@casual-simulation/aux-records 3.4.6-alpha.14601027727 → 3.5.0-alpha.15117651144

package/PolicyController.js

@@ -4,23 +4,13 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-import { isRecordKey } from './RecordsController';
-import { ADMIN_ROLE_NAME, PUBLIC_READ_MARKER, ACCOUNT_MARKER, PRIVATE_MARKER, } from '@casual-simulation/aux-common';
+import { ADMIN_ROLE_NAME, PUBLIC_READ_MARKER, ACCOUNT_MARKER, PRIVATE_MARKER, isRecordKey, isSuperUserRole, normalizeInstId, parseInstId, } from '@casual-simulation/aux-common';
 import { getExpireTime, getPublicMarkersPermission } from './PolicyStore';
 import { sortBy, without } from 'lodash';
 import { getRootMarker, getRootMarkersOrDefault } from './Utils';
-import { normalizeInstId, parseInstId } from './websockets';
 import { traced } from './tracing/TracingDecorators';
 import { SpanStatusCode, trace } from '@opentelemetry/api';
+import { v7 as uuidv7 } from 'uuid';
 const TRACE_NAME = 'PolicyController';
 /**
  * The maximum number of instances that can be authorized at once.
@@ -57,6 +47,8 @@ const ALLOWED_STUDIO_MEMBER_RESOURCES = [
     ],
     ['loom', ['create']],
     ['webhook', ['read', 'create', 'delete', 'update', 'list', 'run']],
+    ['package', ['read', 'create', 'delete', 'update', 'list']],
+    ['package.version', ['read', 'create', 'delete', 'update', 'list', 'run']],
 ];
 const ALLOWED_MODERATOR_ACTIONS = new Set([
     'read',
@@ -149,180 +141,142 @@ export function getMarkerResourcesForUpdate(existingMarkers, newMarkers) {
  * Defines a class that is able to calculate the policies and permissions that are allowed for specific actions.
  */
 export class PolicyController {
-    constructor(auth, records, policies) {
+    constructor(auth, records, policies, insts = null, packageVersions = null) {
         this._auth = auth;
         this._records = records;
         this._policies = policies;
+        this._insts = insts;
+        this._packageVersions = packageVersions;
     }
     /**
      * Constructs the authorization context that is needed for the given request.
      * @param request The request that will be authorized.
      * @returns The authorization context that will be used to evaluate whether the request is authorized.
      */
-    constructAuthorizationContext(request) {
+    async constructAuthorizationContext(request) {
         var _a, _b;
-        return __awaiter(this, void 0, void 0, function* () {
-            let recordKeyResult = null;
-            let recordName;
-            let recordKeyCreatorId;
-            let ownerId;
-            let studioId;
-            let studioMembers = undefined;
-            const recordKeyProvided = isRecordKey(request.recordKeyOrRecordName);
-            if (recordKeyProvided) {
-                recordKeyResult = yield this._records.validatePublicRecordKey(request.recordKeyOrRecordName);
-                if (recordKeyResult.success === true) {
-                    recordName = recordKeyResult.recordName;
-                    ownerId = recordKeyResult.ownerId;
-                    recordKeyCreatorId = recordKeyResult.keyCreatorId;
-                }
-                else {
-                    return {
-                        success: false,
-                        errorCode: recordKeyResult.errorCode,
-                        errorMessage: recordKeyResult.errorMessage,
-                    };
-                }
+        let recordKeyResult = null;
+        let recordName;
+        let recordKeyCreatorId;
+        let ownerId;
+        let studioId;
+        let studioMembers = undefined;
+        const recordKeyProvided = isRecordKey(request.recordKeyOrRecordName);
+        if (recordKeyProvided) {
+            recordKeyResult = await this._records.validatePublicRecordKey(request.recordKeyOrRecordName);
+            if (recordKeyResult.success === true) {
+                recordName = recordKeyResult.recordName;
+                ownerId = recordKeyResult.ownerId;
+                recordKeyCreatorId = recordKeyResult.keyCreatorId;
             }
             else {
-                const result = yield this._records.validateRecordName(request.recordKeyOrRecordName, request.userId);
-                if (result.success === false) {
-                    return {
-                        success: false,
-                        errorCode: result.errorCode,
-                        errorMessage: result.errorMessage,
-                    };
-                }
-                recordName = result.recordName;
-                ownerId = result.ownerId;
-                studioId = result.studioId;
-                studioMembers = result.studioMembers;
-            }
-            const subjectPolicy = !!recordKeyResult && recordKeyResult.success
-                ? recordKeyResult.policy
-                : 'subjectfull';
-            let recordOwnerPrivacyFeatures = null;
-            let userPrivacyFeatures = null;
-            if (ownerId) {
-                recordOwnerPrivacyFeatures =
-                    yield this._policies.getUserPrivacyFeatures(ownerId);
-            }
-            if (!recordOwnerPrivacyFeatures) {
-                // The record owner will most likely have privacy features,
-                // but this is just a sanity check in case they dont.
-                if (this._auth.privoEnabled) {
-                    recordOwnerPrivacyFeatures = {
-                        allowAI: false,
-                        allowPublicData: false,
-                        allowPublicInsts: false,
-                        publishData: false,
-                    };
-                }
-                else {
-                    recordOwnerPrivacyFeatures = {
-                        allowAI: true,
-                        allowPublicData: true,
-                        allowPublicInsts: true,
-                        publishData: true,
-                    };
-                }
-            }
-            if (request.userId) {
-                userPrivacyFeatures = yield this._policies.getUserPrivacyFeatures(request.userId);
-            }
-            if (!userPrivacyFeatures) {
-                if (this._auth.privoEnabled) {
-                    userPrivacyFeatures = {
-                        allowAI: false,
-                        allowPublicData: false,
-                        allowPublicInsts: false,
-                        publishData: false,
-                    };
-                }
-                else {
-                    userPrivacyFeatures = {
-                        allowAI: true,
-                        allowPublicData: true,
-                        allowPublicInsts: true,
-                        publishData: true,
-                    };
-                }
+                return {
+                    success: false,
+                    errorCode: recordKeyResult.errorCode,
+                    errorMessage: recordKeyResult.errorMessage,
+                };
             }
-            const context = {
-                recordName,
-                recordKeyResult,
-                subjectPolicy,
-                recordKeyProvided,
-                recordKeyCreatorId,
-                recordOwnerId: ownerId,
-                recordOwnerPrivacyFeatures,
-                recordStudioId: studioId,
-                recordStudioMembers: studioMembers,
-                userId: request.userId,
-                userRole: (_a = userPrivacyFeatures === null || userPrivacyFeatures === void 0 ? void 0 : userPrivacyFeatures.userRole) !== null && _a !== void 0 ? _a : 'none',
-                userPrivacyFeatures,
-                sendNotLoggedIn: (_b = request.sendNotLoggedIn) !== null && _b !== void 0 ? _b : true,
-            };
-            return {
-                success: true,
-                context,
-            };
-        });
-    }
-    /**
-     * Attempts to authorize the given user and instances for the action and resource(s).
-     * @param context The authorization context for the request.
-     * @param request The request.
-     */
-    authorizeUserAndInstances(context, request) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const authorization = yield this.authorizeSubjects(context, {
-                    action: request.action,
-                    markers: request.markers,
-                    resourceKind: request.resourceKind,
-                    resourceId: request.resourceId,
-                    subjects: [
-                        {
-                            subjectType: 'user',
-                            subjectId: request.userId,
-                        },
-                        ...((_a = request.instances) !== null && _a !== void 0 ? _a : []).map((i) => ({
-                            subjectType: 'inst',
-                            subjectId: i,
-                        })),
-                    ],
-                });
-                if (authorization.success === false) {
-                    return authorization;
-                }
-                const userResult = authorization.results.find((r) => r.subjectType === 'user' && r.subjectId === request.userId);
-                return Object.assign(Object.assign({}, authorization), { user: userResult });
-            }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred while authorizing user and instances.', err);
+        }
+        else {
+            const result = await this._records.validateRecordName(request.recordKeyOrRecordName, request.userId);
+            if (result.success === false) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: result.errorCode,
+                    errorMessage: result.errorMessage,
                 };
             }
-        });
+            recordName = result.recordName;
+            ownerId = result.ownerId;
+            studioId = result.studioId;
+            studioMembers = result.studioMembers;
+        }
+        const subjectPolicy = !!recordKeyResult && recordKeyResult.success
+            ? recordKeyResult.policy
+            : 'subjectfull';
+        let recordOwnerPrivacyFeatures = null;
+        let userPrivacyFeatures = null;
+        if (ownerId) {
+            recordOwnerPrivacyFeatures =
+                await this._policies.getUserPrivacyFeatures(ownerId);
+        }
+        if (!recordOwnerPrivacyFeatures) {
+            // The record owner will most likely have privacy features,
+            // but this is just a sanity check in case they dont.
+            if (this._auth.privoEnabled) {
+                recordOwnerPrivacyFeatures = {
+                    allowAI: false,
+                    allowPublicData: false,
+                    allowPublicInsts: false,
+                    publishData: false,
+                };
+            }
+            else {
+                recordOwnerPrivacyFeatures = {
+                    allowAI: true,
+                    allowPublicData: true,
+                    allowPublicInsts: true,
+                    publishData: true,
+                };
+            }
+        }
+        if (request.userId) {
+            userPrivacyFeatures = await this._policies.getUserPrivacyFeatures(request.userId);
+        }
+        if (!userPrivacyFeatures) {
+            if (this._auth.privoEnabled) {
+                userPrivacyFeatures = {
+                    allowAI: false,
+                    allowPublicData: false,
+                    allowPublicInsts: false,
+                    publishData: false,
+                };
+            }
+            else {
+                userPrivacyFeatures = {
+                    allowAI: true,
+                    allowPublicData: true,
+                    allowPublicInsts: true,
+                    publishData: true,
+                };
+            }
+        }
+        const context = {
+            recordName,
+            recordKeyResult,
+            subjectPolicy,
+            recordKeyProvided,
+            recordKeyCreatorId,
+            recordOwnerId: ownerId,
+            recordOwnerPrivacyFeatures,
+            recordStudioId: studioId,
+            recordStudioMembers: studioMembers,
+            userId: request.userId,
+            userRole: (_a = (request.userId
+                ? userPrivacyFeatures === null || userPrivacyFeatures === void 0 ? void 0 : userPrivacyFeatures.userRole
+                : request.userRole)) !== null && _a !== void 0 ? _a : 'none',
+            userPrivacyFeatures,
+            sendNotLoggedIn: (_b = request.sendNotLoggedIn) !== null && _b !== void 0 ? _b : true,
+        };
+        return {
+            success: true,
+            context,
+        };
     }
     /**
-     * Attempts to authorize the given user and instances for the given resources.
+     * Attempts to authorize the given user and instances for the action and resource(s).
      * @param context The authorization context for the request.
      * @param request The request.
      */
-    authorizeUserAndInstancesForResources(context, request) {
+    async authorizeUserAndInstances(context, request) {
         var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const subjects = [
+        try {
+            const authorization = await this.authorizeSubjects(context, {
+                action: request.action,
+                markers: request.markers,
+                resourceKind: request.resourceKind,
+                resourceId: request.resourceId,
+                subjects: [
                     {
                         subjectType: 'user',
                         subjectId: request.userId,
@@ -331,164 +285,211 @@ export class PolicyController {
                         subjectType: 'inst',
                         subjectId: i,
                     })),
-                ];
-                const subjectPermission = new Map();
-                const results = [];
-                const recordName = context.recordName;
-                for (let resource of request.resources) {
-                    let subjectsToAuthorize = [];
-                    let authorizations = [];
-                    for (let subject of subjects) {
-                        const subjectKey = `${subject.subjectType}.${subject.subjectId}`;
-                        const authorizedSubject = subjectPermission.get(subjectKey);
-                        if (authorizedSubject) {
-                            const permission = authorizedSubject.permission;
-                            const isCorrectResourceKind = permission.resourceKind === null ||
-                                permission.resourceKind === resource.resourceKind;
-                            const isCorrectAction = permission.action === null ||
-                                permission.action === resource.action;
-                            const isCorrectMarker = !('marker' in permission) ||
-                                resource.markers.includes(permission.marker);
-                            const isCorrectResource = !('resourceId' in permission) ||
-                                permission.resourceId === null ||
-                                permission.resourceId === resource.resourceId;
-                            if (isCorrectResourceKind &&
-                                isCorrectAction &&
-                                isCorrectMarker &&
-                                isCorrectResource) {
-                                // Record the authorization
-                                authorizations.push(authorizedSubject);
-                            }
-                            else {
-                                subjectsToAuthorize.push(subject);
-                            }
+                ],
+            });
+            if (authorization.success === false) {
+                return authorization;
+            }
+            const userResult = authorization.results.find((r) => r.subjectType === 'user' && r.subjectId === request.userId);
+            return {
+                ...authorization,
+                user: userResult,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred while authorizing user and instances.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
+    }
+    /**
+     * Attempts to authorize the given user and instances for the given resources.
