@iobroker/db-objects-redis 7.2.3 → 8.0.0-alpha.1-20260921-e5941ca8a

package/build/cjs/lib/objects/objectsInRedisClient.js

@@ -5,6 +5,7 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -32,21 +33,25 @@ __export(objectsInRedisClient_exports, {
 });
 module.exports = __toCommonJS(objectsInRedisClient_exports);
 var __import_meta_url = typeof document === "undefined" ? new (require("url".replace("", ""))).URL("file:" + __filename).href : document.currentScript && document.currentScript.src || new URL("main.js", document.baseURI).href;
-var import_node = __toESM(require("node.extend"), 1);
-var import_ioredis = __toESM(require("ioredis"), 1);
-var import_db_base = require("@iobroker/db-base");
 var import_node_fs = __toESM(require("node:fs"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
 var import_node_crypto = __toESM(require("node:crypto"), 1);
 var import_node_util = require("node:util");
+var url = __toESM(require("node:url"), 1);
 var import_deep_clone = __toESM(require("deep-clone"), 1);
-var utils = __toESM(require("../../lib/objects/objectsUtils.js"), 1);
 var import_semver = __toESM(require("semver"), 1);
+var import_node = __toESM(require("node.extend"), 1);
+var import_ioredis = __toESM(require("ioredis"), 1);
+var import_db_base = require("@iobroker/db-base");
+var import_objectsUtils = require("../../lib/objects/objectsUtils.js");
+var utils = __toESM(require("../../lib/objects/objectsUtils.js"), 1);
 var CONSTS = __toESM(require("../../lib/objects/constants.js"), 1);
-var url = __toESM(require("node:url"), 1);
 const thisDir = url.fileURLToPath(new URL(".", __import_meta_url || `file://${__filename}`));
 const ERRORS = CONSTS.ERRORS;
 class ObjectsInRedisClient {
+  static {
+    __name(this, "ObjectsInRedisClient");
+  }
   client;
   fileNamespace;
   redisNamespace;
@@ -72,6 +77,9 @@ class ObjectsInRedisClient {
   noLegacyMultihost;
   userSubscriptions;
   systemSubscriptions;
+  /**
+   * @param settings Settings for the objects client including connection and namespaces
+   */
   constructor(settings) {
     this.settings = settings || {};
     this.redisNamespace = `${this.settings.redisNamespace || this.settings.connection?.redisNamespace || "cfg"}.`;
@@ -126,6 +134,9 @@ class ObjectsInRedisClient {
       throw new Error(`This host does not support protocol version "${protoVersion}"`);
     }
   }
+  /**
+   * Connect to the objects database and set up the change and file subscriptions
+   */
   connectDb() {
     this.settings.connection = this.settings.connection || {};
     const onChange = this.settings.change;
@@ -166,7 +177,7 @@ class ObjectsInRedisClient {
       const defaultPort = Array.isArray(configuredPort) ? null : configuredPort;
       this.settings.connection.options.sentinels = this.settings.connection.host.map((redisNode, idx) => ({
         host: redisNode,
-        // @ts-expect-error ts does not get that if defPort is null we have an array
+        // @ts-expect-error ts does not get that if defPort is null, we have an array
         port: defaultPort === null ? configuredPort[idx] : defaultPort
       }));
       this.settings.connection.options.name = this.settings.connection.sentinelName ? this.settings.connection.sentinelName : "mymaster";
@@ -178,10 +189,10 @@ class ObjectsInRedisClient {
     }
     this.settings.connection.options.db = this.settings.connection.options.db || 0;
     this.settings.connection.options.family = this.settings.connection.options.family || 0;
-    this.settings.connection.options.password = this.settings.connection.options.auth_pass || this.settings.connection.pass || null;
+    this.settings.connection.options.password = this.settings.connection.options.auth_pass || this.settings.connection.pass || void 0;
     this.settings.connection.options.autoResubscribe = false;
     this.settings.connection.options.connectionName = this.namespace.replace(/\s/g, "");
-    this.client = new import_ioredis.default(this.settings.connection.options);
+    this.client = new import_ioredis.default.Redis(this.settings.connection.options);
     this.client.on("error", (error) => {
       if (this.settings.connection.enhancedLogging) {
         this.log.silly(`${this.namespace} Redis ERROR Objects: (${this.stop}) ${error.message} / ${error.stack}`);
@@ -258,7 +269,7 @@ class ObjectsInRedisClient {
