceId The ID of the resource.
+     * @param userId The ID of the currently logged in user.
+     * @param instances The instances that are loaded.
      */
-    listUserRoles(recordKeyOrRecordName, userId, subjectId, instances) {
+    listPermissionsForResource(recordKeyOrRecordName, resourceKind, resourceId, userId, instances) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                const baseRequest = {
-                    recordKeyOrRecordName: recordKeyOrRecordName,
-                    userId: userId,
-                };
-                const context = yield this.constructAuthorizationContext(baseRequest);
+                const context = yield this.constructAuthorizationContext({
+                    recordKeyOrRecordName,
+                    userId,
+                });
+                if (context.success === false) {
+                    return context;
+                }
+                const authorization = yield this.authorizeUserAndInstances(context.context, {
+                    userId,
+                    instances,
+                    resourceKind: 'marker',
+                    action: 'list',
+                    markers: [ACCOUNT_MARKER],
+                });
+                if (authorization.success === false) {
+                    return authorization;
+                }
+                const recordName = context.context.recordName;
+                const result = yield this._policies.listPermissionsForResource(recordName, resourceKind, resourceId);
+                return {
+                    success: true,
+                    recordName,
+                    resourcePermissions: result.map((r) => ({
+                        id: r.id,
+                        recordName: r.recordName,
+                        subjectType: r.subjectType,
+                        subjectId: r.subjectId,
+                        resourceKind: r.resourceKind,
+                        action: r.action,
+                        resourceId: r.resourceId,
+                        options: r.options,
+                        expireTimeMs: r.expireTimeMs,
+                    })),
+                };
+            }
+            catch (err) {
+                console.error('[PolicyController] A server error occurred while listing permissions for resource.', err);
+                return {
+                    success: false,
+                    errorCode: 'server_error',
+                    errorMessage: 'A server error occurred.',
+                };
+            }
+        });
+    }
+    /**
+     * Attempts to grant a permission to a marker.
+     * @param request The request for the operation.
+     */
+    grantMarkerPermission(request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const baseRequest = {
+                    recordKeyOrRecordName: request.recordKeyOrRecordName,
+                    userId: request.userId,
+                };
+                const context = yield this.constructAuthorizationContext(baseRequest);
+                if (context.success === false) {
+                    return {
+                        success: false,
+                        errorCode: context.errorCode,
+                        errorMessage: context.errorMessage,
+                    };
+                }
+                const marker = getRootMarker(request.marker);
+                const authorization = yield this.authorizeUserAndInstances(context.context, {
+                    action: 'grantPermission',
+                    resourceKind: 'marker',
+                    resourceId: marker,
+                    markers: [ACCOUNT_MARKER],
+                    userId: request.userId,
+                    instances: request.instances,
+                });
+                if (authorization.success === false) {
+                    return authorization;
+                }
+                const recordName = context.context.recordName;
+                const assignmentResult = yield this._policies.assignPermissionToSubjectAndMarker(recordName, request.permission.subjectType, request.permission.subjectId, request.permission.resourceKind, marker, request.permission.action, request.permission.options, request.permission.expireTimeMs);
+                if (assignmentResult.success === false) {
+                    return assignmentResult;
+                }
+                return {
+                    success: true,
+                };
+            }
+            catch (err) {
+                console.error('[PolicyController] A server error occurred while granting a marker permission.', err);
+                return {
+                    success: false,
+                    errorCode: 'server_error',
+                    errorMessage: 'A server error occurred.',
+                };
+            }
+        });
+    }
+    /**
+     * Attempts to revoke a permission from a marker.
+     * @param request The request for the operation.
+     */
+    revokeMarkerPermission(request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const permission = yield this._policies.getMarkerPermissionAssignmentById(request.permissionId);
+                if (!permission) {
+                    return {
+                        success: false,
+                        errorCode: 'permission_not_found',
+                        errorMessage: 'The permission was not found.',
+                    };
+                }
+                const baseRequest = {
+                    recordKeyOrRecordName: permission.recordName,
+                    userId: request.userId,
+                };
+                const context = yield this.constructAuthorizationContext(baseRequest);
+                if (context.success === false) {
+                    return {
+                        success: false,
+                        errorCode: context.errorCode,
+                        errorMessage: context.errorMessage,
+                    };
+                }
+                const authorization = yield this.authorizeUserAndInstances(context.context, {
+                    action: 'revokePermission',
+                    resourceKind: 'marker',
+                    resourceId: permission.marker,
+                    markers: [ACCOUNT_MARKER],
+                    userId: request.userId,
+                    instances: request.instances,
+                });
+                if (authorization.success === false) {
+                    return authorization;
+                }
+                const deleteResult = yield this._policies.deleteMarkerPermissionAssignmentById(permission.id);
+                if (!deleteResult.success) {
+                    return deleteResult;
+                }
+                return {
+                    success: true,
+                };
+            }
+            catch (err) {
+                console.error('[PolicyController] A server error occurred while revoking a marker permission.', err);
+                return {
+                    success: false,
+                    errorCode: 'server_error',
+                    errorMessage: 'A server error occurred.',
+                };
+            }
+        });
+    }
+    /**
+     * Attempts to grant a permission to a resource.
+     * @param request The request.
+     */
+    grantResourcePermission(request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const baseRequest = {
+                    recordKeyOrRecordName: request.recordKeyOrRecordName,
+                    userId: request.userId,
+                };
+                const context = yield this.constructAuthorizationContext(baseRequest);
+                if (context.success === false) {
+                    return {
+                        success: false,
+                        errorCode: context.errorCode,
+                        errorMessage: context.errorMessage,
+                    };
+                }
+                if (!request.permission.resourceId) {
+                    return {
+                        success: false,
+                        errorCode: 'unacceptable_request',
+                        errorMessage: 'You must provide a resourceId for the permission.',
+                    };
+                }
+                else if (!request.permission.resourceKind) {
+                    return {
+                        success: false,
+                        errorCode: 'unacceptable_request',
+                        errorMessage: 'You must provide a resourceKind for the permission.',
+                    };
+                }
+                const authorization = yield this.authorizeUserAndInstances(context.context, {
+                    action: 'grantPermission',
+                    // Resource permissions require access to the "account" marker
+                    // because there is currently no other marker that would make sense
+                    // for per-resource permissions.
+                    resourceKind: 'marker',
+                    resourceId: ACCOUNT_MARKER,
+                    markers: [ACCOUNT_MARKER],
+                    userId: request.userId,
+                    instances: request.instances,
+                });
+                if (authorization.success === false) {
+                    return authorization;
+                }
+                const recordName = context.context.recordName;
+                const assignmentResult = yield this._policies.assignPermissionToSubjectAndResource(recordName, request.permission.subjectType, request.permission.subjectId, request.permission.resourceKind, request.permission.resourceId, request.permission.action, request.permission.options, request.permission.expireTimeMs);
+                if (assignmentResult.success === false) {
+                    return assignmentResult;
+                }
+                return {
+                    success: true,
+                };
+            }
+            catch (err) {
+                console.error('[PolicyController] A server error occurred while granting a resource permission.', err);
+                return {
+                    success: false,
+                    errorCode: 'server_error',
+                    errorMessage: 'A server error occurred.',
+                };
+            }
+        });
+    }
+    /**
+     * Attempts to revoke a permission from a resource.
+     * @param request The request for the operation.
+     */
+    revokeResourcePermission(request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const permission = yield this._policies.getResourcePermissionAssignmentById(request.permissionId);
+                if (!permission) {
+                    return {
+                        success: false,
+                        errorCode: 'permission_not_found',
+                        errorMessage: 'The permission was not found.',
+                    };
+                }
+                const baseRequest = {
+                    recordKeyOrRecordName: permission.recordName,
+                    userId: request.userId,
+                };
+                const context = yield this.constructAuthorizationContext(baseRequest);
+                if (context.success === false) {
+                    return {
+                        success: false,
+                        errorCode: context.errorCode,
+                        errorMessage: context.errorMessage,
+                    };
+                }
+                const authorization = yield this.authorizeUserAndInstances(context.context, {
+                    action: 'revokePermission',
+                    resourceKind: 'marker',
+                    resourceId: ACCOUNT_MARKER,
+                    markers: [ACCOUNT_MARKER],
+                    userId: request.userId,
+                    instances: request.instances,
+                });
+                if (authorization.success === false) {
+                    return authorization;
+                }
+                const deleteResult = yield this._policies.deleteResourcePermissionAssignmentById(permission.id);
+                if (!deleteResult.success) {
+                    return deleteResult;
+                }
+                return {
+                    success: true,
+                };
+            }
+            catch (err) {
+                console.error('[PolicyController] A server error occurred while revoking a resource permission.', err);
+                return {
+                    success: false,
+                    errorCode: 'server_error',
+                    errorMessage: 'A server error occurred.',
+                };
+            }
+        });
+    }
+    /**
+     * Attempts to revoke the permission with the given ID.
+     * @param request The request for the operation.
+     */
+    revokePermission(request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const markerResult = yield this.revokeMarkerPermission(request);
+                if (markerResult.success === false &&
+                    markerResult.errorCode === 'permission_not_found') {
+                    return yield this.revokeResourcePermission(request);
+                }
+                return markerResult;
+            }
+            catch (err) {
+                console.error('[PolicyController] A server error occurred while revoking a permission.', err);
+                return {
+                    success: false,
+                    errorCode: 'server_error',
+                    errorMessage: 'A server error occurred.',
+                };
+            }
+        });
+    }
+    /**
+     * Attempts to list the roles that are assigned to a user.
+     * @param recordKeyOrRecordName The record key or the name of the record.
+     * @param userId The ID of the user that is currently logged in.