+     * @param context The authorization context for the request.
+     * @param request The request.
+     */
+    async authorizeUserAndInstancesForResources(context, request) {
+        var _a;
+        try {
+            const subjects = [
+                {
+                    subjectType: 'user',
+                    subjectId: request.userId,
+                },
+                ...((_a = request.instances) !== null && _a !== void 0 ? _a : []).map((i) => ({
+                    subjectType: 'inst',
+                    subjectId: i,
+                })),
+            ];
+            const subjectPermission = new Map();
+            const results = [];
+            const recordName = context.recordName;
+            for (let resource of request.resources) {
+                let subjectsToAuthorize = [];
+                let authorizations = [];
+                for (let subject of subjects) {
+                    const subjectKey = `${subject.subjectType}.${subject.subjectId}`;
+                    const authorizedSubject = subjectPermission.get(subjectKey);
+                    if (authorizedSubject) {
+                        const permission = authorizedSubject.permission;
+                        const isCorrectResourceKind = permission.resourceKind === null ||
+                            permission.resourceKind === resource.resourceKind;
+                        const isCorrectAction = permission.action === null ||
+                            permission.action === resource.action;
+                        const isCorrectMarker = !('marker' in permission) ||
+                            resource.markers.includes(permission.marker);
+                        const isCorrectResource = !('resourceId' in permission) ||
+                            permission.resourceId === null ||
+                            permission.resourceId === resource.resourceId;
+                        if (isCorrectResourceKind &&
+                            isCorrectAction &&
+                            isCorrectMarker &&
+                            isCorrectResource) {
+                            // Record the authorization
+                            authorizations.push(authorizedSubject);
                         }
                         else {
                             subjectsToAuthorize.push(subject);
                         }
                     }
-                    if (subjectsToAuthorize.length > 0) {
-                        const result = yield this.authorizeSubjects(context, {
-                            action: resource.action,
-                            markers: resource.markers,
-                            resourceKind: resource.resourceKind,
-                            resourceId: resource.resourceId,
-                            subjects: subjectsToAuthorize,
-                        });
-                        if (result.success === false) {
-                            return result;
+                    else {
+                        subjectsToAuthorize.push(subject);
+                    }
+                }
+                if (subjectsToAuthorize.length > 0) {
+                    const result = await this.authorizeSubjects(context, {
+                        action: resource.action,
+                        markers: resource.markers,
+                        resourceKind: resource.resourceKind,
+                        resourceId: resource.resourceId,
+                        subjects: subjectsToAuthorize,
+                    });
+                    if (result.success === false) {
+                        return result;
+                    }
+                    for (let authorization of result.results) {
+                        const subjectKey = `${authorization.subjectType}.${authorization.subjectId}`;
+                        authorizations.push(authorization);
+                        const permission = authorization.permission;
+                        const existingAuthorization = subjectPermission.get(subjectKey);
+                        if (!existingAuthorization) {
+                            subjectPermission.set(subjectKey, authorization);
                         }
-                        for (let authorization of result.results) {
-                            const subjectKey = `${authorization.subjectType}.${authorization.subjectId}`;
-                            authorizations.push(authorization);
-                            const permission = authorization.permission;
-                            const existingAuthorization = subjectPermission.get(subjectKey);
-                            if (!existingAuthorization) {
+                        else {
+                            const existingPermission = existingAuthorization.permission;
+                            const isResourceKindMoreGeneral = permission.resourceKind === null &&
+                                existingPermission.resourceKind !== null;
+                            const isActionMoreGeneral = permission.action === null &&
+                                existingPermission.action !== null;
+                            const isMarkerMoreGeneral = 'marker' in permission &&
+                                'marker' in existingPermission &&
+                                permission.marker === null &&
+                                existingPermission.marker !== null;
+                            const isResourceMoreGeneral = 'resourceId' in permission &&
+                                'resourceId' in existingPermission &&
+                                permission.resourceId === null &&
+                                existingPermission.resourceId !== null;
+                            if (isResourceKindMoreGeneral ||
+                                isActionMoreGeneral ||
+                                isMarkerMoreGeneral ||
+                                isResourceMoreGeneral) {
                                 subjectPermission.set(subjectKey, authorization);
                             }
-                            else {
-                                const existingPermission = existingAuthorization.permission;
-                                const isResourceKindMoreGeneral = permission.resourceKind === null &&
-                                    existingPermission.resourceKind !== null;
-                                const isActionMoreGeneral = permission.action === null &&
-                                    existingPermission.action !== null;
-                                const isMarkerMoreGeneral = 'marker' in permission &&
-                                    'marker' in existingPermission &&
-                                    permission.marker === null &&
-                                    existingPermission.marker !== null;
-                                const isResourceMoreGeneral = 'resourceId' in permission &&
-                                    'resourceId' in existingPermission &&
-                                    permission.resourceId === null &&
-                                    existingPermission.resourceId !== null;
-                                if (isResourceKindMoreGeneral ||
-                                    isActionMoreGeneral ||
-                                    isMarkerMoreGeneral ||
-                                    isResourceMoreGeneral) {
-                                    subjectPermission.set(subjectKey, authorization);
-                                }
-                            }
                         }
                     }
-                    if (authorizations.length !== subjects.length) {
-                        console.error('[PolicyController] [authorizeUserAndInstancesForResources] The number of authorizations does not match the number of subjects!');
-                        return {
-                            success: false,
-                            errorCode: 'server_error',
-                            errorMessage: 'A server error occurred.',
-                        };
-                    }
-                    results.push({
-                        success: true,
-                        recordName: recordName,
-                        resourceKind: resource.resourceKind,
-                        resourceId: resource.resourceId,
-                        action: resource.action,
-                        markers: resource.markers,
-                        results: authorizations,
-                        user: authorizations.find((r) => r.subjectType === 'user' &&
-                            r.subjectId === request.userId),
-                    });
                 }
-                return {
+                if (authorizations.length !== subjects.length) {
+                    console.error('[PolicyController] [authorizeUserAndInstancesForResources] The number of authorizations does not match the number of subjects!');
+                    return {
+                        success: false,
+                        errorCode: 'server_error',
+                        errorMessage: 'A server error occurred.',
+                    };
+                }
+                results.push({
                     success: true,
                     recordName: recordName,
-                    results,
-                };
-            }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred while authorizing user and instances for resources.', err);
-                return {
-                    success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
-                };
+                    resourceKind: resource.resourceKind,
+                    resourceId: resource.resourceId,
+                    action: resource.action,
+                    markers: resource.markers,
+                    results: authorizations,
+                    user: authorizations.find((r) => r.subjectType === 'user' &&
+                        r.subjectId === request.userId),
+                });
             }
-        });
+            return {
+                success: true,
+                recordName: recordName,
+                results,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred while authorizing user and instances for resources.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Attempts to authorize the given subjects for the action and resource(s).
      * @param context The authorization context for the request.
      * @param request The request.
      */
-    authorizeSubjects(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                if (request.subjects.length <= 0) {
-                    return {
-                        success: false,
-                        errorCode: 'unacceptable_request',
-                        errorMessage: 'You must provide at least one subject to authorize.',
-                    };
-                }
-                const results = [];
-                for (let subject of request.subjects) {
-                    const subjectResult = yield this.authorizeSubjectUsingContext(context, Object.assign(Object.assign({}, subject), { action: request.action, resourceKind: request.resourceKind, resourceId: request.resourceId, markers: request.markers }));
-                    if (subjectResult.success === false) {
-                        return subjectResult;
-                    }
-                    results.push(Object.assign(Object.assign({}, subjectResult), { subjectType: subject.subjectType, subjectId: subject.subjectId }));
-                }
-                return {
-                    success: true,
-                    recordName: context.recordName,
-                    results: results,
-                };
-            }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred while authorizing subjects.', err);
+    async authorizeSubjects(context, request) {
+        try {
+            if (request.subjects.length <= 0) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'unacceptable_request',
+                    errorMessage: 'You must provide at least one subject to authorize.',
                 };
             }
-        });
+            const results = [];
+            for (let subject of request.subjects) {
+                const subjectResult = await this.authorizeSubjectUsingContext(context, {
+                    ...subject,
+                    action: request.action,
+                    resourceKind: request.resourceKind,
+                    resourceId: request.resourceId,
+                    markers: request.markers,
+                });
+                if (subjectResult.success === false) {
+                    return subjectResult;
+                }
+                results.push({
+                    ...subjectResult,
+                    subjectType: subject.subjectType,
+                    subjectId: subject.subjectId,
+                });
+            }
+            return {
+                success: true,
+                recordName: context.recordName,
+                results: results,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred while authorizing subjects.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Attempts to authorize the given subject for the action and resource(s).
@@ -496,26 +497,24 @@ export class PolicyController {
      * @param context The context for the request.
      * @param request The request to authorize.
      */
-    authorizeSubject(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                if (context.success === false) {
-                    return context;
-                }
-                return yield this.authorizeSubjectUsingContext(context.context, request);
-            }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred while authorizing a subject.', err);
-                return {
-                    success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
-                };
+    async authorizeSubject(context, request) {
+        try {
+            if (context.success === false) {
+                return context;
             }
-        });
+            return await this.authorizeSubjectUsingContext(context.context, request);
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred while authorizing a subject.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Attempts to authorize the given subject for the action and resource(s).
@@ -523,17 +522,15 @@ export class PolicyController {
      * @param context The context for the request.
      * @param request The request to authorize.
      */
-    authorizeSubjectUsingContext(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const result = yield this._authorizeSubjectUsingContext(context, request);
-            if (result.success) {
-                console.log(`[PolicyController] [action: ${request.resourceKind}.${request.action} resourceId: ${request.resourceId} recordName: ${context.recordName}, ${request.subjectType}: ${request.subjectId}, userId: ${context.userId}] Request authorized.`);
-            }
-            else {
-                console.log(`[PolicyController] [action: ${request.resourceKind}.${request.action} resourceId: ${request.resourceId} recordName: ${context.recordName}, ${request.subjectType}: ${request.subjectId}, userId: ${context.userId}] Request denied:`, result);
-            }
-            return result;
-        });
+    async authorizeSubjectUsingContext(context, request) {
+        const result = await this._authorizeSubjectUsingContext(context, request);
+        if (result.success) {
+            console.log(`[PolicyController] [action: ${request.resourceKind}.${request.action} resourceId: ${request.resourceId} recordName: ${context.recordName}, ${request.subjectType}: ${request.subjectId}, userId: ${context.userId}] Request authorized: ${result.explanation}`);
+        }
+        else {
+            console.log(`[PolicyController] [action: ${request.resourceKind}.${request.action} resourceId: ${request.resourceId} recordName: ${context.recordName}, ${request.subjectType}: ${request.subjectId}, userId: ${context.userId}] Request denied:`, result);
+        }
+        return result;
     }
     /**
      * Attempts to authorize the given subject for the action and resource(s).
@@ -541,21 +538,143 @@ export class PolicyController {
      * @param context The context for the request.
      * @param request The request to authorize.