       if (!this.subSystem && typeof onChange === "function") {
         initCounter++;
         this.log.debug(`${this.namespace} Objects create System PubSub Client`);
-        this.subSystem = new import_ioredis.default(this.settings.connection.options);
+        this.subSystem = new import_ioredis.default.Redis(this.settings.connection.options);
         if (typeof this.settings.primaryHostLost === "function") {
           try {
             await this.client.config("SET", "notify-keyspace-events", "Exe");
@@ -303,7 +314,7 @@ class ObjectsInRedisClient {
                   if (id === "system.config" && obj2?.common?.defaultNewAcl && !(0, import_node_util.isDeepStrictEqual)(obj2.common.defaultNewAcl, this.defaultNewAcl)) {
                     this.defaultNewAcl = (0, import_deep_clone.default)(obj2.common.defaultNewAcl);
                     if (this.settings.controller) {
-                      this.setDefaultAcl(this.defaultNewAcl);
+                      this.setDefaultAcl(this.defaultNewAcl).catch((e) => this.log.error(`${this.namespace} Cannot set default ACL: ${e.message}`));
                     }
                   }
                   onChange(id, obj2);
@@ -379,7 +390,7 @@ class ObjectsInRedisClient {
       if (!this.sub && (typeof onChangeUser === "function" || typeof onChangeFileUser === "function")) {
         initCounter++;
         this.log.debug(`${this.namespace} Objects create User PubSub Client`);
-        this.sub = new import_ioredis.default(this.settings.connection.options);
+        this.sub = new import_ioredis.default.Redis(this.settings.connection.options);
         this.sub.on("pmessage", (pattern, channel, message) => {
           setImmediate(() => {
             this.log.silly(`${this.namespace} Objects user redis pmessage ${pattern}/${channel}:${message}`);
@@ -529,6 +540,9 @@ class ObjectsInRedisClient {
       }
     });
   }
+  /**
+   * Get the current status of the database
+   */
   getStatus() {
     return { type: "redis", server: false };
   }
@@ -536,7 +550,7 @@ class ObjectsInRedisClient {
    * Checks if given ID is a meta-object, else throws error
    *
    * @param id to check
-   * @throws Error if id is invalid
+   * @throws {Error} if id is invalid
    */
   async validateMetaObject(id) {
     if (this.existingMetaObjects[id] === void 0) {
@@ -551,6 +565,11 @@ class ObjectsInRedisClient {
       throw new Error(`${id} is not an object of type "meta"`);
     }
   }
+  /**
+   * Normalize a file name by collapsing slashes and backslashes into a single forward slash
+   *
+   * @param name The file name to normalize
+   */
   normalizeFilename(name) {
     return name ? name.replace(/[/\\]+/g, "/") : name;
   }
@@ -558,7 +577,7 @@ class ObjectsInRedisClient {
   /**
    * Sets a buffer to the Redis DB
    *
-   * @param id id of the file
+   * @param id ID of the file
    * @param data content, if string is passed it will be converted to a Buffer
    */
   async _setBinaryState(id, data) {
@@ -572,7 +591,7 @@ class ObjectsInRedisClient {
     await this.client.publish(id, data.byteLength.toString(10));
   }
   /**
-   * get buffer of given id from redis
+   * Get a buffer of a given ID from redis
    *
    * @param id - id of the data with namespace prefix
    */
@@ -583,7 +602,7 @@ class ObjectsInRedisClient {
     return this.client.getBuffer(id);
   }
   /**
-   * deletes binary state of given id from redis db
+   * deletes binary state of a given ID from redis db
    *
    * @param id - id to delete, with namespace prefix
    */
@@ -595,6 +614,13 @@ class ObjectsInRedisClient {
       await this.client.publish(id, "null");
     }
   }
+  /**
+   * Build the internal redis key for a file
+   *
+   * @param id The ID of the object owning the file
+   * @param name The file name
+   * @param isMeta Whether to return the key of the meta-entry (true) or the data entry (false)
+   */
   getFileId(id, name, isMeta) {
     name = this.normalizeFilename(name);
     if (id.endsWith(".admin")) {
@@ -617,37 +643,58 @@ class ObjectsInRedisClient {
     name = normalized.name;
     return `${this.fileNamespace + id}$%$${name}${isMeta !== void 0 ? isMeta ? "$%$meta" : "$%$data" : ""}`;
   }
-  async checkFile(id, name, options2, flag, callback) {
-    const fileId = this.getFileId(id, name, true);