+     * @param subjectId The ID of the user whose roles should be listed.
+     * @param instances The instances that the request is being made from.
+     */
+    listUserRoles(recordKeyOrRecordName, userId, subjectId, instances) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const baseRequest = {
+                    recordKeyOrRecordName: recordKeyOrRecordName,
+                    userId: userId,
+                };
+                const context = yield this.constructAuthorizationContext(baseRequest);
                 if (context.success === false) {
                     return {
                         success: false,
@@ -424,9 +1346,15 @@ export class PolicyController {
                     };
                 }
                 if (userId !== subjectId || (!!instances && instances.length > 0)) {
-                    const authorization = yield this.authorizeRequestUsingContext(context.context, Object.assign(Object.assign({ action: 'role.list' }, baseRequest), { instances }));
-                    if (authorization.allowed === false) {
-                        return returnAuthorizationResult(authorization);
+                    const authorization = yield this.authorizeUserAndInstances(context.context, {
+                        resourceKind: 'role',
+                        action: 'list',
+                        markers: [ACCOUNT_MARKER],
+                        userId: userId,
+                        instances: instances,
+                    });
+                    if (authorization.success === false) {
+                        return authorization;
                     }
                 }
                 const result = yield this._policies.listRolesForUser(context.context.recordName, subjectId);
@@ -467,11 +1395,17 @@ export class PolicyController {
                         errorMessage: context.errorMessage,
                     };
                 }
-                const authorization = yield this.authorizeRequestUsingContext(context.context, Object.assign(Object.assign({ action: 'role.list' }, baseRequest), { instances }));
-                if (authorization.allowed === false) {
-                    return returnAuthorizationResult(authorization);
+                const authorization = yield this.authorizeUserAndInstances(context.context, {
+                    resourceKind: 'role',
+                    action: 'list',
+                    markers: [ACCOUNT_MARKER],
+                    userId: userId,
+                    instances: instances,
+                });
+                if (authorization.success === false) {
+                    return authorization;
                 }
-                const result = yield this._policies.listRolesForInst(context.context.recordName, subjectId);
+                const result = yield this._policies.listRolesForInst(context.context.recordName, normalizeInstId(subjectId));
                 return {
                     success: true,
                     roles: sortBy(result, (r) => r.role),
@@ -509,9 +1443,15 @@ export class PolicyController {
                         errorMessage: context.errorMessage,
                     };
                 }
-                const authorization = yield this.authorizeRequestUsingContext(context.context, Object.assign(Object.assign({ action: 'role.list' }, baseRequest), { instances }));
-                if (authorization.allowed === false) {
-                    return returnAuthorizationResult(authorization);
+                const authorization = yield this.authorizeUserAndInstances(context.context, {
+                    resourceKind: 'role',
+                    action: 'list',
+                    markers: [ACCOUNT_MARKER],
+                    userId: userId,
+                    instances: instances,
+                });
+                if (authorization.success === false) {
+                    return authorization;
                 }
                 const result = yield this._policies.listAssignmentsForRole(context.context.recordName, role);
                 return {
@@ -558,9 +1498,15 @@ export class PolicyController {
                         errorMessage: context.errorMessage,
                     };
                 }
-                const authorization = yield this.authorizeRequestUsingContext(context.context, Object.assign(Object.assign({ action: 'role.list' }, baseRequest), { instances }));
-                if (authorization.allowed === false) {
-                    return returnAuthorizationResult(authorization);
+                const authorization = yield this.authorizeUserAndInstances(context.context, {
+                    resourceKind: 'role',
+                    action: 'list',
+                    markers: [ACCOUNT_MARKER],
+                    userId: userId,
+                    instances: instances,
+                });
+                if (authorization.success === false) {
+                    return authorization;
                 }
                 const result = yield this._policies.listAssignments(context.context.recordName, startingRole);
                 return {
@@ -603,13 +1549,18 @@ export class PolicyController {
                 }
                 const recordName = context.context.recordName;
                 const targetUserId = request.userId;
-                const targetInstance = request.instance;
+                const targetInstance = normalizeInstId(request.instance);
                 const expireTimeMs = getExpireTime(request.expireTimeMs);
-                const authorization = yield this.authorizeRequestUsingContext(context.context, Object.assign(Object.assign({ action: 'role.grant' }, baseRequest), { instances, role: request.role, targetUserId,
-                    targetInstance,
-                    expireTimeMs }));
-                if (authorization.allowed === false) {
-                    return returnAuthorizationResult(authorization);
+                const authorization = yield this.authorizeUserAndInstances(context.context, {
+                    resourceKind: 'role',
+                    action: 'grant',
+                    resourceId: request.role,
+                    markers: [ACCOUNT_MARKER],
+                    userId: userId,
+                    instances: instances,
+                });
+                if (authorization.success === false) {
+                    return authorization;
                 }
                 if (targetUserId) {
                     const result = yield this._policies.assignSubjectRole(recordName, targetUserId, 'user', {
@@ -675,11 +1626,17 @@ export class PolicyController {
                 }
                 const recordName = context.context.recordName;
                 const targetUserId = request.userId;
-                const targetInstance = request.instance;
-                const authorization = yield this.authorizeRequestUsingContext(context.context, Object.assign(Object.assign({ action: 'role.revoke' }, baseRequest), { instances, role: request.role, targetUserId,
-                    targetInstance }));
-                if (authorization.allowed === false) {
-                    return returnAuthorizationResult(authorization);
+                const targetInstance = normalizeInstId(request.instance);
+                const authorization = yield this.authorizeUserAndInstances(context.context, {
+                    resourceKind: 'role',
+                    action: 'revoke',
+                    resourceId: request.role,
+                    markers: [ACCOUNT_MARKER],
+                    userId: userId,
+                    instances: instances,
+                });
+                if (authorization.success === false) {
+                    return authorization;
                 }
                 if (targetUserId) {
                     const result = yield this._policies.revokeSubjectRole(recordName, targetUserId, 'user', request.role);
@@ -715,2642 +1672,6 @@ export class PolicyController {
             }
         });
     }
-    /**
-     * Attempts to authorize the given request.
-     * Returns a promise that resolves with information about the security properties of the request.
-     * @param context The authorization context for the request.
-     * @param request The request.
-     */
-    _authorizeRequestUsingContext(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (request.action === 'data.create') {
-                return this._authorizeDataCreateRequest(context, request);
-            }
-            else if (request.action === 'data.read') {
-                return this._authorizeDataReadRequest(context, request);
-            }
-            else if (request.action === 'data.update') {
-                return this._authorizeDataUpdateRequest(context, request);
-            }
-            else if (request.action === 'data.delete') {
-                return this._authorizeDataDeleteRequest(context, request);
-            }
-            else if (request.action === 'data.list') {
-                return this._authorizeDataListRequest(context, request);
-            }
-            else if (request.action === 'file.create') {
-                return this._authorizeFileCreateRequest(context, request);
-            }
-            else if (request.action === 'file.read') {
-                return this._authorizeFileReadRequest(context, request);
-            }
-            else if (request.action === 'file.list') {
-                return this._authorizeFileListRequest(context, request);
-            }
-            else if (request.action === 'file.update') {
-                return this._authorizeFileUpdateRequest(context, request);
-            }
-            else if (request.action === 'file.delete') {
-                return this._authorizeFileDeleteRequest(context, request);
-            }
-            else if (request.action === 'event.count') {
-                return this._authorizeEventCountRequest(context, request);
-            }
-            else if (request.action === 'event.increment') {
-                return this._authorizeEventIncrementRequest(context, request);
-            }
-            else if (request.action === 'event.update') {
-                return this._authorizeEventUpdateRequest(context, request);
-            }
-            else if (request.action === 'event.list') {
-                return this._authorizeEventListRequest(context, request);
-            }
-            else if (request.action === 'policy.grantPermission') {
-                return this._authorizePolicyGrantPermissionRequest(context, request);
-            }
-            else if (request.action === 'policy.revokePermission') {
-                return this._authorizePolicyRevokePermissionRequest(context, request);
-            }
-            else if (request.action === 'policy.read') {
-                return this._authorizePolicyReadRequest(context, request);
-            }
-            else if (request.action === 'policy.list') {
-                return this._authorizePolicyListRequest(context, request);
-            }
-            else if (request.action === 'role.list') {
-                return this._authorizeRoleListRequest(context, request);
-            }
-            else if (request.action === 'role.read') {
-                return this._authorizeRoleReadRequest(context, request);
-            }
-            else if (request.action === 'role.grant') {
-                return this._authorizeRoleGrantRequest(context, request);
-            }
-            else if (request.action === 'role.revoke') {
-                return this._authorizeRoleRevokeRequest(context, request);
-            }
-            else if (request.action === 'inst.create') {
-                return this._authorizeInstCreateRequest(context, request);
-            }
-            else if (request.action === 'inst.read') {
-                return this._authorizeInstReadRequest(context, request);
-            }
-            else if (request.action === 'inst.update') {
-                return this._authorizeInstUpdateRequest(context, request);
-            }
-            else if (request.action === 'inst.updateData') {
-                return this._authorizeInstUpdateDataRequest(context, request);
-            }
-            else if (request.action === 'inst.delete') {
-                return this._authorizeInstDeleteRequest(context, request);
-            }
-            else if (request.action === 'inst.list') {
-                return this._authorizeInstListRequest(context, request);
-            }
-            else if (request.action === 'inst.sendAction') {
-                return this._authorizeInstSendActionRequest(context, request);
-            }
-            return {
-                allowed: false,
-                errorCode: 'action_not_supported',
-                errorMessage: 'The given action is not supported.',
-            };
-        });
-    }
-    _authorizeDataCreateRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this._authorizeRequest(context, request, request.resourceMarkers, (context, type, id) => {
-                return this._authorizeCreateData(context, type, id);
-            });
-        });
-    }
-    /**
-     * Authorizes the given subject for data.create requests.