      */
-    _authorizeSubjectUsingContext(context, request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const markers = getRootMarkersOrDefault(request.markers);
-                if (request.action === 'list' && markers.length > 1) {
+    async _authorizeSubjectUsingContext(context, request) {
+        var _a, _b, _c;
+        try {
+            const markers = getRootMarkersOrDefault(request.markers);
+            let recommendedEntitlement = undefined;
+            if (request.action === 'list' && markers.length > 1) {
+                return {
+                    success: false,
+                    errorCode: 'not_authorized',
+                    errorMessage: `The "${request.action}" action cannot be used with multiple markers.`,
+                    reason: {
+                        type: 'too_many_markers',
+                    },
+                    recommendedEntitlement,
+                };
+            }
+            if (!context.userPrivacyFeatures.publishData) {
+                return {
+                    success: false,
+                    errorCode: 'not_authorized',
+                    errorMessage: 'You are not authorized to perform this action.',
+                    reason: {
+                        type: 'disabled_privacy_feature',
+                        recordName: context.recordName,
+                        subjectType: 'user',
+                        subjectId: context.userId,
+                        resourceKind: request.resourceKind,
+                        action: request.action,
+                        resourceId: request.resourceId,
+                        privacyFeature: 'publishData',
+                    },
+                    recommendedEntitlement,
+                };
+            }
+            const recordName = context.recordName;
+            const subjectType = request.subjectType;
+            let subjectId = request.subjectId;
+            if (subjectType === 'inst') {
+                subjectId = normalizeInstId(subjectId);
+            }
+            if (context.userRole === 'superUser' &&
+                request.subjectType !== 'inst') {
+                // super users are allowed to do anything for any user
+                // insts need to be authorized separately so that a malicious inst can't just do anything
+                // if a super user happens to visit it
+                return {
+                    success: true,
+                    recordName: recordName,
+                    permission: {
+                        id: null,
+                        recordName: recordName,
+                        userId: null,
+                        // Record owners are treated as if they are admins in the record
+                        subjectType: 'role',
+                        subjectId: ADMIN_ROLE_NAME,
+                        // Admins get all access to all resources in a record
+                        resourceKind: null,
+                        action: null,
+                        marker: markers[0],
+                        options: {},
+                        expireTimeMs: null,
+                    },
+                    explanation: `User is a superUser.`,
+                };
+            }
+            else if (context.userRole === 'system') {
+                return {
+                    success: true,
+                    recordName: recordName,
+                    permission: {
+                        id: null,
+                        recordName: recordName,
+                        userId: null,
+                        // Record owners are treated as if they are admins in the record
+                        subjectType: 'role',
+                        subjectId: ADMIN_ROLE_NAME,
+                        // Admins get all access to all resources in a record
+                        resourceKind: null,
+                        action: null,
+                        marker: markers[0],
+                        options: {},
+                        expireTimeMs: null,
+                    },
+                    explanation: `The system is requesting the action.`,
+                };
+            }
+            else if (context.userRole === 'moderator' &&
+                request.subjectType !== 'inst') {
+                // moderators are allowed to read anything for any user
+                // insts need to be authorized separately so that a malicious inst can't just read everything
+                // if a moderator happens to visit it
+                if (isAllowedModeratorResource(request.resourceKind, request.action)) {
+                    return {
+                        success: true,
+                        recordName: recordName,
+                        permission: {
+                            id: null,
+                            recordName: recordName,
+                            userId: null,
+                            // Record owners are treated as if they are admins in the record
+                            subjectType: 'role',
+                            subjectId: ADMIN_ROLE_NAME,
+                            // Admins get all access to all resources in a record
+                            resourceKind: null,
+                            action: request.action,
+                            marker: markers[0],
+                            options: {},
+                            expireTimeMs: null,
+                        },
+                        explanation: `User is a moderator.`,
+                    };
+                }
+            }
+            const publicPermission = getPublicMarkersPermission(markers, request.resourceKind, request.action);
+            if (context.recordOwnerId &&
+                context.userId !== context.recordOwnerId) {
+                if (!context.recordOwnerPrivacyFeatures.allowPublicData) {
                     return {
                         success: false,
                         errorCode: 'not_authorized',
-                        errorMessage: `The "${request.action}" action cannot be used with multiple markers.`,
+                        errorMessage: 'You are not authorized to perform this action.',
                         reason: {
-                            type: 'too_many_markers',
+                            type: 'disabled_privacy_feature',
+                            recordName: context.recordName,
+                            subjectType: 'user',
+                            subjectId: context.userId,
+                            resourceKind: request.resourceKind,
+                            action: request.action,
+                            resourceId: request.resourceId,
+                            privacyFeature: 'allowPublicData',
                         },
+                        recommendedEntitlement,
                     };
                 }
-                if (!context.userPrivacyFeatures.publishData) {
+                if (request.resourceKind === 'inst' &&
+                    (!context.recordOwnerPrivacyFeatures.allowPublicInsts ||
+                        !context.userPrivacyFeatures.allowPublicInsts)) {
                     return {
                         success: false,
                         errorCode: 'not_authorized',
@@ -568,139 +687,107 @@ export class PolicyController {
                             resourceKind: request.resourceKind,
                             action: request.action,
                             resourceId: request.resourceId,
-                            privacyFeature: 'publishData',
+                            privacyFeature: 'allowPublicInsts',
                         },
+                        recommendedEntitlement,
                     };
                 }
-                const recordName = context.recordName;
-                if (context.userRole === 'superUser') {
+            }
+            if (publicPermission) {
+                if (!context.userPrivacyFeatures.allowPublicData) {
                     return {
-                        success: true,
+                        success: false,
+                        errorCode: 'not_authorized',
+                        errorMessage: 'You are not authorized to perform this action.',
+                        reason: {
+                            type: 'disabled_privacy_feature',
+                            recordName: context.recordName,
+                            subjectType: 'user',
+                            subjectId: context.userId,
+                            resourceKind: request.resourceKind,
+                            action: request.action,
+                            resourceId: request.resourceId,
+                            privacyFeature: 'allowPublicData',
+                        },
+                        recommendedEntitlement,
+                    };
+                }
+                return {
+                    success: true,
+                    recordName,
+                    permission: {
+                        id: null,
                         recordName: recordName,
-                        permission: {
-                            id: null,
-                            recordName: recordName,
-                            userId: null,
-                            // Record owners are treated as if they are admins in the record
-                            subjectType: 'role',
-                            subjectId: ADMIN_ROLE_NAME,
-                            // Admins get all access to all resources in a record
-                            resourceKind: null,
-                            action: null,
-                            marker: markers[0],
-                            options: {},
-                            expireTimeMs: null,
-                        },
-                        explanation: `User is a superUser.`,
-                    };
-                }
-                else if (context.userRole === 'moderator') {
-                    if (isAllowedModeratorResource(request.resourceKind, request.action)) {
-                        return {
-                            success: true,
-                            recordName: recordName,
-                            permission: {
-                                id: null,
-                                recordName: recordName,
-                                userId: null,
-                                // Record owners are treated as if they are admins in the record
-                                subjectType: 'role',
-                                subjectId: ADMIN_ROLE_NAME,
-                                // Admins get all access to all resources in a record
-                                resourceKind: null,
-                                action: request.action,
-                                marker: markers[0],
-                                options: {},
-                                expireTimeMs: null,
-                            },
-                            explanation: `User is a moderator.`,
-                        };
-                    }
-                }
-                const subjectType = request.subjectType;
-                let subjectId = request.subjectId;
-                if (subjectType === 'inst') {
-                    subjectId = normalizeInstId(subjectId);
-                }
-                const publicPermission = getPublicMarkersPermission(markers, request.resourceKind, request.action);
-                if (context.recordOwnerId &&
-                    context.userId !== context.recordOwnerId) {
-                    if (!context.recordOwnerPrivacyFeatures.allowPublicData) {
-                        return {
-                            success: false,
-                            errorCode: 'not_authorized',
-                            errorMessage: 'You are not authorized to perform this action.',
-                            reason: {
-                                type: 'disabled_privacy_feature',
-                                recordName: context.recordName,
-                                subjectType: 'user',
-                                subjectId: context.userId,
-                                resourceKind: request.resourceKind,
-                                action: request.action,
-                                resourceId: request.resourceId,
-                                privacyFeature: 'allowPublicData',
-                            },
-                        };
-                    }
-                    if (request.resourceKind === 'inst' &&
-                        (!context.recordOwnerPrivacyFeatures.allowPublicInsts ||
-                            !context.userPrivacyFeatures.allowPublicInsts)) {
-                        return {
-                            success: false,
-                            errorCode: 'not_authorized',
-                            errorMessage: 'You are not authorized to perform this action.',
-                            reason: {
-                                type: 'disabled_privacy_feature',
-                                recordName: context.recordName,
-                                subjectType: 'user',
-                                subjectId: context.userId,
-                                resourceKind: request.resourceKind,
-                                action: request.action,
-                                resourceId: request.resourceId,
-                                privacyFeature: 'allowPublicInsts',
-                            },
-                        };
-                    }
-                }
-                if (publicPermission) {
-                    if (!context.userPrivacyFeatures.allowPublicData) {
-                        return {
-                            success: false,
-                            errorCode: 'not_authorized',
-                            errorMessage: 'You are not authorized to perform this action.',
-                            reason: {
-                                type: 'disabled_privacy_feature',
-                                recordName: context.recordName,
-                                subjectType: 'user',
-                                subjectId: context.userId,
-                                resourceKind: request.resourceKind,
-                                action: request.action,
-                                resourceId: request.resourceId,
-                                privacyFeature: 'allowPublicData',
-                            },
-                        };
-                    }
+                        userId: null,
+                        subjectType: subjectType,
+                        subjectId: subjectId,
+                        resourceKind: publicPermission.resourceKind,
+                        action: publicPermission.action,
+                        marker: publicPermission.marker,
+                        options: {},
+                        expireTimeMs: null,
+                    },
+                    explanation: publicPermission.marker === PUBLIC_READ_MARKER
+                        ? 'Resource has the publicRead marker.'
+                        : 'Resource has the publicWrite marker.',
+                };
+            }
+            if (subjectType === 'role' && subjectId === ADMIN_ROLE_NAME) {
+                return {
+                    success: true,
+                    recordName: recordName,
+                    permission: {
+                        id: null,
+                        recordName: recordName,
+                        userId: null,
+                        // Record owners are treated as if they are admins in the record
+                        subjectType: 'role',
+                        subjectId: ADMIN_ROLE_NAME,
+                        // Admins get all access to all resources in a record
+                        resourceKind: null,
+                        action: null,
+                        marker: markers[0],
+                        options: {},
+                        expireTimeMs: null,
+                    },
+                    explanation: `Role is "${ADMIN_ROLE_NAME}".`,
+                };
+            }
+            if (context.recordKeyProvided &&
+                context.recordKeyResult &&
+                context.recordKeyResult.success &&
+                isAllowedRecordKeyResource(request.resourceKind, request.action)) {
+                if (context.subjectPolicy === 'subjectfull' &&
+                    subjectType === 'user' &&
+                    !subjectId) {
                     return {
-                        success: true,
-                        recordName,
-                        permission: {
-                            id: null,
-                            recordName: recordName,
-                            userId: null,
-                            subjectType: subjectType,
-                            subjectId: subjectId,
-                            resourceKind: publicPermission.resourceKind,
-                            action: publicPermission.action,
-                            marker: publicPermission.marker,
-                            options: {},
-                            expireTimeMs: null,
-                        },
-                        explanation: publicPermission.marker === PUBLIC_READ_MARKER
-                            ? 'Resource has the publicRead marker.'