+  /**
+   * Check whether the current options have the required rights on a file
+   *
+   * @param id The id of the object owning the file
+   * @param name The file name
+   * @param userContext The resolved user context used for permission checks
+   * @param flag The access flag(s) to check for
+   */
+  async checkFileAsync(id, name, userContext2, flag) {
+    const fileId = this.getFileId(id, name ?? "", true);
     if (!fileId) {
-      const fileOptions2 = { notExists: true };
-      if (utils.checkFile(fileOptions2, options2, flag, this.defaultNewAcl)) {
-        return import_db_base.tools.maybeCallback(callback, false, options2, fileOptions2);
+      if (!utils.checkFile({ notExists: true }, userContext2, flag, this.defaultNewAcl)) {
+        return null;
       }
-      return import_db_base.tools.maybeCallback(callback, true, options2);
+      return { notExists: true };
     }
     if (!this.client) {
-      return import_db_base.tools.maybeCallbackWithRedisError(callback, ERRORS.ERROR_DB_CLOSED, options2);
+      throw new Error(ERRORS.ERROR_DB_CLOSED);
     }
-    let fileOptions;
+    let fileOptionsStr;
     try {
-      fileOptions = await this.client.get(fileId);
+      fileOptionsStr = await this.client.get(fileId);
     } catch {
     }
-    fileOptions = fileOptions || '{"notExists": true}';
+    fileOptionsStr ||= '{"notExists": true}';
+    let fileOptions;
     try {
-      fileOptions = JSON.parse(fileOptions);
+      fileOptions = JSON.parse(fileOptionsStr);
     } catch {
-      this.log.error(`${this.namespace} Cannot parse JSON ${id}: ${fileOptions}`);
+      this.log.error(`${this.namespace} Cannot parse JSON ${id}: ${fileOptionsStr}`);
       fileOptions = { notExists: true };
     }
-    if (utils.checkFile(fileOptions, options2, flag, this.defaultNewAcl)) {
-      return import_db_base.tools.maybeCallback(callback, false, options2, fileOptions);
+    if (!utils.checkFile(fileOptions, userContext2, flag, this.defaultNewAcl)) {
+      return null;
     }
-    return import_db_base.tools.maybeCallback(callback, true, options2);
+    return fileOptions;
   }
-  checkFileRights(id, name, options2, flag, callback) {
-    return utils.checkFileRights(this, id, name, options2, flag, callback);
+  /**
+   * Check whether the current user is allowed to access a file
+   *
+   * @param id The id of the object owning the file
+   * @param name The file name, or null for the whole namespace
+   * @param options The current request options including the user
+   * @param flag The access flag(s) to check for
+   * @param callback Called with the effective options once the rights have been checked
+   */
+  checkFileRights(id, name, options, flag, callback) {
+    try {
+      utils.checkFileRightsAsync(this, id, name, options, flag).then((result) => callback(null, result.fileOptions, result.userContext)).catch((err) => callback(err));
+    } catch (error) {
+      callback(error);
+    }
   }
   async _setDefaultAcl(ids, defaultAcl) {
     for (const id of ids) {
@@ -662,6 +709,11 @@ class ObjectsInRedisClient {
       }
     }
   }
+  /**
+   * Set the default ACL applied to new objects and apply it to all existing objects without an ACL
+   *
+   * @param defaultNewAcl The default ACL to use, or null to use the built-in default
+   */
   async setDefaultAcl(defaultNewAcl) {
     this.defaultNewAcl = defaultNewAcl || {
       owner: CONSTS.SYSTEM_ADMIN_USER,
@@ -679,24 +731,32 @@ class ObjectsInRedisClient {
       this.log.error(`${this.namespace} Could not update default acl: ${e.message}`);
     }
   }
+  /**
+   * Determine the groups and effective ACL of the given user
+   *
+   * @param user The id of the user to look up
+   * @param callback Called with the user, its groups, and the effective ACL
+   */
   getUserGroup(user, callback) {
     return utils.getUserGroup(this, user, (error, user2, userGroups, userAcl) => {
       if (error) {
         this.log.error(`${this.namespace} ${error.stack}`);
       }
-      return import_db_base.tools.maybeCallback(callback, user2, userGroups, userAcl);
+      if (typeof callback === "function") {
+        callback(user2, userGroups, userAcl);
+      }
     });
   }
-  async _writeFile(id, name, data, options2, callback, meta) {
+  async _writeFile(id, name, data, options, callback, meta) {