-     *
-     * @param context The context for the authorization.
-     * @param subjectType The type of subject that is being authorized.
-     * @param id The ID of the subject.
-     * @returns The authorization that approves the subject for the request. Null if the subject is not authorized.
-     */
-    _authorizeCreateData(context, subjectType, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const authorizations = [];
-            let role = null;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byData('data.create', context.request.address), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, subjectType, id), this._bySubjectRole(context, subjectType, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    return {
-                        success: false,
-                        reason: {
-                            type: 'missing_permission',
-                            kind: subjectType,
-                            id,
-                            marker: marker.marker,
-                            permission: 'data.create',
-                            role,
-                        },
-                    };
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                const policyPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byPolicy('policy.assign', marker.marker), this._some(this._byEveryoneRole(), this._byRole(actionPermission.permission.role))));
-                if (!policyPermission) {
-                    return {
-                        success: false,
-                        reason: {
-                            type: 'missing_permission',
-                            kind: subjectType,
-                            id,
-                            marker: marker.marker,
-                            permission: 'policy.assign',
-                            role,
-                        },
-                    };
-                }
-                authorizations.push({
-                    marker: marker.marker,
-                    actions: [
-                        {
-                            action: context.request.action,
-                            grantingPolicy: actionPermission.policy,
-                            grantingPermission: actionPermission.permission,
-                        },
-                        {
-                            action: 'policy.assign',
-                            grantingPolicy: policyPermission.policy,
-                            grantingPermission: policyPermission.permission,
-                        },
-                    ],
-                });
-            }
-            if (!role) {
-                return {
-                    success: false,
-                    reason: {
-                        type: 'missing_role',
-                    },
-                };
-            }
-            return {
-                success: true,
-                authorization: {
-                    role,
-                    markers: authorizations,
-                },
-            };
-        });
-    }
-    _authorizeDataReadRequest(context, request) {
-        return this._authorizeRequest(context, request, request.resourceMarkers, (context, type, id) => {
-            return this._authorizeDataRead(context, type, id);
-        });
-    }
-    _authorizeDataRead(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byData('data.read', context.request.address), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'data.read',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizeDataUpdateRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!willMarkersBeRemaining(request.existingMarkers, request.removedMarkers, request.addedMarkers)) {
-                return Object.assign(Object.assign({}, NOT_AUTHORIZED_RESULT), { reason: {
-                        type: 'no_markers_remaining',
-                    } });
-            }
-            return this._authorizeRequest(context, request, union(request.existingMarkers, request.addedMarkers, request.removedMarkers), (context, type, id) => {
-                return this._authorizeDataUpdate(context, type, id);
-            });
-        });
-    }
-    _authorizeDataUpdate(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let authorizations = [];
-            let role = null;
-            // The denial reason for if the user does not have permission from an existing marker.
-            let denialReason;
-            let hasPermissionFromExistingMarker = false;
-            for (let marker of context.markers) {
-                const isAddedMarker = context.request.addedMarkers &&
-                    context.request.addedMarkers.includes(marker.marker);
-                const isRemovedMarker = context.request.removedMarkers &&
-                    context.request.removedMarkers.includes(marker.marker);
-                const isExistingMarker = context.request.existingMarkers.includes(marker.marker);
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byData('data.update', context.request.address), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    if (isAddedMarker || isRemovedMarker) {
-                        // Deny because the user needs permission for all new & removed markers.
-                        return {
-                            success: false,
-                            reason: {
-                                type: 'missing_permission',
-                                kind: type,
-                                id,
-                                marker: marker.marker,
-                                permission: 'data.update',
-                                role,
-                            },
-                        };
-                    }
-                    else {
-                        // Record that the user does not have permission from this marker.
-                        // May or may not be used depending on if a different existing marker
-                        // provides permission.
-                        denialReason = {
-                            type: 'missing_permission',
-                            kind: type,
-                            id,
-                            marker: marker.marker,
-                            permission: 'data.update',
-                            role,
-                        };
-                        continue;
-                    }
-                }
-                if (isExistingMarker) {
-                    hasPermissionFromExistingMarker = true;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                const actions = [
-                    {
-                        action: context.request.action,
-                        grantingPolicy: actionPermission.policy,
-                        grantingPermission: actionPermission.permission,
-                    },
-                ];
-                if (isAddedMarker) {
-                    const policyPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byPolicy('policy.assign', marker.marker), this._some(this._byEveryoneRole(), this._byRole(actionPermission.permission.role))));
-                    if (!policyPermission) {
-                        return {
-                            success: false,
-                            reason: {
-                                type: 'missing_permission',
-                                kind: type,
-                                id,
-                                marker: marker.marker,
-                                permission: 'policy.assign',
-                                role,
-                            },
-                        };
-                        continue;
-                    }
-                    actions.push({
-                        action: 'policy.assign',
-                        grantingPolicy: policyPermission.policy,
-                        grantingPermission: policyPermission.permission,
-                    });
-                }
-                else if (isRemovedMarker) {
-                    const policyPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byPolicy('policy.unassign', marker.marker), this._some(this._byEveryoneRole(), this._byRole(actionPermission.permission.role))));
-                    if (!policyPermission) {
-                        return {
-                            success: false,
-                            reason: {
-                                type: 'missing_permission',
-                                kind: type,
-                                id,
-                                marker: marker.marker,
-                                permission: 'policy.unassign',
-                                role,
-                            },
-                        };
-                    }
-                    actions.push({
-                        action: 'policy.unassign',
-                        grantingPolicy: policyPermission.policy,
-                        grantingPermission: policyPermission.permission,
-                    });
-                }
-                authorizations.push({
-                    marker: marker.marker,
-                    actions,
-                });
-            }
-            // Deny the request if the user does not have permission from at least one existing marker.
-            if (!hasPermissionFromExistingMarker && denialReason) {
-                return {
-                    success: false,
-                    reason: denialReason,
-                };
-            }
-            if (!role) {
-                return {
-                    success: false,
-                    reason: {
-                        type: 'missing_role',
-                    },
-                };
-            }
-            return {
-                success: true,
-                authorization: {
-                    role,
-                    markers: authorizations,
-                },
-            };
-        });
-    }
-    _authorizeDataDeleteRequest(context, request) {
-        return this._authorizeRequest(context, request, request.resourceMarkers, (context, type, id) => {
-            return this._authorizeDataDelete(context, type, id);
-        });
-    }
-    _authorizeDataDelete(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byData('data.delete', context.request.address), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'data.delete',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizeDataListRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const allMarkers = union(...request.dataItems.map((i) => i.markers));
-            return yield this._authorizeRequest(context, request, allMarkers, (context, type, id) => {
-                return this._authorizeDataList(context, type, id);
-            }, undefined, true);
-        });
-    }
-    _authorizeDataList(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const authorizations = [];
-            let role = null;
-            const allowedDataItems = (context.allowedDataItems =
-                []);
-            const markers = new Map();
-            for (let marker of context.markers) {
-                const authorization = {
-                    marker: marker.marker,
-                    actions: [],
-                };
-                authorizations.push(authorization);
-                markers.set(marker.marker, {
-                    marker,
-                    authorization: authorization,
-                    usedPermissions: new Set(),
-                });
-            }
-            for (let item of context.request.dataItems) {
-                let itemPermission;
-                for (let m of item.markers) {
-                    const a = markers.get(m);
-                    if (!a) {
-                        continue;
-                    }
-                    const { marker, authorization, usedPermissions } = a;
-                    itemPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byData('data.list', item.address), role === null
-                        ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                        : this._byRole(role)));
-                    if (!itemPermission) {
-                        continue;
-                    }
-                    if (role === null) {
-                        role = itemPermission.permission.role;
-                    }
-                    if (!usedPermissions.has(itemPermission.permission)) {
-                        usedPermissions.add(itemPermission.permission);
-                        authorization.actions.push({
-                            action: context.request.action,
-                            grantingPolicy: itemPermission.policy,
-                            grantingPermission: itemPermission.permission,
-                        });
-                    }
-                    if (itemPermission) {
-                        break;
-                    }
-                }
-                if (itemPermission) {
-                    allowedDataItems.push(item);
-                }
-            }
-            if (!role) {
-                role = true;
-            }
-            return {
-                success: true,
-                authorization: {
-                    role,
-                    markers: authorizations,
-                },
-            };
-        });
-    }
-    _authorizeFileCreateRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this._authorizeRequest(context, request, request.resourceMarkers, (context, type, id) => {
-                return this._authorizeFileCreate(context, type, id);
-            });
-        });
-    }
-    _authorizeFileCreate(context, subjectType, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const authorizations = [];
-            let role = null;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byFile('file.create', context.request.fileSizeInBytes, context.request.fileMimeType), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, subjectType, id), this._bySubjectRole(context, subjectType, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    return {
-                        success: false,
-                        reason: {
-                            type: 'missing_permission',
-                            kind: subjectType,
-                            id,
-                            marker: marker.marker,
-                            permission: 'file.create',
-                            role,
-                        },
-                    };