-                            : 'Resource has the publicWrite marker.',
+                        success: false,
+                        errorCode: 'not_logged_in',
+                        errorMessage: 'You must be logged in in order to use this record key.',
                     };
                 }
-                if (subjectType === 'role' && subjectId === ADMIN_ROLE_NAME) {
+                return {
+                    success: true,
+                    recordName: context.recordName,
+                    permission: {
+                        id: null,
+                        recordName: recordName,
+                        userId: null,
+                        // Record owners are treated as if they are admins in the record
+                        subjectType: 'role',
+                        subjectId: ADMIN_ROLE_NAME,
+                        // Admins get all access to all resources in a record
+                        resourceKind: request.resourceKind,
+                        action: request.action,
+                        marker: markers[0],
+                        options: {},
+                        expireTimeMs: null,
+                    },
+                    explanation: 'A recordKey was used.',
+                };
+            }
+            if (subjectType === 'user' && subjectId) {
+                if (subjectId === context.recordOwnerId) {
                     return {
                         success: true,
                         recordName: recordName,
@@ -718,130 +805,165 @@ export class PolicyController {
                             options: {},
                             expireTimeMs: null,
                         },
-                        explanation: `Role is "${ADMIN_ROLE_NAME}".`,
+                        explanation: 'User is the owner of the record.',
                     };
                 }
-                if (context.recordKeyProvided &&
-                    context.recordKeyResult &&
-                    context.recordKeyResult.success &&
-                    isAllowedRecordKeyResource(request.resourceKind, request.action)) {
-                    if (context.subjectPolicy === 'subjectfull' &&
-                        subjectType === 'user' &&
-                        !subjectId) {
-                        return {
-                            success: false,
-                            errorCode: 'not_logged_in',
-                            errorMessage: 'You must be logged in in order to use this record key.',
-                        };
-                    }
-                    return {
-                        success: true,
-                        recordName: context.recordName,
-                        permission: {
-                            id: null,
-                            recordName: recordName,
-                            userId: null,
-                            // Record owners are treated as if they are admins in the record
-                            subjectType: 'role',
-                            subjectId: ADMIN_ROLE_NAME,
-                            // Admins get all access to all resources in a record
-                            resourceKind: request.resourceKind,
-                            action: request.action,
-                            marker: markers[0],
-                            options: {},
-                            expireTimeMs: null,
-                        },
-                        explanation: 'A recordKey was used.',
-                    };
-                }
-                if (subjectType === 'user' && subjectId) {
-                    if (subjectId === context.recordOwnerId) {
-                        return {
-                            success: true,
-                            recordName: recordName,
-                            permission: {
-                                id: null,
+                else if (context.recordStudioMembers) {
+                    const member = context.recordStudioMembers.find((m) => m.userId === subjectId);
+                    if (member) {
+                        if (member.role === 'admin') {
+                            return {
+                                success: true,
                                 recordName: recordName,
-                                userId: null,
-                                // Record owners are treated as if they are admins in the record
-                                subjectType: 'role',
-                                subjectId: ADMIN_ROLE_NAME,
-                                // Admins get all access to all resources in a record
-                                resourceKind: null,
-                                action: null,
-                                marker: markers[0],
-                                options: {},
-                                expireTimeMs: null,
-                            },
-                            explanation: 'User is the owner of the record.',
-                        };
-                    }
-                    else if (context.recordStudioMembers) {
-                        const member = context.recordStudioMembers.find((m) => m.userId === subjectId);
-                        if (member) {
-                            if (member.role === 'admin') {
+                                permission: {
+                                    id: null,
+                                    recordName: recordName,
+                                    userId: null,
+                                    // Admins in a studio are treated as if they are admins in the record.
+                                    subjectType: 'role',
+                                    subjectId: ADMIN_ROLE_NAME,
+                                    // Admins get all access to all resources in a record
+                                    resourceKind: null,
+                                    action: null,
+                                    marker: markers[0],
+                                    options: {},
+                                    // No expiration
+                                    expireTimeMs: null,
+                                },
+                                explanation: "User is an admin in the record's studio.",
+                            };
+                        }
+                        else if (member.role === 'member') {
+                            let isAssigningDefaultMarker = (request.resourceKind === 'marker' &&
+                                request.resourceId ===
+                                    PUBLIC_READ_MARKER) ||
+                                request.resourceId === PRIVATE_MARKER;
+                            if (isAssigningDefaultMarker ||
+                                isAllowedStudioMemberResource(request.resourceKind, request.action)) {
                                 return {
                                     success: true,
                                     recordName: recordName,
                                     permission: {
                                         id: null,
                                         recordName: recordName,
-                                        userId: null,
-                                        // Admins in a studio are treated as if they are admins in the record.
-                                        subjectType: 'role',
-                                        subjectId: ADMIN_ROLE_NAME,
-                                        // Admins get all access to all resources in a record
-                                        resourceKind: null,
-                                        action: null,
+                                        // Members in a studio are treated as if they are granted direct access to most resources
+                                        // in the record.
+                                        userId: subjectId,
+                                        subjectType: 'user',
+                                        subjectId: subjectId,
+                                        // Not all actions or resources are granted though
+                                        resourceKind: request.resourceKind,
+                                        action: request.action,
                                         marker: markers[0],
                                         options: {},
-                                        // No expiration
                                         expireTimeMs: null,
                                     },
-                                    explanation: "User is an admin in the record's studio.",
+                                    explanation: "User is a member in the record's studio.",
                                 };
                             }
-                            else if (member.role === 'member') {
-                                let isAssigningDefaultMarker = (request.resourceKind === 'marker' &&
-                                    request.resourceId ===
-                                        PUBLIC_READ_MARKER) ||
-                                    request.resourceId === PRIVATE_MARKER;
-                                if (isAssigningDefaultMarker ||
-                                    isAllowedStudioMemberResource(request.resourceKind, request.action)) {
-                                    return {
-                                        success: true,
-                                        recordName: recordName,
-                                        permission: {
-                                            id: null,
-                                            recordName: recordName,
-                                            // Members in a studio are treated as if they are granted direct access to most resources
-                                            // in the record.
-                                            userId: subjectId,
-                                            subjectType: 'user',
-                                            subjectId: subjectId,
-                                            // Not all actions or resources are granted though
-                                            resourceKind: request.resourceKind,
-                                            action: request.action,
-                                            marker: markers[0],
-                                            options: {},
-                                            expireTimeMs: null,
-                                        },
-                                        explanation: "User is a member in the record's studio.",
-                                    };
+                        }
+                    }
+                }
+            }
+            else if (subjectType === 'inst' && subjectId) {
+                const instId = parseInstId(subjectId);
+                if (!instId) {
+                    return {
+                        success: false,
+                        errorCode: 'unacceptable_request',
+                        errorMessage: 'Invalid inst ID. It must contain a forward slash',
+                    };
+                }
+                const entitlementFeature = getEntitlementFeatureForAction(request.resourceKind, request.action);
+                let hasPackages = false;
+                if (entitlementFeature) {
+                    const loadedPackages = (_b = (await ((_a = this._insts) === null || _a === void 0 ? void 0 : _a.listLoadedPackages(instId.recordName, instId.inst)))) !== null && _b !== void 0 ? _b : [];
+                    const grantedEntitlements = await this._policies.listGrantedEntitlementsByFeatureAndUserId(loadedPackages.map((p) => p.packageId), entitlementFeature, context.userId, context.recordName, Date.now());
+                    if ((loadedPackages === null || loadedPackages === void 0 ? void 0 : loadedPackages.length) > 0 ||
+                        (grantedEntitlements === null || grantedEntitlements === void 0 ? void 0 : grantedEntitlements.length) > 0) {
+                        hasPackages = true;
+                    }
+                    if (grantedEntitlements && grantedEntitlements.length > 0) {
+                        // check scope
+                        const entitlement = grantedEntitlements.find((entitlement) => {
+                            if (entitlement.revokeTimeMs === null &&
+                                entitlement.scope === 'designated' &&
+                                entitlement.recordName ===
+                                    context.recordName) {
+                                // Entitlement is for the current record
+                                return true;
+                            }
+                            else {
+                                return false;
+                            }
+                        });
+                        if (entitlement) {
+                            const loadedPackage = loadedPackages.find((lp) => lp.packageId === entitlement.packageId);
+                            return {
+                                success: true,
+                                recordName,
+                                permission: {
+                                    id: null,
+                                    recordName,
+                                    userId: context.userId,
+                                    subjectType: 'inst',
+                                    subjectId: subjectId,
+                                    // Not all actions or resources are granted though
+                                    resourceKind: request.resourceKind,
+                                    resourceId: request.resourceId,
+                                    action: request.action,
+                                    options: {},
+                                    expireTimeMs: entitlement.expireTimeMs,
+                                },
+                                entitlementGrant: {
+                                    ...entitlement,
+                                    loadedPackage,
+                                },
+                                explanation: `Inst has entitlement.`,
+                            };
+                        }
+                    }
+                    if (hasPackages) {
+                        const firstPackage = loadedPackages[0];
+                        const pkg = await ((_c = this._packageVersions) === null || _c === void 0 ? void 0 : _c.getItemById(firstPackage.packageVersionId));
+                        if (pkg === null || pkg === void 0 ? void 0 : pkg.item) {
+                            const canRecommendEntitlement = pkg.item.entitlements.some((e) => {
+                                var _a, _b;
+                                if (e.scope === 'personal' &&
+                                    context.userId === context.recordName) {
+                                    return true;
+                                }
+                                else if (e.scope === 'owned' &&
+                                    context.recordOwnerId === context.userId) {
+                                    return true;
+                                }
+                                else if (e.scope === 'studio' &&
+                                    ((_a = context.recordStudioMembers) === null || _a === void 0 ? void 0 : _a.some((m) => m.userId === context.userId))) {
+                                    return true;
+                                }
+                                else if (e.scope === 'designated' &&
+                                    ((_b = e.designatedRecords) === null || _b === void 0 ? void 0 : _b.includes(context.recordName))) {
+                                    return true;
+                                }
+                                else if (e.scope === 'shared') {
+                                    return true;
                                 }
+                                return false;
+                            });
+                            if (canRecommendEntitlement) {
+                                recommendedEntitlement = {
+                                    feature: entitlementFeature,
+                                    scope: 'designated',
+                                    recordName: context.recordName,
+                                    packageId: loadedPackages[0].packageId,
+                                };
                             }
                         }
                     }
                 }
-                else if (subjectType === 'inst' && subjectId) {
-                    const instId = parseInstId(subjectId);
-                    if (!instId) {
-                        return {
-                            success: false,
-                            errorCode: 'unacceptable_request',
-                            errorMessage: 'Invalid inst ID. It must contain a forward slash',
-                        };
-                    }
+                // Automatic permissions don't apply to insts with packages
+                // TODO: Maybe add a flag for insts to choose whether they want automatic permissions or if they have to explicitly grant them or use packages
+                if (!hasPackages) {
                     if (instId.recordName) {
                         if (instId.recordName === recordName) {
                             return {
@@ -864,7 +986,7 @@ export class PolicyController {
                                 explanation: `Inst is owned by the record.`,
                             };
                         }
-                        const instRecord = yield this._records.validateRecordName(instId.recordName, context.userId);
+                        const instRecord = await this._records.validateRecordName(instId.recordName, context.userId);
                         if (instRecord.success === false) {
                             return instRecord;
                         }
@@ -914,95 +1036,96 @@ export class PolicyController {
                         }
                     }
                 }
-                if (subjectId) {
-                    if (subjectType === 'inst' || subjectType === 'user') {
-                        // check for admin role
-                        const roles = subjectType === 'user'
-                            ? yield this._policies.listRolesForUser(recordName, subjectId)
-                            : yield this._policies.listRolesForInst(recordName, subjectId);
-                        const role = roles.find((r) => r.role === ADMIN_ROLE_NAME);
-                        if (role) {
-                            const kindString = subjectType === 'user' ? 'User' : 'Inst';
-                            return {
-                                success: true,
-                                recordName: recordName,
-                                permission: {
-                                    id: null,
-                                    recordName: recordName,
-                                    userId: null,
-                                    // Admins in a studio are treated as if they are admins in the record.
-                                    subjectType: 'role',
-                                    subjectId: ADMIN_ROLE_NAME,
-                                    // Admins get all access to all resources in a record
-                                    resourceKind: null,
-                                    action: null,
-                                    marker: markers[0],
-                                    options: {},
-                                    // No expiration
-                                    expireTimeMs: role.expireTimeMs,
-                                },
-                                explanation: `${kindString} is assigned the "${ADMIN_ROLE_NAME}" role.`,
-                            };
-                        }
-                    }
-                    let permission = null;
-                    if (request.resourceId) {
-                        const result = yield this._policies.getPermissionForSubjectAndResource(subjectType, subjectId, recordName, request.resourceKind, request.resourceId, request.action, Date.now());
-                        if (result.success === false) {
-                            return result;
-                        }
-                        permission = result.permissionAssignment;
-                    }
-                    if (!permission) {
-                        const result = yield this._policies.getPermissionForSubjectAndMarkers(subjectType, subjectId, recordName, request.resourceKind, markers, request.action, Date.now());
-                        if (result.success === false) {
-                            return result;
-                        }
-                        permission = result.permissionAssignment;
-                    }
-                    if (permission) {
+            }
+            if (subjectId) {
+                if (subjectType === 'inst' || subjectType === 'user') {
+                    // check for admin role
+                    const roles = subjectType === 'user'
+                        ? await this._policies.listRolesForUser(recordName, subjectId)
+                        : await this._policies.listRolesForInst(recordName, subjectId);
+                    const role = roles.find((r) => r.role === ADMIN_ROLE_NAME);
+                    if (role) {
+                        const kindString = subjectType === 'user' ? 'User' : 'Inst';
                         return {
                             success: true,
-                            recordName,
-                            permission: permission,
-                            explanation: explainationForPermissionAssignment(subjectType, permission),
+                            recordName: recordName,
+                            permission: {
+                                id: null,
+                                recordName: recordName,
+                                userId: null,
+                                // Admins in a studio are treated as if they are admins in the record.