     const matchedExtension = name.match(/\.[^.]+$/);
-    const ext = matchedExtension ? matchedExtension[0] : "";
+    const ext = matchedExtension?.[0] || "";
     const isTextData = typeof data === "string";
     const { mimeType, isBinary } = utils.getMimeType(ext, isTextData);
     const metaID = this.getFileId(id, name, true);
     if (!this.client) {
       return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_DB_CLOSED);
     }
-    if (options2.virtualFile) {
+    if (options.virtualFile) {
       meta = {
         notExists: true,
         virtualFile: true
@@ -708,28 +768,24 @@ class ObjectsInRedisClient {
         return import_db_base.tools.maybeCallbackWithRedisError(callback, e);
       }
     } else {
-      if (!meta) {
-        meta = { createdAt: Date.now() };
-      }
-      if (!meta.acl) {
-        meta.acl = {
-          owner: options2.user || this.defaultNewAcl && this.defaultNewAcl.owner || CONSTS.SYSTEM_ADMIN_USER,
-          ownerGroup: options2.group || this.defaultNewAcl && this.defaultNewAcl.ownerGroup || CONSTS.SYSTEM_ADMIN_GROUP,
-          permissions: options2.mode || this.defaultNewAcl && this.defaultNewAcl.file || 1604
-        };
-      }
+      meta ||= { createdAt: Date.now() };
+      meta.acl ||= {
+        owner: options.user || this.defaultNewAcl?.owner || CONSTS.SYSTEM_ADMIN_USER,
+        ownerGroup: options.group || this.defaultNewAcl?.ownerGroup || CONSTS.SYSTEM_ADMIN_GROUP,
+        permissions: options.mode || this.defaultNewAcl?.file || 1604
+      };
       meta.stats = {
-        size: data ? data.length : 0
+        size: data?.length || 0
       };
       if (Object.prototype.hasOwnProperty.call(meta, "notExists")) {
         delete meta.notExists;
       }
-      meta.mimeType = options2.mimeType || mimeType;
+      meta.mimeType = options.mimeType || mimeType;
       meta.binary = isBinary;
-      meta.acl.ownerGroup = meta.acl.ownerGroup || this.defaultNewAcl && this.defaultNewAcl.ownerGroup || CONSTS.SYSTEM_ADMIN_GROUP;
+      meta.acl.ownerGroup ||= this.defaultNewAcl?.ownerGroup || CONSTS.SYSTEM_ADMIN_GROUP;
       meta.modifiedAt = Date.now();
       try {
-        await this._setBinaryState(this.getFileId(id, name, false), data);
+        await this._setBinaryState(this.getFileId(id, name, false), data || "");
         await this.client.set(metaID, JSON.stringify(meta));
         return import_db_base.tools.maybeCallback(callback);
       } catch (e) {
@@ -737,19 +793,22 @@ class ObjectsInRedisClient {
       }
     }
   }
-  async writeFile(id, name, data, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
-    }
-    if (typeof options2 === "string") {
-      options2 = { mimeType: options2 };
-    }
-    if (options2?.acl) {
-      options2.acl = null;
+  /**
+   * Write data into a file of an object
+   *
+   * @param id The id of the object owning the file
+   * @param name The file name
+   * @param data The data to write
+   * @param options The current request options including the user, or the callback
+   * @param callback Called once the file has been written
+   */
+  async writeFile(id, name, data, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
     if (!callback) {
-      return this.writeFileAsync(id, name, data, options2);
+      return this.writeFileAsync(id, name, data, options);
     }
     try {
       await this.validateMetaObject(id);
@@ -766,15 +825,23 @@ class ObjectsInRedisClient {
     if (data === void 0) {
       data = null;
     }
-    return this.checkFileRights(id, name, options2, CONSTS.ACCESS_WRITE, (err, options3, meta) => {
+    return this.checkFileRights(id, name, options, CONSTS.ACCESS_WRITE, (err, meta) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithError(callback, err);
       }
-      return this._writeFile(id, name, data, options3, callback, meta);
+      return this._writeFile(id, name, data, options || {}, callback, meta);
     });
   }
-  writeFileAsync(id, name, data, options2) {
-    return new Promise((resolve, reject) => this.writeFile(id, name, data, options2, (err) => err ? reject(err) : resolve()));
+  /**
+   * Promise-version of writeFile
+   *
+   * @param id The ID of the object owning the file
+   * @param name The file name
+   * @param data The data to write
+   * @param options The current request options including the user