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                const policyPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byPolicy('policy.assign', marker.marker), this._some(this._byEveryoneRole(), this._byRole(actionPermission.permission.role))));
-                if (!policyPermission) {
-                    return {
-                        success: false,
-                        reason: {
-                            type: 'missing_permission',
-                            kind: subjectType,
-                            id,
-                            marker: marker.marker,
-                            permission: 'policy.assign',
-                            role,
-                        },
-                    };
-                }
-                authorizations.push({
-                    marker: marker.marker,
-                    actions: [
-                        {
-                            action: context.request.action,
-                            grantingPolicy: actionPermission.policy,
-                            grantingPermission: actionPermission.permission,
-                        },
-                        {
-                            action: 'policy.assign',
-                            grantingPolicy: policyPermission.policy,
-                            grantingPermission: policyPermission.permission,
-                        },
-                    ],
-                });
-            }
-            if (!role) {
-                return {
-                    success: false,
-                    reason: {
-                        type: 'missing_role',
-                    },
-                };
-            }
-            return {
-                success: true,
-                authorization: {
-                    role,
-                    markers: authorizations,
-                },
-            };
-        });
-    }
-    _authorizeFileReadRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this._authorizeRequest(context, request, request.resourceMarkers, (context, type, id) => {
-                return this._authorizeFileRead(context, type, id);
-            });
-        });
-    }
-    _authorizeFileRead(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byFile('file.read', context.request.fileSizeInBytes, context.request.fileMimeType), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'file.read',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizeFileListRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const allMarkers = union(...request.fileItems.map((i) => i.markers));
-            return yield this._authorizeRequest(context, request, allMarkers, (context, type, id) => {
-                return this._authorizeFileList(context, type, id);
-            }, undefined, true);
-        });
-    }
-    _authorizeFileList(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const authorizations = [];
-            let role = null;
-            const allowedFileItems = (context.allowedFileItems =
-                []);
-            const markers = new Map();
-            for (let marker of context.markers) {
-                const authorization = {
-                    marker: marker.marker,
-                    actions: [],
-                };
-                authorizations.push(authorization);
-                markers.set(marker.marker, {
-                    marker,
-                    authorization: authorization,
-                    usedPermissions: new Set(),
-                });
-            }
-            for (let item of context.request.fileItems) {
-                let itemPermission;
-                for (let m of item.markers) {
-                    const a = markers.get(m);
-                    if (!a) {
-                        continue;
-                    }
-                    const { marker, authorization, usedPermissions } = a;
-                    itemPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byFile('file.list', item.fileSizeInBytes, item.fileMimeType), role === null
-                        ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                        : this._byRole(role)));
-                    if (!itemPermission) {
-                        continue;
-                    }
-                    if (role === null) {
-                        role = itemPermission.permission.role;
-                    }
-                    if (!usedPermissions.has(itemPermission.permission)) {
-                        usedPermissions.add(itemPermission.permission);
-                        authorization.actions.push({
-                            action: context.request.action,
-                            grantingPolicy: itemPermission.policy,
-                            grantingPermission: itemPermission.permission,
-                        });
-                    }
-                    if (itemPermission) {
-                        break;
-                    }
-                }
-                if (itemPermission) {
-                    allowedFileItems.push(item);
-                }
-            }
-            if (!role) {
-                role = true;
-            }
-            return {
-                success: true,
-                authorization: {
-                    role,
-                    markers: authorizations,
-                },
-            };
-        });
-    }
-    _authorizeFileUpdateRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const allMarkers = union(request.existingMarkers, request.addedMarkers, request.removedMarkers);
-            return yield this._authorizeRequest(context, request, allMarkers, (context, type, id) => {
-                return this._authorizeFileUpdate(context, type, id);
-            });
-        });
-    }
-    _authorizeFileUpdate(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if ((!context.request.addedMarkers ||
-                context.request.addedMarkers.length <= 0) &&
-                (!context.request.removedMarkers ||
-                    context.request.removedMarkers.length <= 0)) {
-                return {
-                    success: false,
-                    reason: {
-                        type: 'no_markers',
-                    },
-                };
-            }
-            if (!willMarkersBeRemaining(context.request.existingMarkers, context.request.removedMarkers, context.request.addedMarkers)) {
-                return {
-                    success: false,
-                    reason: {
-                        type: 'no_markers_remaining',
-                    },
-                };
-            }
-            const authorizations = [];
-            let role = null;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byFile('file.update', context.request.fileSizeInBytes, context.request.fileMimeType), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    return {
-                        success: false,
-                        reason: {
-                            type: 'missing_permission',
-                            kind: type,
-                            id,
-                            marker: marker.marker,
-                            permission: 'file.update',
-                            role,
-                        },
-                    };
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                const isAddedMarker = context.request.addedMarkers &&
-                    context.request.addedMarkers.includes(marker.marker);
-                const isRemovedMarker = context.request.removedMarkers &&
-                    context.request.removedMarkers.includes(marker.marker);
-                const actions = [
-                    {
-                        action: context.request.action,
-                        grantingPolicy: actionPermission.policy,
-                        grantingPermission: actionPermission.permission,
-                    },
-                ];
-                if (isAddedMarker) {
-                    const policyPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byPolicy('policy.assign', marker.marker), this._some(this._byEveryoneRole(), this._byRole(actionPermission.permission.role))));
-                    if (!policyPermission) {
-                        return {
-                            success: false,
-                            reason: {
-                                type: 'missing_permission',
-                                kind: type,
-                                id,
-                                marker: marker.marker,
-                                permission: 'policy.assign',
-                                role,
-                            },
-                        };
-                    }
-                    actions.push({
-                        action: 'policy.assign',
-                        grantingPolicy: policyPermission.policy,
-                        grantingPermission: policyPermission.permission,
-                    });
-                }
-                else if (isRemovedMarker) {
-                    const policyPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byPolicy('policy.unassign', marker.marker), this._some(this._byEveryoneRole(), this._byRole(actionPermission.permission.role))));
-                    if (!policyPermission) {
-                        return {
-                            success: false,
-                            reason: {
-                                type: 'missing_permission',
-                                kind: type,
-                                id,
-                                marker: marker.marker,
-                                permission: 'policy.unassign',
-                                role,
-                            },
-                        };
-                    }
-                    actions.push({
-                        action: 'policy.unassign',
-                        grantingPolicy: policyPermission.policy,
-                        grantingPermission: policyPermission.permission,
-                    });
-                }
-                authorizations.push({
-                    marker: marker.marker,
-                    actions,
-                });
-            }
-            if (!role) {
-                return {
-                    success: false,
-                    reason: {
-                        type: 'missing_role',
-                    },
-                };
-            }
-            return {
-                success: true,
-                authorization: {
-                    role,
-                    markers: authorizations,
-                },
-            };
-        });
-    }
-    _authorizeFileDeleteRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this._authorizeRequest(context, request, request.resourceMarkers, (context, type, id) => {
-                return this._authorizeFileDelete(context, type, id);
-            });
-        });
-    }
-    _authorizeFileDelete(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byFile('file.delete', context.request.fileSizeInBytes, context.request.fileMimeType), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'file.delete',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizeEventCountRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this._authorizeRequest(context, request, request.resourceMarkers, (context, type, id) => {
-                return this._authorizeEventCount(context, type, id);
-            });
-        });
-    }
-    _authorizeEventCount(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byEvent('event.count', context.request.eventName), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'event.count',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizeEventIncrementRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this._authorizeRequest(context, request, request.resourceMarkers, (context, type, id) => {
-                return this._authorizeEventIncrement(context, type, id);
-            });
-        });
-    }
-    _authorizeEventIncrement(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byEvent('event.increment', context.request.eventName), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'event.increment',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizeEventUpdateRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!willMarkersBeRemaining(request.existingMarkers, request.removedMarkers, request.addedMarkers)) {
-                return Object.assign(Object.assign({}, NOT_AUTHORIZED_RESULT), { reason: {
-                        type: 'no_markers_remaining',
-                    } });
-            }
-            return yield this._authorizeRequest(context, request, union(request.existingMarkers, request.addedMarkers, request.removedMarkers), (context, type, id) => {
-                return this._authorizeEventUpdate(context, type, id);
-            });
-        });
-    }
-    _authorizeEventUpdate(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let authorizations = [];
-            let role = null;
-            // The denial reason for if the user does not have permission from an existing marker.
-            let denialReason;
-            let hasPermissionFromExistingMarker = false;
-            for (let marker of context.markers) {
-                const isAddedMarker = context.request.addedMarkers &&
-                    context.request.addedMarkers.includes(marker.marker);
-                const isRemovedMarker = context.request.removedMarkers &&
-                    context.request.removedMarkers.includes(marker.marker);
-                const isExistingMarker = context.request.existingMarkers.includes(marker.marker);
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byEvent('event.update', context.request.eventName), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    if (isAddedMarker || isRemovedMarker) {
-                        // Deny because the user needs permission for all new & removed markers.
-                        return {
-                            success: false,
-                            reason: {
-                                type: 'missing_permission',
-                                kind: type,
-                                id,
-                                marker: marker.marker,
-                                permission: 'event.update',
-                                role,
-                            },
-                        };
-                    }
-                    else {
-                        // Record that the user does not have permission from this marker.
-                        // May or may not be used depending on if a different existing marker
-                        // provides permission.