+                                subjectType: 'role',
+                                subjectId: ADMIN_ROLE_NAME,
+                                // Admins get all access to all resources in a record
+                                resourceKind: null,
+                                action: null,
+                                marker: markers[0],
+                                options: {},
+                                // No expiration
+                                expireTimeMs: role.expireTimeMs,
+                            },
+                            explanation: `${kindString} is assigned the "${ADMIN_ROLE_NAME}" role.`,
                         };
                     }
                 }
-                if (context.sendNotLoggedIn &&
-                    !subjectId &&
-                    (!context.recordKeyProvided ||
-                        !isAllowedRecordKeyResource(request.resourceKind, request.action))) {
+                let permission = null;
+                if (request.resourceId) {
+                    const result = await this._policies.getPermissionForSubjectAndResource(subjectType, subjectId, recordName, request.resourceKind, request.resourceId, request.action, Date.now());
+                    if (result.success === false) {
+                        return result;
+                    }
+                    permission = result.permissionAssignment;
+                }
+                if (!permission) {
+                    const result = await this._policies.getPermissionForSubjectAndMarkers(subjectType, subjectId, recordName, request.resourceKind, markers, request.action, Date.now());
+                    if (result.success === false) {
+                        return result;
+                    }
+                    permission = result.permissionAssignment;
+                }
+                if (permission) {
                     return {
-                        success: false,
-                        errorCode: 'not_logged_in',
-                        errorMessage: 'The user must be logged in. Please provide a sessionKey or a recordKey.',
+                        success: true,
+                        recordName,
+                        permission: permission,
+                        explanation: explainationForPermissionAssignment(subjectType, permission),
                     };
                 }
-                return {
-                    success: false,
-                    errorCode: 'not_authorized',
-                    errorMessage: 'You are not authorized to perform this action.',
-                    reason: {
-                        type: 'missing_permission',
-                        recordName: recordName,
-                        subjectType: subjectType,
-                        subjectId: subjectId,
-                        resourceKind: request.resourceKind,
-                        resourceId: request.resourceId,
-                        action: request.action,
-                    },
-                };
             }
-            catch (err) {
-                console.error('[PolicyController] A server error occurred while authorizing a subject.', err);
+            if (context.sendNotLoggedIn &&
+                !subjectId &&
+                (!context.recordKeyProvided ||
+                    !isAllowedRecordKeyResource(request.resourceKind, request.action))) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'not_logged_in',
+                    errorMessage: 'The user must be logged in. Please provide a sessionKey or a recordKey.',
                 };
             }
-        });
+            return {
+                success: false,
+                errorCode: 'not_authorized',
+                errorMessage: 'You are not authorized to perform this action.',
+                reason: {
+                    type: 'missing_permission',
+                    recordName: recordName,
+                    subjectType: subjectType,
+                    subjectId: subjectId,
+                    resourceKind: request.resourceKind,
+                    resourceId: request.resourceId,
+                    action: request.action,
+                },
+                recommendedEntitlement,
+            };
+        }
+        catch (err) {
+            console.error('[PolicyController] A server error occurred while authorizing a subject.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Gets the list of permissions in the given record.
@@ -1010,70 +1133,68 @@ export class PolicyController {
      * @param userId The ID of the currently logged in user.
      * @param instances The instances that are loaded.
      */
-    listPermissions(recordKeyOrRecordName, userId, instances) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const context = yield this.constructAuthorizationContext({
-                    recordKeyOrRecordName,
-                    userId,
-                });
-                if (context.success === false) {
-                    return context;
-                }
-                const authorization = yield this.authorizeUserAndInstances(context.context, {
-                    userId,
-                    instances,
-                    resourceKind: 'marker',
-                    action: 'list',
-                    markers: [ACCOUNT_MARKER],
-                });
-                if (authorization.success === false) {
-                    return authorization;
-                }
-                const recordName = context.context.recordName;
-                const result = yield this._policies.listPermissionsInRecord(recordName);
-                if (result.success === false) {
-                    return result;
-                }
-                return {
-                    success: true,
-                    recordName,
-                    resourcePermissions: result.resourceAssignments.map((r) => ({
-                        id: r.id,
-                        recordName: r.recordName,
-                        subjectType: r.subjectType,
-                        subjectId: r.subjectId,
-                        resourceKind: r.resourceKind,
-                        action: r.action,
-                        resourceId: r.resourceId,
-                        options: r.options,
-                        expireTimeMs: r.expireTimeMs,
-                    })),
-                    markerPermissions: result.markerAssignments.map((r) => ({
-                        id: r.id,
-                        recordName: r.recordName,
-                        subjectType: r.subjectType,
-                        subjectId: r.subjectId,
-                        resourceKind: r.resourceKind,
-                        action: r.action,
-                        marker: r.marker,
-                        options: r.options,
-                        expireTimeMs: r.expireTimeMs,
-                    })),
-                };
+    async listPermissions(recordKeyOrRecordName, userId, instances) {
+        try {
+            const context = await this.constructAuthorizationContext({
+                recordKeyOrRecordName,
+                userId,
+            });
+            if (context.success === false) {
+                return context;
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred while listing permissions.', err);
-                return {
-                    success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
-                };
+            const authorization = await this.authorizeUserAndInstances(context.context, {
+                userId,
+                instances,
+                resourceKind: 'marker',
+                action: 'list',
+                markers: [ACCOUNT_MARKER],
+            });
+            if (authorization.success === false) {
+                return authorization;
             }
-        });
+            const recordName = context.context.recordName;
+            const result = await this._policies.listPermissionsInRecord(recordName);
+            if (result.success === false) {
+                return result;
+            }
+            return {
+                success: true,
+                recordName,
+                resourcePermissions: result.resourceAssignments.map((r) => ({
+                    id: r.id,
+                    recordName: r.recordName,
+                    subjectType: r.subjectType,
+                    subjectId: r.subjectId,
+                    resourceKind: r.resourceKind,
+                    action: r.action,
+                    resourceId: r.resourceId,
+                    options: r.options,
+                    expireTimeMs: r.expireTimeMs,
+                })),
+                markerPermissions: result.markerAssignments.map((r) => ({
+                    id: r.id,
+                    recordName: r.recordName,
+                    subjectType: r.subjectType,
+                    subjectId: r.subjectId,
+                    resourceKind: r.resourceKind,
+                    action: r.action,
+                    marker: r.marker,
+                    options: r.options,
+                    expireTimeMs: r.expireTimeMs,
+                })),
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred while listing permissions.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Gets the list of permissions that have been assigned to the given marker.
@@ -1082,57 +1203,55 @@ export class PolicyController {
      * @param userId The ID of the currently logged in user.
      * @param instances The instances that are loaded.
      */
-    listPermissionsForMarker(recordKeyOrRecordName, marker, userId, instances) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                marker = getRootMarker(marker);
-                const context = yield this.constructAuthorizationContext({
-                    recordKeyOrRecordName,
-                    userId,
-                });
-                if (context.success === false) {
-                    return context;
-                }
-                const authorization = yield this.authorizeUserAndInstances(context.context, {
-                    userId,
-                    instances,
-                    resourceKind: 'marker',
-                    action: 'list',
-                    markers: [ACCOUNT_MARKER],
-                });
-                if (authorization.success === false) {
-                    return authorization;
-                }
-                const recordName = context.context.recordName;
-                const result = yield this._policies.listPermissionsForMarker(recordName, marker);
-                return {
-                    success: true,
-                    recordName,
-                    markerPermissions: result.map((r) => ({
-                        id: r.id,
-                        recordName: r.recordName,
-                        subjectType: r.subjectType,
-                        subjectId: r.subjectId,
-                        resourceKind: r.resourceKind,
-                        action: r.action,
-                        marker: r.marker,
-                        options: r.options,
-                        expireTimeMs: r.expireTimeMs,
-                    })),
-                };
+    async listPermissionsForMarker(recordKeyOrRecordName, marker, userId, instances) {
+        try {
+            marker = getRootMarker(marker);
+            const context = await this.constructAuthorizationContext({
+                recordKeyOrRecordName,
+                userId,
+            });
+            if (context.success === false) {
+                return context;
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred while listing permissions for marker.', err);
-                return {
-                    success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
-                };
+            const authorization = await this.authorizeUserAndInstances(context.context, {
+                userId,
+                instances,
+                resourceKind: 'marker',
+                action: 'list',
+                markers: [ACCOUNT_MARKER],
+            });
+            if (authorization.success === false) {
+                return authorization;
             }
-        });
+            const recordName = context.context.recordName;
+            const result = await this._policies.listPermissionsForMarker(recordName, marker);
+            return {
+                success: true,
+                recordName,
+                markerPermissions: result.map((r) => ({
+                    id: r.id,
+                    recordName: r.recordName,
+                    subjectType: r.subjectType,
+                    subjectId: r.subjectId,
+                    resourceKind: r.resourceKind,
+                    action: r.action,
+                    marker: r.marker,
+                    options: r.options,
+                    expireTimeMs: r.expireTimeMs,
+                })),
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred while listing permissions for marker.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Gets the list of permissions that have been assigned to the given marker.
@@ -1142,406 +1261,341 @@ export class PolicyController {
      * @param userId The ID of the currently logged in user.
      * @param instances The instances that are loaded.
      */
-    listPermissionsForResource(recordKeyOrRecordName, resourceKind, resourceId, userId, instances) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const context = yield this.constructAuthorizationContext({
-                    recordKeyOrRecordName,
-                    userId,
-                });
-                if (context.success === false) {
-                    return context;
-                }
-                const authorization = yield this.authorizeUserAndInstances(context.context, {
-                    userId,
-                    instances,
-                    resourceKind: 'marker',
-                    action: 'list',
-                    markers: [ACCOUNT_MARKER],
-                });
-                if (authorization.success === false) {
-                    return authorization;
-                }
-                const recordName = context.context.recordName;
-                const result = yield this._policies.listPermissionsForResource(recordName, resourceKind, resourceId);
-                return {
-                    success: true,
-                    recordName,
-                    resourcePermissions: result.map((r) => ({
-                        id: r.id,
-                        recordName: r.recordName,
-                        subjectType: r.subjectType,
-                        subjectId: r.subjectId,
-                        resourceKind: r.resourceKind,
-                        action: r.action,
-                        resourceId: r.resourceId,
-                        options: r.options,
-                        expireTimeMs: r.expireTimeMs,
-                    })),
-                };
+    async listPermissionsForResource(recordKeyOrRecordName, resourceKind, resourceId, userId, instances) {
+        try {
+            const context = await this.constructAuthorizationContext({
+                recordKeyOrRecordName,
+                userId,
+            });
+            if (context.success === false) {
+                return context;
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred while listing permissions for resource.', err);
-                return {
-                    success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
-                };
+            const authorization = await this.authorizeUserAndInstances(context.context, {
+                userId,
+                instances,
+                resourceKind: 'marker',
+                action: 'list',
+                markers: [ACCOUNT_MARKER],
+            });
+            if (authorization.success === false) {
+                return authorization;
             }
-        });
+            const recordName = context.context.recordName;
+            const result = await this._policies.listPermissionsForResource(recordName, resourceKind, resourceId);
+            return {
+                success: true,
+                recordName,
+                resourcePermissions: result.map((r) => ({
+                    id: r.id,
+                    recordName: r.recordName,
+                    subjectType: r.subjectType,
+                    subjectId: r.subjectId,
+                    resourceKind: r.resourceKind,
+                    action: r.action,
+                    resourceId: r.resourceId,
+                    options: r.options,
+                    expireTimeMs: r.expireTimeMs,
+                })),
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred while listing permissions for resource.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Attempts to grant a permission to a marker.