+   */
+  writeFileAsync(id, name, data, options) {
+    return new Promise((resolve, reject) => this.writeFile(id, name, data, options, (err) => err ? reject(err) : resolve()));
   }
   async _readFile(id, name, meta) {
     if (meta.notExists) {
@@ -783,24 +850,28 @@ class ObjectsInRedisClient {
     if (!this.client) {
       throw new Error(ERRORS.ERROR_DB_CLOSED);
     }
-    let buffer;
-    buffer = await this._getBinaryState(this.getFileId(id, name, false));
+    let file = await this._getBinaryState(this.getFileId(id, name, false));
     const mimeType = meta?.mimeType;
-    if (meta && !meta.binary && buffer) {
-      buffer = buffer.toString();
+    if (meta && !meta.binary && file) {
+      file = file.toString();
     }
-    return { file: buffer, mimeType };
+    return { file, mimeType };
   }
-  readFile(id, name, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
-    }
-    if (options2?.acl) {
-      options2.acl = null;
+  /**
+   * Read a file of an object
+   *
+   * @param id The ID of the object owning the file
+   * @param name The file name
+   * @param options The current request options including the user, or the callback
+   * @param callback Called with the file content and mime type
+   */
+  readFile(id, name, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
     if (!callback) {
-      return new Promise((resolve, reject) => this.readFile(id, name, options2, (err, res, mimeType) => err ? reject(err) : resolve({ file: res, mimeType })));
+      return new Promise((resolve, reject) => this.readFile(id, name, options, (err, res, mimeType) => err ? reject(err) : resolve({ file: res, mimeType })));
     }
     if (typeof name !== "string" || !name.length || name === "/") {
       return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_NOT_FOUND);
@@ -808,8 +879,8 @@ class ObjectsInRedisClient {
     if (name.startsWith("/")) {
       name = name.substring(1);
     }
-    options2 = options2 || {};
-    this.checkFileRights(id, name, options2, CONSTS.ACCESS_READ, async (err, options3, meta) => {
+    options ||= {};
+    this.checkFileRights(id, name, options, CONSTS.ACCESS_READ, async (err, meta) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithError(callback, err);
       }
@@ -822,27 +893,21 @@ class ObjectsInRedisClient {
     });
   }
   /**
-   * Check if given object exists
+   * Check if a given object exists
    *
-   * @param id id of the object
+   * @param id ID of the object
    * @param options optional user context
    */
-  async objectExists(id, options2) {
+  async objectExists(id, options) {
     if (!this.client) {
       throw new Error(ERRORS.ERROR_DB_CLOSED);
     }
     if (!id || typeof id !== "string") {
-      throw new Error(`invalid id ${JSON.stringify(id)}`);
+      throw new Error(`invalid ID ${JSON.stringify(id)}`);
     }
     try {
       await new Promise((resolve, reject) => {
-        utils.checkObjectRights(this, null, null, options2, CONSTS.ACCESS_LIST, (err) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve();
-          }
-        });
+        utils.checkObjectRights(this, null, null, options, CONSTS.ACCESS_LIST, (err) => err ? reject(err) : resolve());
       });
       const exists = await this.client.exists(this.objNamespace + id);
       return !!exists;
@@ -852,13 +917,13 @@ class ObjectsInRedisClient {
     }
   }
   /**
-   * Check if given file exists
+   * Check if a given file exists
    *
-   * @param id id of the namespace
+   * @param id ID of the namespace
    * @param name name of the file
    * @param options optional user context
    */
-  async fileExists(id, name, options2) {
+  async fileExists(id, name, options) {
     if (typeof name !== "string") {
       name = "";
     }
@@ -866,15 +931,7 @@ class ObjectsInRedisClient {
       name = name.substring(1);
     }
     try {
-      await new Promise((resolve, reject) => {
-        this.checkFileRights(id, name, options2, CONSTS.ACCESS_READ, (err) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve();
-          }
-        });
-      });
+      await utils.checkFileRightsAsync(this, id, name, options, CONSTS.ACCESS_READ);
       if (!this.client) {
         throw new Error(ERRORS.ERROR_DB_CLOSED);
       }
@@ -886,25 +943,30 @@ class ObjectsInRedisClient {