-                        denialReason = {
-                            type: 'missing_permission',
-                            kind: type,
-                            id,
-                            marker: marker.marker,
-                            permission: 'event.update',
-                            role,
-                        };
-                        continue;
-                    }
-                }
-                if (isExistingMarker) {
-                    hasPermissionFromExistingMarker = true;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                const actions = [
-                    {
-                        action: context.request.action,
-                        grantingPolicy: actionPermission.policy,
-                        grantingPermission: actionPermission.permission,
-                    },
-                ];
-                if (isAddedMarker) {
-                    const policyPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byPolicy('policy.assign', marker.marker), this._some(this._byEveryoneRole(), this._byRole(actionPermission.permission.role))));
-                    if (!policyPermission) {
-                        return {
-                            success: false,
-                            reason: {
-                                type: 'missing_permission',
-                                kind: type,
-                                id,
-                                marker: marker.marker,
-                                permission: 'policy.assign',
-                                role,
-                            },
-                        };
-                        continue;
-                    }
-                    actions.push({
-                        action: 'policy.assign',
-                        grantingPolicy: policyPermission.policy,
-                        grantingPermission: policyPermission.permission,
-                    });
-                }
-                else if (isRemovedMarker) {
-                    const policyPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byPolicy('policy.unassign', marker.marker), this._some(this._byEveryoneRole(), this._byRole(actionPermission.permission.role))));
-                    if (!policyPermission) {
-                        return {
-                            success: false,
-                            reason: {
-                                type: 'missing_permission',
-                                kind: type,
-                                id,
-                                marker: marker.marker,
-                                permission: 'policy.unassign',
-                                role,
-                            },
-                        };
-                    }
-                    actions.push({
-                        action: 'policy.unassign',
-                        grantingPolicy: policyPermission.policy,
-                        grantingPermission: policyPermission.permission,
-                    });
-                }
-                authorizations.push({
-                    marker: marker.marker,
-                    actions,
-                });
-            }
-            // Deny the request if the user does not have permission from at least one existing marker.
-            if (!hasPermissionFromExistingMarker && denialReason) {
-                return {
-                    success: false,
-                    reason: denialReason,
-                };
-            }
-            if (!role) {
-                return {
-                    success: false,
-                    reason: {
-                        type: 'missing_role',
-                    },
-                };
-            }
-            return {
-                success: true,
-                authorization: {
-                    role,
-                    markers: authorizations,
-                },
-            };
-        });
-    }
-    _authorizeEventListRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const allMarkers = union(...request.eventItems.map((i) => i.markers));
-            return yield this._authorizeRequest(context, request, allMarkers, (context, type, id) => {
-                return this._authorizeEventList(context, type, id);
-            }, undefined, true);
-        });
-    }
-    _authorizeEventList(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const authorizations = [];
-            let role = null;
-            const allowedEventItems = (context.allowedEventItems =
-                []);
-            const markers = new Map();
-            for (let marker of context.markers) {
-                const authorization = {
-                    marker: marker.marker,
-                    actions: [],
-                };
-                authorizations.push(authorization);
-                markers.set(marker.marker, {
-                    marker,
-                    authorization: authorization,
-                    usedPermissions: new Set(),
-                });
-            }
-            for (let item of context.request.eventItems) {
-                let itemPermission;
-                for (let m of item.markers) {
-                    const a = markers.get(m);
-                    if (!a) {
-                        continue;
-                    }
-                    const { marker, authorization, usedPermissions } = a;
-                    itemPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byEvent('event.list', item.eventName), role === null
-                        ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                        : this._byRole(role)));
-                    if (!itemPermission) {
-                        continue;
-                    }
-                    if (role === null) {
-                        role = itemPermission.permission.role;
-                    }
-                    if (!usedPermissions.has(itemPermission.permission)) {
-                        usedPermissions.add(itemPermission.permission);
-                        authorization.actions.push({
-                            action: context.request.action,
-                            grantingPolicy: itemPermission.policy,
-                            grantingPermission: itemPermission.permission,
-                        });
-                    }
-                    if (itemPermission) {
-                        break;
-                    }
-                }
-                if (itemPermission) {
-                    allowedEventItems.push(item);
-                }
-            }
-            if (!role) {
-                role = true;
-            }
-            return {
-                success: true,
-                authorization: {
-                    role,
-                    markers: authorizations,
-                },
-            };
-        });
-    }
-    _authorizePolicyGrantPermissionRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this._authorizeRequest(context, request, [ACCOUNT_MARKER], (context, type, id) => {
-                return this._authorizePolicyGrantPermission(context, type, id);
-            }, false);
-        });
-    }
-    _authorizePolicyGrantPermission(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byPolicy('policy.grantPermission', context.request.policy), role === null
-                    ? this._some(this._byEveryoneRole(), this._bySubjectRole(context, type, context.recordName, id), this._byRecordOwner(context, type, id), this._byStudioRole(context, type, id, 'admin'))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'policy.grantPermission',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizePolicyRevokePermissionRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this._authorizeRequest(context, request, [ACCOUNT_MARKER], (context, type, id) => {
-                return this._authorizePolicyRevokePermission(context, type, id);
-            }, false);
-        });
-    }
-    _authorizePolicyRevokePermission(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byPolicy('policy.revokePermission', context.request.policy), role === null
-                    ? this._some(this._byEveryoneRole(), this._bySubjectRole(context, type, context.recordName, id), this._byRecordOwner(context, type, id), this._byStudioRole(context, type, id, 'admin'))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'policy.revokePermission',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizePolicyReadRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this._authorizeRequest(context, request, [ACCOUNT_MARKER], (context, type, id) => {
-                return this._authorizePolicyRead(context, type, id);
-            }, false);
-        });
-    }
-    _authorizePolicyRead(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byPolicy('policy.read', context.request.policy), role === null
-                    ? this._some(this._byEveryoneRole(), this._bySubjectRole(context, type, context.recordName, id), this._byRecordOwner(context, type, id), this._byStudioRole(context, type, id, 'admin'))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'policy.read',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizePolicyListRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this._authorizeRequest(context, request, [ACCOUNT_MARKER], (context, type, id) => {
-                return this._authorizePolicyList(context, type, id);
-            }, false);
-        });
-    }
-    _authorizePolicyList(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byPolicyList('policy.list'), role === null
-                    ? this._some(this._byEveryoneRole(), this._bySubjectRole(context, type, context.recordName, id), this._byRecordOwner(context, type, id), this._byStudioRole(context, type, id, 'admin'))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'policy.list',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizeRoleListRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this._authorizeRequest(context, request, [ACCOUNT_MARKER], (context, type, id) => {
-                return this._authorizeRoleList(context, type, id);
-            }, false);
-        });
-    }
-    _authorizeRoleList(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byRoleList('role.list'), role === null
-                    ? this._some(this._byEveryoneRole(), this._bySubjectRole(context, type, context.recordName, id), this._byRecordOwner(context, type, id), this._byStudioRole(context, type, id, 'admin'))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'role.list',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizeRoleReadRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this._authorizeRequest(context, request, [ACCOUNT_MARKER], (context, type, id) => {
-                return this._authorizeRoleRead(context, type, id);
-            }, false);
-        });
-    }
-    _authorizeRoleRead(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byRolePermission('role.read', context.request.role), role === null
-                    ? this._some(this._byEveryoneRole(), this._bySubjectRole(context, type, context.recordName, id), this._byRecordOwner(context, type, id), this._byStudioRole(context, type, id, 'admin'))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'role.read',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizeRoleGrantRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this._authorizeRequest(context, request, [ACCOUNT_MARKER], (context, type, id) => {
-                return this._authorizeRoleGrant(context, type, id);
-            }, false);
-        });
-    }
-    _authorizeRoleGrant(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            const durationMs = getExpireTime(context.request.expireTimeMs) - Date.now();
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byRoleGrant('role.grant', context.request.role, context.request.targetUserId, context.request.targetInstance, durationMs), role === null
-                    ? this._some(this._byEveryoneRole(), this._bySubjectRole(context, type, context.recordName, id), this._byRecordOwner(context, type, id), this._byStudioRole(context, type, id, 'admin'))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'role.grant',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizeRoleRevokeRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this._authorizeRequest(context, request, [ACCOUNT_MARKER], (context, type, id) => {
-                return this._authorizeRoleRevoke(context, type, id);
-            }, false);
-        });
-    }
-    _authorizeRoleRevoke(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byRoleRevoke('role.revoke', context.request.role, context.request.targetUserId, context.request.targetInstance), role === null
-                    ? this._some(this._byEveryoneRole(), this._bySubjectRole(context, type, context.recordName, id), this._byRecordOwner(context, type, id), this._byStudioRole(context, type, id, 'admin'))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'role.revoke',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizeInstCreateRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this._authorizeRequest(context, request, request.resourceMarkers, (context, type, id) => {
-                return this._authorizeCreateInst(context, type, id);
-            });
-        });
-    }
-    /**
-     * Authorizes the given subject for inst.create requests.
-     *
-     * @param context The context for the authorization.
-     * @param subjectType The type of subject that is being authorized.
-     * @param id The ID of the subject.
-     * @returns The authorization that approves the subject for the request. Null if the subject is not authorized.
-     */
-    _authorizeCreateInst(context, subjectType, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const authorizations = [];
-            let role = null;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byInst('inst.create', context.request.inst), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, subjectType, id), this._bySubjectRole(context, subjectType, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    return {
-                        success: false,
-                        reason: {
-                            type: 'missing_permission',
-                            kind: subjectType,
-                            id,
-                            marker: marker.marker,
-                            permission: 'inst.create',
-                            role,
-                        },
-                    };
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                const policyPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byPolicy('policy.assign', marker.marker), this._some(this._byEveryoneRole(), this._byRole(actionPermission.permission.role))));
-                if (!policyPermission) {
-                    return {
-                        success: false,
-                        reason: {
-                            type: 'missing_permission',
-                            kind: subjectType,
-                            id,
-                            marker: marker.marker,
-                            permission: 'policy.assign',
-                            role,
-                        },
-                    };
-                }
-                authorizations.push({
-                    marker: marker.marker,
-                    actions: [
-                        {
-                            action: context.request.action,
-                            grantingPolicy: actionPermission.policy,
-                            grantingPermission: actionPermission.permission,
-                        },
-                        {
-                            action: 'policy.assign',
-                            grantingPolicy: policyPermission.policy,
-                            grantingPermission: policyPermission.permission,
-                        },
-                    ],
-                });
-            }
-            if (!role) {
-                return {
-                    success: false,
-                    reason: {
-                        type: 'missing_role',
-                    },
-                };
-            }
-            return {
-                success: true,
-                authorization: {
-                    role,
-                    markers: authorizations,
-                },
-            };
-        });
-    }
-    _authorizeInstReadRequest(context, request) {
-        return this._authorizeRequest(context, request, request.resourceMarkers, (context, type, id) => {
-            return this._authorizeInstRead(context, type, id);
-        });
-    }
-    _authorizeInstRead(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byInst('inst.read', context.request.inst), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'inst.read',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizeInstUpdateRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!willMarkersBeRemaining(request.existingMarkers, request.removedMarkers, request.addedMarkers)) {
-                return Object.assign(Object.assign({}, NOT_AUTHORIZED_RESULT), { reason: {
-                        type: 'no_markers_remaining',
-                    } });
-            }
-            return this._authorizeRequest(context, request, union(request.existingMarkers, request.addedMarkers, request.removedMarkers), (context, type, id) => {
-                return this._authorizeInstUpdate(context, type, id);
-            });
-        });
-    }
-    _authorizeInstUpdate(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let authorizations = [];
-            let role = null;
-            // The denial reason for if the user does not have permission from an existing marker.