      * @param request The request for the operation.
      */
-    grantMarkerPermission(request) {
+    async grantMarkerPermission(request) {
         var _a, _b, _c;
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const baseRequest = {
-                    recordKeyOrRecordName: request.recordKeyOrRecordName,
-                    userId: request.userId,
-                };
-                const context = yield this.constructAuthorizationContext(baseRequest);
-                if (context.success === false) {
-                    return {
-                        success: false,
-                        errorCode: context.errorCode,
-                        errorMessage: context.errorMessage,
-                    };
-                }
-                const marker = getRootMarker(request.marker);
-                const authorization = yield this.authorizeUserAndInstances(context.context, {
-                    action: 'grantPermission',
-                    resourceKind: 'marker',
-                    resourceId: marker,
-                    markers: [ACCOUNT_MARKER],
-                    userId: request.userId,
-                    instances: request.instances,
-                });
-                if (authorization.success === false) {
-                    return authorization;
-                }
-                const recordName = context.context.recordName;
-                const assignmentResult = yield this._policies.assignPermissionToSubjectAndMarker(recordName, request.permission.subjectType, request.permission.subjectId, request.permission.resourceKind, marker, request.permission.action, request.permission.options, request.permission.expireTimeMs);
-                if (assignmentResult.success === false) {
-                    return assignmentResult;
-                }
-                console.log(`[PolicyController] [grantMarkerPermission] [userId: ${request.userId}, recordName: ${recordName}, subjectType: ${request.permission.subjectType}, subjectId: ${request.permission.subjectId}, marker: ${marker}, resourceKind: ${(_a = request.permission.resourceKind) !== null && _a !== void 0 ? _a : '(null)'}, action: ${(_b = request.permission.action) !== null && _b !== void 0 ? _b : '(null)'}, expireTimeMs: ${(_c = request.permission.expireTimeMs) !== null && _c !== void 0 ? _c : '(null)'}, permissionId: ${assignmentResult.permissionAssignment.id}] Granted marker permission.`);
-                return {
-                    success: true,
-                };
-            }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred while granting a marker permission.', err);
+        try {
+            const baseRequest = {
+                recordKeyOrRecordName: request.recordKeyOrRecordName,
+                userId: request.userId,
+            };
+            const context = await this.constructAuthorizationContext(baseRequest);
+            if (context.success === false) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: context.errorCode,
+                    errorMessage: context.errorMessage,
                 };
             }
-        });
+            const marker = getRootMarker(request.marker);
+            const authorization = await this.authorizeUserAndInstances(context.context, {
+                action: 'grantPermission',
+                resourceKind: 'marker',
+                resourceId: marker,
+                markers: [ACCOUNT_MARKER],
+                userId: request.userId,
+                instances: request.instances,
+            });
+            if (authorization.success === false) {
+                return authorization;
+            }
+            const recordName = context.context.recordName;
+            const assignmentResult = await this._policies.assignPermissionToSubjectAndMarker(recordName, request.permission.subjectType, request.permission.subjectId, request.permission.resourceKind, marker, request.permission.action, request.permission.options, request.permission.expireTimeMs);
+            if (assignmentResult.success === false) {
+                return assignmentResult;
+            }
+            console.log(`[PolicyController] [grantMarkerPermission] [userId: ${request.userId}, recordName: ${recordName}, subjectType: ${request.permission.subjectType}, subjectId: ${request.permission.subjectId}, marker: ${marker}, resourceKind: ${(_a = request.permission.resourceKind) !== null && _a !== void 0 ? _a : '(null)'}, action: ${(_b = request.permission.action) !== null && _b !== void 0 ? _b : '(null)'}, expireTimeMs: ${(_c = request.permission.expireTimeMs) !== null && _c !== void 0 ? _c : '(null)'}, permissionId: ${assignmentResult.permissionAssignment.id}] Granted marker permission.`);
+            return {
+                success: true,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred while granting a marker permission.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Attempts to revoke a permission from a marker.
      * @param request The request for the operation.
      */
-    revokeMarkerPermission(request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const permission = yield this._policies.getMarkerPermissionAssignmentById(request.permissionId);
-                if (!permission) {
-                    return {
-                        success: false,
-                        errorCode: 'permission_not_found',
-                        errorMessage: 'The permission was not found.',
-                    };
-                }
-                const baseRequest = {
-                    recordKeyOrRecordName: permission.recordName,
-                    userId: request.userId,
-                };
-                const context = yield this.constructAuthorizationContext(baseRequest);
-                if (context.success === false) {
-                    return {
-                        success: false,
-                        errorCode: context.errorCode,
-                        errorMessage: context.errorMessage,
-                    };
-                }
-                const authorization = yield this.authorizeUserAndInstances(context.context, {
-                    action: 'revokePermission',
-                    resourceKind: 'marker',
-                    resourceId: permission.marker,
-                    markers: [ACCOUNT_MARKER],
-                    userId: request.userId,
-                    instances: request.instances,
-                });
-                if (authorization.success === false) {
-                    return authorization;
-                }
-                const deleteResult = yield this._policies.deleteMarkerPermissionAssignmentById(permission.id);
-                if (!deleteResult.success) {
-                    return deleteResult;
-                }
-                console.log(`[PolicyController] [revokeMarkerPermission] [userId: ${request.userId}, permissionId: ${request.permissionId}] Revoked marker permission.`);
+    async revokeMarkerPermission(request) {
+        try {
+            const permission = await this._policies.getMarkerPermissionAssignmentById(request.permissionId);
+            if (!permission) {
                 return {
-                    success: true,
+                    success: false,
+                    errorCode: 'permission_not_found',
+                    errorMessage: 'The permission was not found.',
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred while revoking a marker permission.', err);
+            const baseRequest = {
+                recordKeyOrRecordName: permission.recordName,
+                userId: request.userId,
+            };
+            const context = await this.constructAuthorizationContext(baseRequest);
+            if (context.success === false) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: context.errorCode,
+                    errorMessage: context.errorMessage,
                 };
             }
-        });
+            const authorization = await this.authorizeUserAndInstances(context.context, {
+                action: 'revokePermission',
+                resourceKind: 'marker',
+                resourceId: permission.marker,
+                markers: [ACCOUNT_MARKER],
+                userId: request.userId,
+                instances: request.instances,
+            });
+            if (authorization.success === false) {
+                return authorization;
+            }
+            const deleteResult = await this._policies.deleteMarkerPermissionAssignmentById(permission.id);
+            if (!deleteResult.success) {
+                return deleteResult;
+            }
+            console.log(`[PolicyController] [revokeMarkerPermission] [userId: ${request.userId}, permissionId: ${request.permissionId}] Revoked marker permission.`);
+            return {
+                success: true,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred while revoking a marker permission.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Attempts to grant a permission to a resource.
      * @param request The request.
      */
-    grantResourcePermission(request) {
+    async grantResourcePermission(request) {
         var _a, _b, _c, _d;
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const baseRequest = {
-                    recordKeyOrRecordName: request.recordKeyOrRecordName,
-                    userId: request.userId,
+        try {
+            const baseRequest = {
+                recordKeyOrRecordName: request.recordKeyOrRecordName,
+                userId: request.userId,
+            };
+            const context = await this.constructAuthorizationContext(baseRequest);
+            if (context.success === false) {
+                return {
+                    success: false,
+                    errorCode: context.errorCode,
+                    errorMessage: context.errorMessage,
                 };
-                const context = yield this.constructAuthorizationContext(baseRequest);
-                if (context.success === false) {
-                    return {
-                        success: false,
-                        errorCode: context.errorCode,
-                        errorMessage: context.errorMessage,
-                    };
-                }
-                if (!request.permission.resourceId) {
-                    return {
-                        success: false,
-                        errorCode: 'unacceptable_request',
-                        errorMessage: 'You must provide a resourceId for the permission.',
-                    };
-                }
-                else if (!request.permission.resourceKind) {
-                    return {
-                        success: false,
-                        errorCode: 'unacceptable_request',
-                        errorMessage: 'You must provide a resourceKind for the permission.',
-                    };
-                }
-                const authorization = yield this.authorizeUserAndInstances(context.context, {
-                    action: 'grantPermission',
-                    // Resource permissions require access to the "account" marker
-                    // because there is currently no other marker that would make sense
-                    // for per-resource permissions.
-                    resourceKind: 'marker',
-                    resourceId: ACCOUNT_MARKER,
-                    markers: [ACCOUNT_MARKER],
-                    userId: request.userId,
-                    instances: request.instances,
-                });
-                if (authorization.success === false) {
-                    return authorization;
-                }
-                const recordName = context.context.recordName;
-                const assignmentResult = yield this._policies.assignPermissionToSubjectAndResource(recordName, request.permission.subjectType, request.permission.subjectId, request.permission.resourceKind, request.permission.resourceId, request.permission.action, request.permission.options, request.permission.expireTimeMs);
-                if (assignmentResult.success === false) {
-                    return assignmentResult;
-                }
-                console.log(`[PolicyController] [grantResourcePermission] [userId: ${request.userId}, recordName: ${recordName}, subjectType: ${request.permission.subjectType}, subjectId: ${request.permission.subjectId}, resourceKind: ${(_a = request.permission.resourceKind) !== null && _a !== void 0 ? _a : '(null)'}, resourceId: ${(_b = request.permission.resourceId) !== null && _b !== void 0 ? _b : '(null)'}, action: ${(_c = request.permission.action) !== null && _c !== void 0 ? _c : '(null)'}, expireTimeMs: ${(_d = request.permission.expireTimeMs) !== null && _d !== void 0 ? _d : '(null)'}, permissionId: ${assignmentResult.permissionAssignment.id}] Granted permission for resource.`);
+            }
+            if (!request.permission.resourceId) {
                 return {
-                    success: true,
+                    success: false,
+                    errorCode: 'unacceptable_request',
+                    errorMessage: 'You must provide a resourceId for the permission.',
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred while granting a resource permission.', err);
+            else if (!request.permission.resourceKind) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'unacceptable_request',
+                    errorMessage: 'You must provide a resourceKind for the permission.',
                 };
             }
-        });
+            const authorization = await this.authorizeUserAndInstances(context.context, {
+                action: 'grantPermission',
+                // Resource permissions require access to the "account" marker
+                // because there is currently no other marker that would make sense
+                // for per-resource permissions.
+                resourceKind: 'marker',
+                resourceId: ACCOUNT_MARKER,
+                markers: [ACCOUNT_MARKER],
+                userId: request.userId,
+                instances: request.instances,
+            });
+            if (authorization.success === false) {
+                return authorization;
+            }
+            const recordName = context.context.recordName;
+            const assignmentResult = await this._policies.assignPermissionToSubjectAndResource(recordName, request.permission.subjectType, request.permission.subjectId, request.permission.resourceKind, request.permission.resourceId, request.permission.action, request.permission.options, request.permission.expireTimeMs);
+            if (assignmentResult.success === false) {
+                return assignmentResult;
+            }
+            console.log(`[PolicyController] [grantResourcePermission] [userId: ${request.userId}, recordName: ${recordName}, subjectType: ${request.permission.subjectType}, subjectId: ${request.permission.subjectId}, resourceKind: ${(_a = request.permission.resourceKind) !== null && _a !== void 0 ? _a : '(null)'}, resourceId: ${(_b = request.permission.resourceId) !== null && _b !== void 0 ? _b : '(null)'}, action: ${(_c = request.permission.action) !== null && _c !== void 0 ? _c : '(null)'}, expireTimeMs: ${(_d = request.permission.expireTimeMs) !== null && _d !== void 0 ? _d : '(null)'}, permissionId: ${assignmentResult.permissionAssignment.id}] Granted permission for resource.`);
+            return {
+                success: true,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred while granting a resource permission.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Attempts to revoke a permission from a resource.
      * @param request The request for the operation.