       throw new Error(`Cannot check file existence of "${id}": ${e.message}`);
     }
   }
-  async _unlink(id, name, options2, meta) {
+  async _unlink(id, name, userContext2, meta) {
     if (!this.client) {
       throw new Error(ERRORS.ERROR_DB_CLOSED);
     }
-    if (meta && meta.notExists) {
-      return this._rm(id, name, options2);
+    if (meta?.notExists) {
+      return this._rm(id, name, userContext2);
     }
     const metaID = this.getFileId(id, name, true);
     const dataID = this.getFileId(id, name, false);
     await this._delBinaryState(dataID);
     await this.client.del(metaID);
   }
-  unlink(id, name, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
-    }
-    if (options2?.acl) {
-      options2.acl = null;
+  /**
+   * Delete a file or directory of an object
+   *
+   * @param id The id of the object owning the file
+   * @param name The file or directory name to delete
+   * @param options The current request options including the user, or the callback
+   * @param callback Called with the list of removed files
+   */
+  unlink(id, name, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
     if (typeof name !== "string") {
       name = "";
@@ -912,31 +974,53 @@ class ObjectsInRedisClient {
     if (name.startsWith("/")) {
       name = name.substring(1);
     }
-    this.checkFileRights(id, name, options2, CONSTS.ACCESS_DELETE, async (err, options3, meta) => {
+    this.checkFileRights(id, name, options, CONSTS.ACCESS_DELETE, async (err, meta, userContext2) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithError(callback, err);
       }
-      if (!options3.acl.file.delete) {
+      if (!userContext2.acl.file.delete) {
         return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION);
       }
       try {
-        const files = await this._unlink(id, name, options3, meta);
+        const files = await this._unlink(id, name, userContext2, meta);
         return import_db_base.tools.maybeCallbackWithError(callback, null, files);
       } catch (e) {
         return import_db_base.tools.maybeCallbackWithError(callback, e);
       }
     });
   }
-  unlinkAsync(id, name, options2) {
-    return new Promise((resolve, reject) => this.unlink(id, name, options2, (err) => err ? reject(err) : resolve()));
+  /**
+   * Promise-version of unlink
+   *
+   * @param id The id of the object owning the file
+   * @param name The file or directory name to delete
+   * @param options The current request options including the user
+   */
+  unlinkAsync(id, name, options) {
+    return new Promise((resolve, reject) => this.unlink(id, name, options, (err) => err ? reject(err) : resolve()));
   }
-  delFile(id, name, options2, callback) {
-    return this.unlink(id, name, options2, callback);
+  /**
+   * Delete a file of an object (alias for {@link unlink})
+   *
+   * @param id The id of the object owning the file
+   * @param name The file name to delete
+   * @param options The current request options including the user
+   * @param callback Called once the file has been deleted
+   */
+  delFile(id, name, options, callback) {
+    return this.unlink(id, name, options, callback);
   }
-  delFileAsync(id, name, options2) {
-    return this.unlinkAsync(id, name, options2);
+  /**
+   * Promise-version of delFile
+   *
+   * @param id The id of the object owning the file
+   * @param name The file name to delete
+   * @param options The current request options including the user
+   */
+  delFileAsync(id, name, options) {
+    return this.unlinkAsync(id, name, options);
   }
-  async _readDir(id, name, options2, callback) {
+  async _readDir(id, name, userContext2, callback) {
     name = this.normalizeFilename(name);
     if (!this.client) {
       return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_DB_CLOSED);
@@ -952,15 +1036,15 @@ class ObjectsInRedisClient {
       if (!this.client) {
         return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_DB_CLOSED);
       }
-      const result3 = [];
+      const result2 = [];
       if (!keys3 || !keys3.length) {
-        return import_db_base.tools.maybeCallbackWithError(callback, null, result3);
+        return import_db_base.tools.maybeCallbackWithError(callback, null, result2);
       }
       let lastDir;
       keys3.sort().forEach((dir) => {