-            let denialReason;
-            let hasPermissionFromExistingMarker = false;
-            for (let marker of context.markers) {
-                const isAddedMarker = context.request.addedMarkers &&
-                    context.request.addedMarkers.includes(marker.marker);
-                const isRemovedMarker = context.request.removedMarkers &&
-                    context.request.removedMarkers.includes(marker.marker);
-                const isExistingMarker = context.request.existingMarkers.includes(marker.marker);
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byInst('inst.update', context.request.inst), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    if (isAddedMarker || isRemovedMarker) {
-                        // Deny because the user needs permission for all new & removed markers.
-                        return {
-                            success: false,
-                            reason: {
-                                type: 'missing_permission',
-                                kind: type,
-                                id,
-                                marker: marker.marker,
-                                permission: 'inst.update',
-                                role,
-                            },
-                        };
-                    }
-                    else {
-                        // Record that the user does not have permission from this marker.
-                        // May or may not be used depending on if a different existing marker
-                        // provides permission.
-                        denialReason = {
-                            type: 'missing_permission',
-                            kind: type,
-                            id,
-                            marker: marker.marker,
-                            permission: 'inst.update',
-                            role,
-                        };
-                        continue;
-                    }
-                }
-                if (isExistingMarker) {
-                    hasPermissionFromExistingMarker = true;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                const actions = [
-                    {
-                        action: context.request.action,
-                        grantingPolicy: actionPermission.policy,
-                        grantingPermission: actionPermission.permission,
-                    },
-                ];
-                if (isAddedMarker) {
-                    const policyPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byPolicy('policy.assign', marker.marker), this._some(this._byEveryoneRole(), this._byRole(actionPermission.permission.role))));
-                    if (!policyPermission) {
-                        return {
-                            success: false,
-                            reason: {
-                                type: 'missing_permission',
-                                kind: type,
-                                id,
-                                marker: marker.marker,
-                                permission: 'policy.assign',
-                                role,
-                            },
-                        };
-                        continue;
-                    }
-                    actions.push({
-                        action: 'policy.assign',
-                        grantingPolicy: policyPermission.policy,
-                        grantingPermission: policyPermission.permission,
-                    });
-                }
-                else if (isRemovedMarker) {
-                    const policyPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byPolicy('policy.unassign', marker.marker), this._some(this._byEveryoneRole(), this._byRole(actionPermission.permission.role))));
-                    if (!policyPermission) {
-                        return {
-                            success: false,
-                            reason: {
-                                type: 'missing_permission',
-                                kind: type,
-                                id,
-                                marker: marker.marker,
-                                permission: 'policy.unassign',
-                                role,
-                            },
-                        };
-                    }
-                    actions.push({
-                        action: 'policy.unassign',
-                        grantingPolicy: policyPermission.policy,
-                        grantingPermission: policyPermission.permission,
-                    });
-                }
-                authorizations.push({
-                    marker: marker.marker,
-                    actions,
-                });
-            }
-            // Deny the request if the user does not have permission from at least one existing marker.
-            if (!hasPermissionFromExistingMarker && denialReason) {
-                return {
-                    success: false,
-                    reason: denialReason,
-                };
-            }
-            if (!role) {
-                return {
-                    success: false,
-                    reason: {
-                        type: 'missing_role',
-                    },
-                };
-            }
-            return {
-                success: true,
-                authorization: {
-                    role,
-                    markers: authorizations,
-                },
-            };
-        });
-    }
-    _authorizeInstUpdateDataRequest(context, request) {
-        return this._authorizeRequest(context, request, request.resourceMarkers, (context, type, id) => {
-            return this._authorizeInstUpdateData(context, type, id);
-        });
-    }
-    _authorizeInstUpdateData(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byInst('inst.updateData', context.request.inst), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'inst.updateData',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizeInstDeleteRequest(context, request) {
-        return this._authorizeRequest(context, request, request.resourceMarkers, (context, type, id) => {
-            return this._authorizeInstDelete(context, type, id);
-        });
-    }
-    _authorizeInstDelete(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byInst('inst.delete', context.request.inst), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'inst.delete',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    _authorizeInstListRequest(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const allMarkers = union(...request.insts.map((i) => i.markers));
-            return yield this._authorizeRequest(context, request, allMarkers, (context, type, id) => {
-                return this._authorizeInstList(context, type, id);
-            }, undefined, true);
-        });
-    }
-    _authorizeInstList(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const authorizations = [];
-            let role = null;
-            const allowedInstItems = (context.allowedInstItems =
-                []);
-            const markers = new Map();
-            for (let marker of context.markers) {
-                const authorization = {
-                    marker: marker.marker,
-                    actions: [],
-                };
-                authorizations.push(authorization);
-                markers.set(marker.marker, {
-                    marker,
-                    authorization: authorization,
-                    usedPermissions: new Set(),
-                });
-            }
-            for (let item of context.request.insts) {
-                let itemPermission;
-                for (let m of item.markers) {
-                    const a = markers.get(m);
-                    if (!a) {
-                        continue;
-                    }
-                    const { marker, authorization, usedPermissions } = a;
-                    itemPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byInst('inst.list', item.inst), role === null
-                        ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                        : this._byRole(role)));
-                    if (!itemPermission) {
-                        continue;
-                    }
-                    if (role === null) {
-                        role = itemPermission.permission.role;
-                    }
-                    if (!usedPermissions.has(itemPermission.permission)) {
-                        usedPermissions.add(itemPermission.permission);
-                        authorization.actions.push({
-                            action: context.request.action,
-                            grantingPolicy: itemPermission.policy,
-                            grantingPermission: itemPermission.permission,
-                        });
-                    }
-                    if (itemPermission) {
-                        break;
-                    }
-                }
-                if (itemPermission) {
-                    allowedInstItems.push(item);
-                }
-            }
-            if (!role) {
-                role = true;
-            }
-            return {
-                success: true,
-                authorization: {
-                    role,
-                    markers: authorizations,
-                },
-            };
-        });
-    }
-    _authorizeInstSendActionRequest(context, request) {
-        return this._authorizeRequest(context, request, request.resourceMarkers, (context, type, id) => {
-            return this._authorizeInstSendAction(context, type, id);
-        });
-    }
-    _authorizeInstSendAction(context, type, id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let role = null;
-            let denialReason;
-            for (let marker of context.markers) {
-                const actionPermission = yield this._findPermissionByFilter(marker.permissions, this._every(this._byInst('inst.sendAction', context.request.inst), role === null
-                    ? this._some(this._byEveryoneRole(), this._byAdminRole(context, type, id), this._bySubjectRole(context, type, context.recordName, id))
-                    : this._byRole(role)));
-                if (!actionPermission) {
-                    denialReason = {
-                        type: 'missing_permission',
-                        kind: type,
-                        id,
-                        marker: marker.marker,
-                        permission: 'inst.sendAction',
-                        role,
-                    };
-                    continue;
-                }
-                if (role === null) {
-                    role = actionPermission.permission.role;
-                }
-                return {
-                    success: true,
-                    authorization: {
-                        role,
-                        markers: [
-                            {
-                                marker: marker.marker,
-                                actions: [
-                                    {
-                                        action: context.request.action,
-                                        grantingPolicy: actionPermission.policy,
-                                        grantingPermission: actionPermission.permission,
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                };
-            }
-            return {
-                success: false,
-                reason: denialReason !== null && denialReason !== void 0 ? denialReason : {
-                    type: 'missing_role',
-                },
-            };
-        });
-    }
-    /**
-     * Attempts to authorize the given request based on common request properties.
-     *
-     * Evaluates the recordKey, userId, and instances with the given resource markers and authorize function.
-     * The given authorize function will be called with the User ID, and each inst and should return the authorization that should be used for each case.
-     * If it returns null, then the request is not authorized and will be rejected as such.
-     *
-     * @param context The context for the request.
-     * @param request The request that should be authorized.
-     * @param resourceMarkers The list of markers that need to be validated.
-     * @param authorize The function that should be used to authorize each subject in the request.
-     * @param skipInstanceChecksWhenValidRecordKeyIsProvided Whether or not to skip instance checks when a valid record key is provided.
-     * @param isListOperation Whether the request is a list operation.