      */
-    revokeResourcePermission(request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const permission = yield this._policies.getResourcePermissionAssignmentById(request.permissionId);
-                if (!permission) {
-                    return {
-                        success: false,
-                        errorCode: 'permission_not_found',
-                        errorMessage: 'The permission was not found.',
-                    };
-                }
-                const baseRequest = {
-                    recordKeyOrRecordName: permission.recordName,
-                    userId: request.userId,
-                };
-                const context = yield this.constructAuthorizationContext(baseRequest);
-                if (context.success === false) {
-                    return {
-                        success: false,
-                        errorCode: context.errorCode,
-                        errorMessage: context.errorMessage,
-                    };
-                }
-                const authorization = yield this.authorizeUserAndInstances(context.context, {
-                    action: 'revokePermission',
-                    resourceKind: 'marker',
-                    resourceId: ACCOUNT_MARKER,
-                    markers: [ACCOUNT_MARKER],
-                    userId: request.userId,
-                    instances: request.instances,
-                });
-                if (authorization.success === false) {
-                    return authorization;
-                }
-                const deleteResult = yield this._policies.deleteResourcePermissionAssignmentById(permission.id);
-                if (!deleteResult.success) {
-                    return deleteResult;
-                }
-                console.log(`[PolicyController] [revokeResourcePermission] [userId: ${request.userId}, permissionId: ${request.permissionId}] Revoked resource permission.`);
+    async revokeResourcePermission(request) {
+        try {
+            const permission = await this._policies.getResourcePermissionAssignmentById(request.permissionId);
+            if (!permission) {
                 return {
-                    success: true,
+                    success: false,
+                    errorCode: 'permission_not_found',
+                    errorMessage: 'The permission was not found.',
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred while revoking a resource permission.', err);
+            const baseRequest = {
+                recordKeyOrRecordName: permission.recordName,
+                userId: request.userId,
+            };
+            const context = await this.constructAuthorizationContext(baseRequest);
+            if (context.success === false) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: context.errorCode,
+                    errorMessage: context.errorMessage,
                 };
             }
-        });
-    }
-    /**
-     * Attempts to revoke the permission with the given ID.
-     * @param request The request for the operation.
-     */
-    revokePermission(request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const markerResult = yield this.revokeMarkerPermission(request);
-                if (markerResult.success === false &&
-                    markerResult.errorCode === 'permission_not_found') {
-                    return yield this.revokeResourcePermission(request);
-                }
-                return markerResult;
+            const authorization = await this.authorizeUserAndInstances(context.context, {
+                action: 'revokePermission',
+                resourceKind: 'marker',
+                resourceId: ACCOUNT_MARKER,
+                markers: [ACCOUNT_MARKER],
+                userId: request.userId,
+                instances: request.instances,
+            });
+            if (authorization.success === false) {
+                return authorization;
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred while revoking a permission.', err);
-                return {
-                    success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
-                };
+            const deleteResult = await this._policies.deleteResourcePermissionAssignmentById(permission.id);
+            if (!deleteResult.success) {
+                return deleteResult;
             }
-        });
+            console.log(`[PolicyController] [revokeResourcePermission] [userId: ${request.userId}, permissionId: ${request.permissionId}] Revoked resource permission.`);
+            return {
+                success: true,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred while revoking a resource permission.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
-     * Attempts to list the roles that are assigned to a user.
-     * @param recordKeyOrRecordName The record key or the name of the record.
-     * @param userId The ID of the user that is currently logged in.
-     * @param subjectId The ID of the user whose roles should be listed.
-     * @param instances The instances that the request is being made from.
-     */
-    listUserRoles(recordKeyOrRecordName, userId, subjectId, instances) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const baseRequest = {
-                    recordKeyOrRecordName: recordKeyOrRecordName,
-                    userId: userId,
-                };
-                const context = yield this.constructAuthorizationContext(baseRequest);
-                if (context.success === false) {
-                    return {
-                        success: false,
-                        errorCode: context.errorCode,
-                        errorMessage: context.errorMessage,
-                    };
-                }
-                if (userId !== subjectId || (!!instances && instances.length > 0)) {
-                    const authorization = yield this.authorizeUserAndInstances(context.context, {
-                        resourceKind: 'role',
-                        action: 'list',
-                        markers: [ACCOUNT_MARKER],
-                        userId: userId,
-                        instances: instances,
-                    });
-                    if (authorization.success === false) {
-                        return authorization;
-                    }
-                }
-                const result = yield this._policies.listRolesForUser(context.context.recordName, subjectId);
-                return {
-                    success: true,
-                    roles: sortBy(result, (r) => r.role),
-                };
-            }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred.', err);
-                return {
-                    success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
-                };
+     * Attempts to revoke the permission with the given ID.
+     * @param request The request for the operation.
+     */
+    async revokePermission(request) {
+        try {
+            const markerResult = await this.revokeMarkerPermission(request);
+            if (markerResult.success === false &&
+                markerResult.errorCode === 'permission_not_found') {
+                return await this.revokeResourcePermission(request);
             }
-        });
+            return markerResult;
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred while revoking a permission.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
-     * Attempts to list the roles that are assigned to an inst.
+     * Attempts to list the roles that are assigned to a user.
      * @param recordKeyOrRecordName The record key or the name of the record.
      * @param userId The ID of the user that is currently logged in.
-     * @param subjectId The ID of the inst whose roles should be listed.
+     * @param subjectId The ID of the user whose roles should be listed.
      * @param instances The instances that the request is being made from.
      */
-    listInstRoles(recordKeyOrRecordName, userId, subjectId, instances) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const baseRequest = {
-                    recordKeyOrRecordName: recordKeyOrRecordName,
-                    userId: userId,
+    async listUserRoles(recordKeyOrRecordName, userId, subjectId, instances) {
+        try {
+            const baseRequest = {
+                recordKeyOrRecordName: recordKeyOrRecordName,
+                userId: userId,
+            };
+            const context = await this.constructAuthorizationContext(baseRequest);
+            if (context.success === false) {
+                return {
+                    success: false,
+                    errorCode: context.errorCode,
+                    errorMessage: context.errorMessage,
                 };
-                const context = yield this.constructAuthorizationContext(baseRequest);
-                if (context.success === false) {
-                    return {
-                        success: false,
-                        errorCode: context.errorCode,
-                        errorMessage: context.errorMessage,
-                    };
-                }
-                const authorization = yield this.authorizeUserAndInstances(context.context, {
+            }
+            if (userId !== subjectId || (!!instances && instances.length > 0)) {
+                const authorization = await this.authorizeUserAndInstances(context.context, {
                     resourceKind: 'role',
                     action: 'list',
                     markers: [ACCOUNT_MARKER],
@@ -1551,24 +1605,73 @@ export class PolicyController {
                 if (authorization.success === false) {
                     return authorization;
                 }
-                const result = yield this._policies.listRolesForInst(context.context.recordName, normalizeInstId(subjectId));
-                return {
-                    success: true,
-                    roles: sortBy(result, (r) => r.role),
-                };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred.', err);
+            const result = await this._policies.listRolesForUser(context.context.recordName, subjectId);
+            return {
+                success: true,
+                roles: sortBy(result, (r) => r.role),
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
+    }
+    /**
+     * Attempts to list the roles that are assigned to an inst.
+     * @param recordKeyOrRecordName The record key or the name of the record.
+     * @param userId The ID of the user that is currently logged in.
+     * @param subjectId The ID of the inst whose roles should be listed.
+     * @param instances The instances that the request is being made from.
+     */
+    async listInstRoles(recordKeyOrRecordName, userId, subjectId, instances) {
+        try {
+            const baseRequest = {
+                recordKeyOrRecordName: recordKeyOrRecordName,
+                userId: userId,
+            };
+            const context = await this.constructAuthorizationContext(baseRequest);
+            if (context.success === false) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: context.errorCode,
+                    errorMessage: context.errorMessage,
                 };
             }
-        });
+            const authorization = await this.authorizeUserAndInstances(context.context, {
+                resourceKind: 'role',
+                action: 'list',
+                markers: [ACCOUNT_MARKER],
+                userId: userId,
+                instances: instances,
+            });
+            if (authorization.success === false) {
+                return authorization;
+            }
+            const result = await this._policies.listRolesForInst(context.context.recordName, normalizeInstId(subjectId));
+            return {
+                success: true,
+                roles: sortBy(result, (r) => r.role),
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Attempts to list the entities that are assigned the given role.
@@ -1577,49 +1680,47 @@ export class PolicyController {
      * @param role The name of the role whose assigments should be listed.
      * @param instances The instances that the request is being made from.
      */
-    listAssignedRoles(recordKeyOrRecordName, userId, role, instances) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const baseRequest = {
-                    recordKeyOrRecordName: recordKeyOrRecordName,
-                    userId: userId,
-                };
-                const context = yield this.constructAuthorizationContext(baseRequest);
-                if (context.success === false) {
-                    return {
-                        success: false,
-                        errorCode: context.errorCode,
-                        errorMessage: context.errorMessage,
-                    };
-                }
-                const authorization = yield this.authorizeUserAndInstances(context.context, {
-                    resourceKind: 'role',
-                    action: 'list',
-                    markers: [ACCOUNT_MARKER],
-                    userId: userId,
-                    instances: instances,
-                });
-                if (authorization.success === false) {
-                    return authorization;
-                }
-                const result = yield this._policies.listAssignmentsForRole(context.context.recordName, role);
-                return {
-                    success: true,
-                    assignments: result.assignments,
-                };
-            }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred.', err);
+    async listAssignedRoles(recordKeyOrRecordName, userId, role, instances) {
+        try {
+            const baseRequest = {
+                recordKeyOrRecordName: recordKeyOrRecordName,
+                userId: userId,
+            };
+            const context = await this.constructAuthorizationContext(baseRequest);
+            if (context.success === false) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: context.errorCode,
+                    errorMessage: context.errorMessage,
                 };
             }
-        });
+            const authorization = await this.authorizeUserAndInstances(context.context, {
+                resourceKind: 'role',
+                action: 'list',
+                markers: [ACCOUNT_MARKER],
+                userId: userId,
+                instances: instances,
+            });
+            if (authorization.success === false) {
+                return authorization;
+            }
+            const result = await this._policies.listAssignmentsForRole(context.context.recordName, role);
+            return {
+                success: true,
+                assignments: result.assignments,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Lists the role assignments that have been made in the given record.
@@ -1628,57 +1729,55 @@ export class PolicyController {
      * @param startingRole The role that assignments should be returned after.
      * @param instances The instances that the request is being made from.
      */
-    listRoleAssignments(recordKeyOrRecordName, userId, startingRole, instances) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                if (!this._policies.listAssignments) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'This operation is not supported.',
-                    };
-                }
-                const baseRequest = {
-                    recordKeyOrRecordName: recordKeyOrRecordName,
-                    userId: userId,
-                };
-                const context = yield this.constructAuthorizationContext(baseRequest);
-                if (context.success === false) {
-                    return {
-                        success: false,
-                        errorCode: context.errorCode,
-                        errorMessage: context.errorMessage,
-                    };
-                }
-                const authorization = yield this.authorizeUserAndInstances(context.context, {
-                    resourceKind: 'role',
-                    action: 'list',
-                    markers: [ACCOUNT_MARKER],
-                    userId: userId,
-                    instances: instances,
-                });
-                if (authorization.success === false) {
-                    return authorization;
-                }
-                const result = yield this._policies.listAssignments(context.context.recordName, startingRole);
+    async listRoleAssignments(recordKeyOrRecordName, userId, startingRole, instances) {
+        try {
+            if (!this._policies.listAssignments) {
                 return {
-                    success: true,
-                    assignments: result.assignments,
-                    totalCount: result.totalCount,
+                    success: false,
+                    errorCode: 'not_supported',
+                    errorMessage: 'This operation is not supported.',
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred.', err);
+            const baseRequest = {
+                recordKeyOrRecordName: recordKeyOrRecordName,
+                userId: userId,
+            };
+            const context = await this.constructAuthorizationContext(baseRequest);
+            if (context.success === false) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: context.errorCode,
+                    errorMessage: context.errorMessage,
                 };
             }
-        });
+            const authorization = await this.authorizeUserAndInstances(context.context, {
+                resourceKind: 'role',
+                action: 'list',
+                markers: [ACCOUNT_MARKER],
+                userId: userId,
+                instances: instances,
+            });
+            if (authorization.success === false) {
+                return authorization;
+            }
+            const result = await this._policies.listAssignments(context.context.recordName, startingRole);
+            return {
+                success: true,
+                assignments: result.assignments,
+                totalCount: result.totalCount,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Attempts to grant a role to a user.