         dir = dir.substring(this.fileNamespaceL, dir.indexOf("$%$"));
         if (dir !== lastDir) {
-          result3.push({
+          result2.push({
             file: dir,
             stats: {},
             isDir: true
@@ -968,7 +1052,7 @@ class ObjectsInRedisClient {
         }
         lastDir = dir;
       });
-      return import_db_base.tools.maybeCallbackWithError(callback, null, result3);
+      return import_db_base.tools.maybeCallbackWithError(callback, null, result2);
     }
     try {
       await this.validateMetaObject(id);
@@ -1006,12 +1090,12 @@ class ObjectsInRedisClient {
       }
     });
     if (!keys2.length) {
-      const result3 = dirs.map((file) => ({
+      const result2 = dirs.map((file) => ({
         file,
         stats: {},
         isDir: true
       }));
-      return import_db_base.tools.maybeCallbackWithError(callback, null, result3);
+      return import_db_base.tools.maybeCallbackWithError(callback, null, result2);
     }
     let strObjs;
     try {
@@ -1019,12 +1103,12 @@ class ObjectsInRedisClient {
     } catch (e) {
       return import_db_base.tools.maybeCallbackWithRedisError(callback, e);
     }
-    const result2 = [];
-    const dontCheck = options2.user === CONSTS.SYSTEM_ADMIN_USER || options2.group !== CONSTS.SYSTEM_ADMIN_GROUP || options2.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP);
+    const result = [];
+    const dontCheck = userContext2.user === CONSTS.SYSTEM_ADMIN_USER || userContext2.group === CONSTS.SYSTEM_ADMIN_GROUP || userContext2.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP);
     for (let i = 0; i < keys2.length; i++) {
       const file = keys2[i].substring(start + baseName.length, keys2[i].length - end);
       while (dirs.length && dirs[0] < file) {
-        result2.push({
+        result.push({
           file: dirs.shift(),
           stats: {},
           isDir: true
@@ -1038,21 +1122,21 @@ class ObjectsInRedisClient {
         this.log.error(`${this.namespace} Cannot parse JSON ${keys2[i]}: ${strObj}`);
         continue;
       }
-      if (dontCheck || utils.checkObject(obj, options2, CONSTS.ACCESS_READ)) {
+      if (dontCheck || utils.checkObject(obj, userContext2, CONSTS.ACCESS_READ)) {
         if (!obj || obj.virtualFile) {
           continue;
         }
-        obj.acl = obj.acl || {};
-        if (options2.user !== CONSTS.SYSTEM_ADMIN_USER && !options2.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP)) {
+        obj.acl ||= {};
+        if (userContext2.user !== CONSTS.SYSTEM_ADMIN_USER && !userContext2.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP)) {
           obj.acl.read = !!(obj.acl.permissions & CONSTS.ACCESS_EVERY_READ);
           obj.acl.write = !!(obj.acl.permissions & CONSTS.ACCESS_EVERY_WRITE);
         } else {
           obj.acl.read = true;
           obj.acl.write = true;
         }
-        result2.push({
+        result.push({
           file,
-          stats: obj.stats,
+          stats: obj.stats || {},
           isDir: false,
           acl: obj.acl,
           modifiedAt: obj.modifiedAt,
@@ -1061,21 +1145,26 @@ class ObjectsInRedisClient {
       }
     }
     while (dirs.length) {
-      result2.push({
+      result.push({
         file: dirs.shift(),
         stats: {},
         isDir: true
       });
     }
-    return import_db_base.tools.maybeCallbackWithError(callback, null, result2);
+    return import_db_base.tools.maybeCallbackWithError(callback, null, result);
   }
-  readDir(id, name, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
-    }
-    if (options2?.acl) {
-      options2.acl = null;
+  /**
+   * List the contents of a directory of an object
+   *
+   * @param id The id of the object owning the files
+   * @param name The directory name to list
+   * @param options The current request options including the user, or the callback
+   * @param callback Called with the directory entries
+   */
+  readDir(id, name, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
     if (typeof name !== "string") {
       name = "";
@@ -1086,18 +1175,25 @@ class ObjectsInRedisClient {
     if (name.endsWith("/")) {
       name = name.substring(0, name.length - 1);
     }
-    this.checkFileRights(id, name, options2, CONSTS.ACCESS_READ, (err, options3) => {