-     */
-    _authorizeRequest(context, request, resourceMarkers, authorize, skipInstanceChecksWhenValidRecordKeyIsProvided = true, isListOperation = false) {
-        var _a, _b;
-        return __awaiter(this, void 0, void 0, function* () {
-            if (request.instances &&
-                request.instances.length > MAX_ALLOWED_INSTANCES) {
-                console.log(`[PolicyController] [action: ${request.action} recordName: ${context.recordName}, userId: ${request.userId}] Request denied because too many instances were provided.`);
-                // More than 2 instances should be auto-denied.
-                // This is a "not_authorized" error instead of an "unacceptable_request" because
-                // we want integrators to understand that this is an authentication issue, and not a configuration issue.
-                // If more than 2 instances are loaded, we always want those passed to the controller, even if having more than 2 fails authentication.
-                return NOT_AUTHORIZED_TO_MANY_INSTANCES_RESULT;
-            }
-            if (resourceMarkers.length <= 0 && !isListOperation) {
-                console.log(`[PolicyController] [action: ${request.action} recordName: ${context.recordName}, userId: ${request.userId}] Request denied because there are no markers.`);
-                return Object.assign(Object.assign({}, NOT_AUTHORIZED_RESULT), { reason: {
-                        type: 'no_markers',
-                    } });
-            }
-            const markers = yield this._listPermissionsForMarkers(context.recordName, request.userId, resourceMarkers);
-            const rolesContext = Object.assign(Object.assign({}, context), { userRoles: null, instRoles: {}, markers,
-                request });
-            const userAuthorization = yield authorize(rolesContext, 'user', request.userId);
-            if (userAuthorization.success === false) {
-                if (!request.userId && !context.recordKeyProvided) {
-                    console.log(`[PolicyController] [action: ${request.action} recordName: ${context.recordName}] Request denied because the user is not signed in.`);
-                    return {
-                        allowed: false,
-                        errorCode: 'not_logged_in',
-                        errorMessage: 'The user must be logged in. Please provide a sessionKey or a recordKey.',
-                    };
-                }
-                console.log(`[PolicyController] [action: ${request.action} recordName: ${context.recordName}, userId: ${request.userId}] Request denied. Reason:`, userAuthorization.reason);
-                return Object.assign(Object.assign({}, NOT_AUTHORIZED_RESULT), { reason: userAuthorization.reason });
-            }
-            const authorizedInstances = yield this._authorizeInstances(request.instances, context.recordKeyResult, (inst) => __awaiter(this, void 0, void 0, function* () {
-                var _c, _d, _e, _f;
-                let currentItems = (_c = rolesContext.allowedDataItems) === null || _c === void 0 ? void 0 : _c.slice();
-                let currentFiles = (_d = rolesContext.allowedFileItems) === null || _d === void 0 ? void 0 : _d.slice();
-                let currentEvents = (_e = rolesContext.allowedEventItems) === null || _e === void 0 ? void 0 : _e.slice();
-                let currentInsts = (_f = rolesContext.allowedInstItems) === null || _f === void 0 ? void 0 : _f.slice();
-                const result = yield authorize(rolesContext, 'inst', inst);
-                if (currentItems) {
-                    rolesContext.allowedDataItems = intersectionBy(currentItems, rolesContext.allowedDataItems, (item) => item.address);
-                }
-                if (currentFiles) {
-                    rolesContext.allowedFileItems = intersectionBy(currentFiles, rolesContext.allowedFileItems, (item) => item.fileName);
-                }
-                if (currentEvents) {
-                    rolesContext.allowedEventItems = intersectionBy(currentEvents, rolesContext.allowedEventItems, (item) => item.eventName);
-                }
-                if (currentInsts) {
-                    rolesContext.allowedInstItems = intersectionBy(currentInsts, rolesContext.allowedInstItems, (item) => item.inst);
-                }
-                return result;
-            }), skipInstanceChecksWhenValidRecordKeyIsProvided);
-            if (!Array.isArray(authorizedInstances)) {
-                console.log(`[PolicyController] [action: ${request.action} recordName: ${context.recordName}, userId: ${request.userId}] Request denied. Reason:`, authorizedInstances.reason);
-                return Object.assign(Object.assign({}, NOT_AUTHORIZED_RESULT), { reason: authorizedInstances.reason });
-            }
-            const recordKeyOwnerId = ((_a = context.recordKeyResult) === null || _a === void 0 ? void 0 : _a.success)
-                ? context.recordKeyResult.keyCreatorId
-                : null;
-            const authorizerId = (_b = recordKeyOwnerId !== null && recordKeyOwnerId !== void 0 ? recordKeyOwnerId : request.userId) !== null && _b !== void 0 ? _b : null;
-            console.log(`[PolicyController] [action: ${request.action} recordName: ${context.recordName}, userId: ${request.userId}] Request authorized.`);
-            return {
-                allowed: true,
-                recordName: context.recordName,
-                recordKeyOwnerId: recordKeyOwnerId,
-                authorizerId: authorizerId,
-                subject: Object.assign(Object.assign({}, userAuthorization.authorization), { userId: request.userId, subjectPolicy: context.subjectPolicy }),
-                instances: authorizedInstances,
-                allowedDataItems: rolesContext.allowedDataItems,
-                allowedFileItems: rolesContext.allowedFileItems,
-                allowedEventItems: rolesContext.allowedEventItems,
-                allowedInstItems: rolesContext.allowedInstItems,
-            };
-        });
-    }
-    _authorizeInstances(instances, recordKeyResult, authorize, skipInstanceChecksWhenValidRecordKeyIsProvided) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const authorizedInstances = [];
-            if (instances) {
-                for (let inst of instances) {
-                    if (skipInstanceChecksWhenValidRecordKeyIsProvided &&
-                        (recordKeyResult === null || recordKeyResult === void 0 ? void 0 : recordKeyResult.success)) {
-                        authorizedInstances.push({
-                            authorizationType: 'not_required',
-                            inst,
-                        });
-                        continue;
-                    }
-                    const authorization = yield authorize(inst);
-                    if (authorization.success === false) {
-                        return authorization;
-                    }
-                    authorizedInstances.push(Object.assign({ inst, authorizationType: 'allowed' }, authorization.authorization));
-                }
-            }
-            return authorizedInstances;
-        });
-    }
-    _listPermissionsForMarkers(recordName, userId, resourceMarkers) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const promises = resourceMarkers.map((m) => __awaiter(this, void 0, void 0, function* () {
-                const result = yield this._policies.listPoliciesForMarkerAndUser(recordName, userId, m);
-                return {
-                    marker: m,
-                    result,
-                };
-            }));
-            const markerPolicies = yield Promise.all(promises);
-            const markers = filterAndMergeMarkerPermissions(markerPolicies);
-            return markers;
-        });
-    }
-    _every(...filters) {
-        return (...args) => __awaiter(this, void 0, void 0, function* () {
-            for (let filter of filters) {
-                if (!(yield filter(...args))) {
-                    return false;
-                }
-            }
-            return true;
-        });
-    }
-    _some(...filters) {
-        return (...args) => __awaiter(this, void 0, void 0, function* () {
-            for (let filter of filters) {
-                if (yield filter(...args)) {
-                    return true;
-                }
-            }
-            return false;
-        });
-    }
-    _byType(type) {
-        return (permission) => __awaiter(this, void 0, void 0, function* () {
-            return permission.type === type;
-        });
-    }
-    _byData(type, address) {
-        return (permission) => __awaiter(this, void 0, void 0, function* () {
-            if (permission.type !== type) {
-                return false;
-            }
-            if (permission.addresses === true) {
-                return true;
-            }
-            if (this._testRegex(permission.addresses, address)) {
-                return true;
-            }
-            return false;
-        });
-    }
-    _byFile(type, fileSizeInBytes, fileMimeType) {
-        return (permission) => __awaiter(this, void 0, void 0, function* () {
-            if (permission.type !== type) {
-                return false;
-            }
-            if (typeof permission.maxFileSizeInBytes === 'number' &&
-                fileSizeInBytes > permission.maxFileSizeInBytes) {
-                return false;
-            }
-            if (typeof permission.allowedMimeTypes === 'object' &&
-                Array.isArray(permission.allowedMimeTypes)) {
-                if (!permission.allowedMimeTypes.includes(fileMimeType)) {
-                    return false;
-                }
-            }
-            return true;
-        });
-    }
-    _byEvent(type, eventName) {
-        return (permission) => __awaiter(this, void 0, void 0, function* () {
-            if (permission.type !== type) {
-                return false;
-            }
-            if (permission.events === true) {
-                return true;
-            }
-            if (this._testRegex(permission.events, eventName)) {
-                return true;
-            }
-            return false;
-        });
-    }
-    _byInst(type, inst) {
-        return (permission) => __awaiter(this, void 0, void 0, function* () {
-            if (permission.type !== type) {
-                return false;
-            }
-            if (permission.insts === true) {
-                return true;
-            }
-            if (this._testRegex(permission.insts, inst)) {
-                return true;
-            }
-            return false;
-        });
-    }
-    _byRecordOwner(context, subjectType, id) {
-        if (subjectType === 'inst') {
-            return () => __awaiter(this, void 0, void 0, function* () { return false; });
-        }
-        if (context.recordOwnerId === id) {
-            return () => __awaiter(this, void 0, void 0, function* () { return true; });
-        }
-        return () => __awaiter(this, void 0, void 0, function* () { return false; });
-    }
-    _byStudioRole(context, subjectType, id, role) {
-        if (subjectType === 'inst') {
-            return () => __awaiter(this, void 0, void 0, function* () { return false; });
-        }
-        if (!context.recordStudioId ||
-            !context.recordStudioMembers ||
-            context.recordStudioMembers.length <= 0) {
-            return () => __awaiter(this, void 0, void 0, function* () { return false; });
-        }
-        if (role) {
-            return () => __awaiter(this, void 0, void 0, function* () {
-                return context.recordStudioMembers.some((m) => m.userId === id && m.role === role);
-            });
-        }
-        return () => __awaiter(this, void 0, void 0, function* () { return context.recordStudioMembers.some((m) => m.userId === id); });