@@ -1687,78 +1786,76 @@ export class PolicyController {
      * @param request The request to grant the role.
      * @param instances The instances that the request is being made from.
      */
-    grantRole(recordKeyOrRecordName, userId, request, instances) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const baseRequest = {
-                    recordKeyOrRecordName: recordKeyOrRecordName,
-                    userId: userId,
+    async grantRole(recordKeyOrRecordName, userId, request, instances) {
+        try {
+            const baseRequest = {
+                recordKeyOrRecordName: recordKeyOrRecordName,
+                userId: userId,
+            };
+            const context = await this.constructAuthorizationContext(baseRequest);
+            if (context.success === false) {
+                return {
+                    success: false,
+                    errorCode: context.errorCode,
+                    errorMessage: context.errorMessage,
                 };
-                const context = yield this.constructAuthorizationContext(baseRequest);
-                if (context.success === false) {
-                    return {
-                        success: false,
-                        errorCode: context.errorCode,
-                        errorMessage: context.errorMessage,
-                    };
-                }
-                const recordName = context.context.recordName;
-                const targetUserId = request.userId;
-                const targetInstance = normalizeInstId(request.instance);
-                const expireTimeMs = getExpireTime(request.expireTimeMs);
-                const authorization = yield this.authorizeUserAndInstances(context.context, {
-                    resourceKind: 'role',
-                    action: 'grant',
-                    resourceId: request.role,
-                    markers: [ACCOUNT_MARKER],
-                    userId: userId,
-                    instances: instances,
+            }
+            const recordName = context.context.recordName;
+            const targetUserId = request.userId;
+            const targetInstance = normalizeInstId(request.instance);
+            const expireTimeMs = getExpireTime(request.expireTimeMs);
+            const authorization = await this.authorizeUserAndInstances(context.context, {
+                resourceKind: 'role',
+                action: 'grant',
+                resourceId: request.role,
+                markers: [ACCOUNT_MARKER],
+                userId: userId,
+                instances: instances,
+            });
+            if (authorization.success === false) {
+                return authorization;
+            }
+            if (targetUserId) {
+                const result = await this._policies.assignSubjectRole(recordName, targetUserId, 'user', {
+                    role: request.role,
+                    expireTimeMs,
                 });
-                if (authorization.success === false) {
-                    return authorization;
-                }
-                if (targetUserId) {
-                    const result = yield this._policies.assignSubjectRole(recordName, targetUserId, 'user', {
-                        role: request.role,
-                        expireTimeMs,
-                    });
-                    if (result.success === false) {
-                        return result;
-                    }
-                    return {
-                        success: true,
-                    };
-                }
-                else if (targetInstance) {
-                    const result = yield this._policies.assignSubjectRole(recordName, targetInstance, 'inst', {
-                        role: request.role,
-                        expireTimeMs,
-                    });
-                    if (result.success === false) {
-                        return result;
-                    }
-                    return {
-                        success: true,
-                    };
+                if (result.success === false) {
+                    return result;
                 }
                 return {
-                    success: false,
-                    errorCode: 'unacceptable_request',
-                    errorMessage: 'Either a user ID or an instance must be specified.',
+                    success: true,
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred.', err);
+            else if (targetInstance) {
+                const result = await this._policies.assignSubjectRole(recordName, targetInstance, 'inst', {
+                    role: request.role,
+                    expireTimeMs,
+                });
+                if (result.success === false) {
+                    return result;
+                }
                 return {
-                    success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    success: true,
                 };
             }
-        });
+            return {
+                success: false,
+                errorCode: 'unacceptable_request',
+                errorMessage: 'Either a user ID or an instance must be specified.',
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Attempts to revoke a role from a user.
@@ -1767,71 +1864,191 @@ export class PolicyController {
      * @param request The request to revoke the role.
      * @param instances The instances that the request is being made from.
      */
-    revokeRole(recordKeyOrRecordName, userId, request, instances) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const baseRequest = {
-                    recordKeyOrRecordName: recordKeyOrRecordName,
-                    userId: userId,
+    async revokeRole(recordKeyOrRecordName, userId, request, instances) {
+        try {
+            const baseRequest = {
+                recordKeyOrRecordName: recordKeyOrRecordName,
+                userId: userId,
+            };
+            const context = await this.constructAuthorizationContext(baseRequest);
+            if (context.success === false) {
+                return {
+                    success: false,
+                    errorCode: context.errorCode,
+                    errorMessage: context.errorMessage,
                 };
-                const context = yield this.constructAuthorizationContext(baseRequest);
-                if (context.success === false) {
-                    return {
-                        success: false,
-                        errorCode: context.errorCode,
-                        errorMessage: context.errorMessage,
-                    };
+            }
+            const recordName = context.context.recordName;
+            const targetUserId = request.userId;
+            const targetInstance = normalizeInstId(request.instance);
+            const authorization = await this.authorizeUserAndInstances(context.context, {
+                resourceKind: 'role',
+                action: 'revoke',
+                resourceId: request.role,
+                markers: [ACCOUNT_MARKER],
+                userId: userId,
+                instances: instances,
+            });
+            if (authorization.success === false) {
+                return authorization;
+            }
+            if (targetUserId) {
+                const result = await this._policies.revokeSubjectRole(recordName, targetUserId, 'user', request.role);
+                if (result.success === false) {
+                    return result;
                 }
-                const recordName = context.context.recordName;
-                const targetUserId = request.userId;
-                const targetInstance = normalizeInstId(request.instance);
-                const authorization = yield this.authorizeUserAndInstances(context.context, {
-                    resourceKind: 'role',
-                    action: 'revoke',
-                    resourceId: request.role,
-                    markers: [ACCOUNT_MARKER],
-                    userId: userId,
-                    instances: instances,
-                });
-                if (authorization.success === false) {
-                    return authorization;
+                return {
+                    success: true,
+                };
+            }
+            else if (targetInstance) {
+                const result = await this._policies.revokeSubjectRole(recordName, targetInstance, 'inst', request.role);
+                if (result.success === false) {
+                    return result;
                 }
-                if (targetUserId) {
-                    const result = yield this._policies.revokeSubjectRole(recordName, targetUserId, 'user', request.role);
-                    if (result.success === false) {
-                        return result;
-                    }
+                return {
+                    success: true,
+                };
+            }
+            return {
+                success: false,
+                errorCode: 'unacceptable_request',
+                errorMessage: 'Either a user ID or an instance must be specified.',
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
+    }
+    /**
+     * Attempts to grant an entitlement to a package.
+     * @param request
+     */
+    async grantEntitlement(request) {
+        var _a, _b, _c, _d, _e, _f, _g, _h;
+        try {
+            if (!isSuperUserRole(request.userRole)) {
+                if (request.userId !== request.grantingUserId) {
                     return {
-                        success: true,
+                        success: false,
+                        errorCode: 'not_authorized',
+                        errorMessage: 'You are not authorized to perform this action.',
                     };
                 }
-                else if (targetInstance) {
-                    const result = yield this._policies.revokeSubjectRole(recordName, targetInstance, 'inst', request.role);
-                    if (result.success === false) {
-                        return result;
-                    }
+            }
+            const grant = await this._policies.findGrantedPackageEntitlementByUserIdPackageIdFeatureAndScope(request.grantingUserId, request.packageId, request.feature, request.scope, request.recordName);
+            const grantId = (_a = grant === null || grant === void 0 ? void 0 : grant.id) !== null && _a !== void 0 ? _a : uuidv7();
+            const feature = (_b = grant === null || grant === void 0 ? void 0 : grant.feature) !== null && _b !== void 0 ? _b : request.feature;
+            await this._policies.saveGrantedPackageEntitlement({
+                id: grantId,
+                createdAtMs: (_c = grant === null || grant === void 0 ? void 0 : grant.createdAtMs) !== null && _c !== void 0 ? _c : Date.now(),
+                expireTimeMs: Math.max(request.expireTimeMs, (_d = grant === null || grant === void 0 ? void 0 : grant.expireTimeMs) !== null && _d !== void 0 ? _d : 0),
+                revokeTimeMs: null,
+                scope: (_e = grant === null || grant === void 0 ? void 0 : grant.scope) !== null && _e !== void 0 ? _e : request.scope,
+                packageId: (_f = grant === null || grant === void 0 ? void 0 : grant.packageId) !== null && _f !== void 0 ? _f : request.packageId,
+                userId: (_g = grant === null || grant === void 0 ? void 0 : grant.userId) !== null && _g !== void 0 ? _g : request.grantingUserId,
+                feature: feature,
+                recordName: (_h = grant === null || grant === void 0 ? void 0 : grant.recordName) !== null && _h !== void 0 ? _h : request.recordName,
+            });
+            return {
+                success: true,
+                grantId,
+                feature,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
+    }
+    async revokeEntitlement(request) {
+        try {
+            const grant = await this._policies.findGrantedPackageEntitlementById(request.grantId);
+            if (!grant) {
+                return {
+                    success: false,
+                    errorCode: 'not_found',
+                    errorMessage: 'The entitlement grant could not be found.',
+                };
+            }
+            if (grant.userId !== request.userId) {
+                if (!isSuperUserRole(request.userRole)) {
                     return {
-                        success: true,
+                        success: false,
+                        errorCode: 'not_authorized',
+                        errorMessage: 'You are not authorized to perform this action.',
                     };
                 }
+            }
+            if (grant.revokeTimeMs !== null) {
+                // Already revoked
                 return {
-                    success: false,
-                    errorCode: 'unacceptable_request',
-                    errorMessage: 'Either a user ID or an instance must be specified.',
+                    success: true,
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[PolicyController] A server error occurred.', err);
+            await this._policies.saveGrantedPackageEntitlement({
+                ...grant,
+                revokeTimeMs: Date.now(),
+            });
+            return {
+                success: true,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
+    }
+    async listGrantedEntitlements(request) {
+        try {
+            if (!request.packageId) {
+                const grants = await this._policies.listGrantedEntitlementsForUser(request.userId, Date.now());
                 return {
-                    success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    success: true,
+                    grants,
                 };
             }
-        });
+            else {
+                const grants = await this._policies.listGrantedEntitlementsForUserAndPackage(request.userId, request.packageId, Date.now());
+                return {
+                    success: true,
+                    grants,
+                };
+            }
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[PolicyController] A server error occurred.', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
 }
 __decorate([
@@ -1897,6 +2114,15 @@ __decorate([
 __decorate([
     traced(TRACE_NAME)
 ], PolicyController.prototype, "revokeRole", null);
+__decorate([
+    traced(TRACE_NAME)
+], PolicyController.prototype, "grantEntitlement", null);
+__decorate([
+    traced(TRACE_NAME)
+], PolicyController.prototype, "revokeEntitlement", null);
+__decorate([
+    traced(TRACE_NAME)
+], PolicyController.prototype, "listGrantedEntitlements", null);
 /**
  * Determines if any markers will be remaining after the removal and addition of the specified markers.
  * @param existingMarkers The markers that already exist.
@@ -1939,4 +2165,25 @@ export function explainationForPermissionAssignment(subjectType, permissionAssig
     }
     return permissionString;
 }
+function getEntitlementFeatureForAction(resourceKind, action) {
+    if (resourceKind === 'data' ||
+        resourceKind === 'file' ||
+        resourceKind === 'event' ||
+        resourceKind === 'inst' ||
+        resourceKind === 'notification' ||
+        resourceKind === 'package' ||
+        resourceKind === 'webhook') {
+        return resourceKind;
+    }
+    else if (resourceKind === 'ai.hume' || resourceKind === 'ai.sloyd') {
+        return 'ai';
+    }
+    else if (resourceKind === 'marker' || resourceKind === 'role') {
+        return 'permissions';
+    }
+    else if (resourceKind === 'package.version') {
+        return 'package';
+    }
+    return null;
+}
 //# sourceMappingURL=PolicyController.js.map