-    }
-    _byEveryoneRole() {
-        return this._byRole(true);
-    }
-    _byAdminRole(context, subjectType, id) {
-        if (!!context.recordKeyResult && context.recordKeyResult.success) {
-            return this._byRole(ADMIN_ROLE_NAME);
-        }
-        else if (context.recordStudioId) {
-            return this._byStudioRole(context, subjectType, id);
-        }
-        else {
-            return this._byRecordOwner(context, subjectType, id);
-        }
-    }
-    _bySubjectRole(context, subjectType, recordName, id) {
-        if (!id) {
-            return () => __awaiter(this, void 0, void 0, function* () { return false; });
-        }
-        if (subjectType === 'user') {
-            return this._byUserRole(context, recordName, id);
-        }
-        else {
-            return this._byInstRole(context, recordName, id);
-        }
-    }
-    _byUserRole(context, recordName, userId) {
-        return (permission) => __awaiter(this, void 0, void 0, function* () {
-            if (!context.userRoles) {
-                const roles = yield this._policies.listRolesForUser(recordName, userId);
-                context.userRoles = new Set(roles.map((r) => r.role));
-            }
-            return (typeof permission.role === 'string' &&
-                context.userRoles.has(permission.role));
-        });
-    }
-    _byInstRole(context, recordName, inst) {
-        return (permission) => __awaiter(this, void 0, void 0, function* () {
-            if (!context.instRoles[inst]) {
-                const roles = yield this._policies.listRolesForInst(recordName, inst);
-                context.instRoles[inst] = new Set(roles.map((r) => r.role));
-            }
-            return (typeof permission.role === 'string' &&
-                context.instRoles[inst].has(permission.role));
-        });
-    }
-    _byRole(role) {
-        return (permission) => __awaiter(this, void 0, void 0, function* () {
-            if (permission.role === role) {
-                return true;
-            }
-            return false;
-        });
-    }
-    _byPolicy(type, marker) {
-        return (permission) => __awaiter(this, void 0, void 0, function* () {
-            if (permission.type !== type) {
-                return false;
-            }
-            if (permission.policies === true) {
-                return true;
-            }
-            if (this._testRegex(permission.policies, marker)) {
-                return true;
-            }
-            return false;
-        });
-    }
-    _byRolePermission(type, marker) {
-        return (permission) => __awaiter(this, void 0, void 0, function* () {
-            if (permission.type !== type) {
-                return false;
-            }
-            if (permission.roles === true) {
-                return true;
-            }
-            if (this._testRegex(permission.roles, marker)) {
-                return true;
-            }
-            return false;
-        });
-    }
-    _byRoleGrant(type, role, targetUserId, targetInstance, durationMs) {
-        return (permission) => __awaiter(this, void 0, void 0, function* () {
-            if (permission.type !== type) {
-                return false;
-            }
-            if (typeof permission.maxDurationMs === 'number' &&
-                durationMs > permission.maxDurationMs) {
-                return false;
-            }
-            if (!!targetUserId && !!targetInstance) {
-                return false;
-            }
-            else if (!!targetUserId) {
-                if (permission.userIds === false) {
-                    return false;
-                }
-                if (typeof permission.userIds === 'object' &&
-                    Array.isArray(permission.userIds)) {
-                    if (permission.userIds.every((id) => id !== targetUserId)) {
-                        return false;
-                    }
-                }
-            }
-            else if (!!targetInstance) {
-                if (permission.instances === false) {
-                    return false;
-                }
-                if (typeof permission.instances === 'string' &&
-                    !this._testRegex(permission.instances, targetInstance)) {
-                    return false;
-                }
-            }
-            else {
-                return false;
-            }
-            if (permission.roles === true) {
-                return true;
-            }
-            if (this._testRegex(permission.roles, role)) {
-                return true;
-            }
-            return false;
-        });
-    }
-    _byRoleRevoke(type, role, targetUserId, targetInstance) {
-        return (permission) => __awaiter(this, void 0, void 0, function* () {
-            if (permission.type !== type) {
-                return false;
-            }
-            if (!!targetUserId && !!targetInstance) {
-                return false;
-            }
-            else if (!!targetUserId) {
-                if (permission.userIds === false) {
-                    return false;
-                }
-                if (typeof permission.userIds === 'object' &&
-                    Array.isArray(permission.userIds)) {
-                    if (permission.userIds.every((id) => id !== targetUserId)) {
-                        return false;
-                    }
-                }
-            }
-            else if (!!targetInstance) {
-                if (permission.instances === false) {
-                    return false;
-                }
-                if (typeof permission.instances === 'string' &&
-                    !this._testRegex(permission.instances, targetInstance)) {
-                    return false;
-                }
-            }
-            else {
-                return false;
-            }
-            if (permission.roles === true) {
-                return true;
-            }
-            if (this._testRegex(permission.roles, role)) {
-                return true;
-            }
-            return false;
-        });
-    }
-    _byPolicyList(type) {
-        return (permission) => __awaiter(this, void 0, void 0, function* () {
-            if (permission.type !== type) {
-                return false;
-            }
-            if (permission.policies === true) {
-                return true;
-            }
-            return false;
-        });
-    }
-    _byRoleList(type) {
-        return (permission) => __awaiter(this, void 0, void 0, function* () {
-            if (permission.type !== type) {
-                return false;
-            }
-            if (permission.roles === true) {
-                return true;
-            }
-            return false;
-        });
-    }
-    _testRegex(regex, value) {
-        try {
-            return new RegExp(regex).test(value);
-        }
-        catch (err) {
-            return false;
-        }
-    }
-    _findPermissionByFilter(permissions, filter) {
-        return __awaiter(this, void 0, void 0, function* () {
-            for (let permission of permissions) {
-                if (yield filter(permission.permission)) {
-                    return permission;
-                }
-            }
-            return null;
-        });
-    }
 }
 /**
  * Determines if any markers will be remaining after the removal and addition of the specified markers.
@@ -3373,84 +1694,25 @@ export function willMarkersBeRemaining(existingMarkers, removedMarkers, addedMar
     }
     return false;
 }
-export function returnAuthorizationResult(a) {
-    if (a.errorCode === 'action_not_supported') {
-        return {
-            success: false,
-            errorCode: 'server_error',
-            errorMessage: 'A server error occurred.',
-        };
-    }
-    const { allowed } = a, rest = __rest(a, ["allowed"]);
-    return Object.assign(Object.assign({ success: false }, rest), { errorCode: a.errorCode });
-}
 /**
- * Merges the permissions from the given marker policies and filters out any permissions that are not allowed according to
- * the privacy settings of the record owner and the user.
- * @param markerPolicies The marker policies that should be merged.
+ * Gets a simple human readable explaination for the given permission assignment.
  */
-export function filterAndMergeMarkerPermissions(markerPolicies) {
-    const markers = [];
-    for (let { marker, result } of markerPolicies) {
-        let permissions = [];
-        let valid = true;
-        const denyPublicInsts = !result.recordOwnerPrivacyFeatures.allowPublicInsts ||
-            !result.userPrivacyFeatures.allowPublicInsts;
-        let instsValid = true;
-        if (!result.recordOwnerPrivacyFeatures.publishData ||
-            !result.userPrivacyFeatures.publishData) {
-            valid = false;
-        }
-        if (valid) {
-            for (let policy of result.policies) {
-                if (!result.recordOwnerPrivacyFeatures.allowPublicData ||
-                    !result.userPrivacyFeatures.allowPublicData) {
-                    if (policy.permissions.some((p) => p.role === true)) {
-                        // policy contains a permission that allows everyone to access the data, but the user should not be able to publish public data.
-                        // skip all the policies for this marker.
-                        valid = false;
-                        break;
-                    }
-                }
-                for (let permission of policy.permissions) {
-                    if (denyPublicInsts) {
-                        if (permission.type.startsWith('inst.')) {
-                            if (!instsValid) {
-                                // Skip all inst permissions if any inst permissions are invalid.
-                                continue;
-                            }
-                            else if (permission.role === true) {
-                                // Mark all insts permissions for this marker as invalid if public insts
-                                // are not allowed and this permission is public.
-                                instsValid = false;
-                                continue;
-                            }
-                        }
-                    }
-                    permissions.push({
-                        policy,
-                        permission,
-                    });
-                }
-            }
-        }
-        if (!instsValid) {
-            // Filter out any inst permissions if insts are invalid
-            permissions = permissions.filter((p) => !p.permission.type.startsWith('inst.'));
-        }
-        if (valid) {
-            markers.push({
-                marker,
-                permissions,
-            });
-        }
-        else {
-            markers.push({
-                marker,
-                permissions: [],
-            });
-        }
-    }
-    return markers;
+export function explainationForPermissionAssignment(subjectType, permissionAssignment) {
+    const subjectString = subjectType === 'user'
+        ? 'User'
+        : subjectType === 'inst'
+            ? 'Inst'
+            : 'Role';
+    let permissionString;
+    if ('marker' in permissionAssignment) {
+        permissionString = `${subjectString} was granted access to marker "${permissionAssignment.marker}" by "${permissionAssignment.id}"`;
+    }
+    else {
+        permissionString = `${subjectString} was granted access to resource "${permissionAssignment.resourceId}" by "${permissionAssignment.id}"`;
+    }
+    if (permissionAssignment.subjectType === 'role') {
+        permissionString += ` using role "${permissionAssignment.subjectId}"`;
+    }
+    return permissionString;
 }
 //# sourceMappingURL=PolicyController.js.map