+    this.checkFileRights(id, name, options, CONSTS.ACCESS_READ, (err, options2, userContext2) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithError(callback, err);
       }
-      if (!options3.acl.file.list) {
+      if (!userContext2.acl.file.list) {
         return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION);
       }
-      this._readDir(id, name, options3, callback);
+      return this._readDir(id, name, userContext2, callback);
     });
   }
-  readDirAsync(id, name, options2) {
-    return new Promise((resolve, reject) => this.readDir(id, name, options2, (err, res) => err ? reject(err) : resolve(res)));
+  /**
+   * Promise-version of readDir
+   *
+   * @param id The id of the object owning the files
+   * @param name The directory name to list
+   * @param options The current request options including the user
+   */
+  readDirAsync(id, name, options) {
+    return new Promise((resolve, reject) => this.readDir(id, name, options, (err, res) => err ? reject(err) : resolve(res)));
   }
   async _renameHelper(keys2, oldBase, newBase, callback) {
     if (!keys2 || !keys2.length) {
@@ -1122,7 +1218,7 @@ class ObjectsInRedisClient {
     }
     return import_db_base.tools.maybeCallback(callback);
   }
-  async _rename(id, oldName, newName, options2, callback, meta) {
+  async _rename(id, oldName, newName, userContext2, callback, meta) {
     const oldMetaID = this.getFileId(id, oldName, true);
     const oldDataID = this.getFileId(id, oldName, false);
     const newMetaID = this.getFileId(id, newName, true);
@@ -1167,10 +1263,10 @@ class ObjectsInRedisClient {
       } catch (e) {
         return import_db_base.tools.maybeCallbackWithRedisError(callback, e);
       }
-      let result2;
-      const dontCheck = options2.user === CONSTS.SYSTEM_ADMIN_USER || options2.group !== CONSTS.SYSTEM_ADMIN_GROUP || options2.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP);
+      let result;
+      const dontCheck = userContext2.user === CONSTS.SYSTEM_ADMIN_USER || userContext2.group === CONSTS.SYSTEM_ADMIN_GROUP || userContext2.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP);
       if (!dontCheck) {
-        result2 = [];
+        result = [];
         for (let i = 0; i < keys2.length; i++) {
           const strObj = strObjs[i];
           let obj;
@@ -1180,14 +1276,14 @@ class ObjectsInRedisClient {
             this.log.error(`${this.namespace} Cannot parse JSON ${keys2[i]}: ${strObj}`);
             continue;
           }
-          if (utils.checkObject(obj, options2, CONSTS.ACCESS_READ)) {
-            result2.push(keys2[i]);
+          if (utils.checkObject(obj, userContext2, CONSTS.ACCESS_READ)) {
+            result.push(keys2[i]);
           }
         }
       } else {
-        result2 = keys2;
+        result = keys2;
       }
-      return this._renameHelper(result2, oldBase, newBase, callback);
+      return this._renameHelper(result, oldBase, newBase, callback);
     }
     try {
       await this.client.rename(oldDataID, newDataID);
@@ -1197,13 +1293,19 @@ class ObjectsInRedisClient {
       return import_db_base.tools.maybeCallbackWithRedisError(callback, e);
     }
   }
-  rename(id, oldName, newName, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
-    }
-    if (options2?.acl) {
-      options2.acl = null;
+  /**
+   * Rename a file or directory of an object
+   *
+   * @param id The id of the object owning the file
+   * @param oldName The current file or directory name
+   * @param newName The new file or directory name
+   * @param options The current request options including the user, or the callback
+   * @param callback Called once the file has been renamed
+   */
+  rename(id, oldName, newName, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
     if (typeof oldName !== "string" || !oldName.length || oldName === "/" || oldName === "//" || typeof newName !== "string" || !newName.length || newName === "/" || newName === "//") {
       return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_NOT_FOUND);
@@ -1220,20 +1322,29 @@ class ObjectsInRedisClient {
     if (newName.endsWith("/")) {
       newName = newName.substring(0, newName.length - 1);
     }
-    this.checkFileRights(id, oldName, options2, CONSTS.ACCESS_WRITE, (err, options3, meta) => {
+    this.checkFileRights(id, oldName, options, CONSTS.ACCESS_WRITE, (err, meta, userContext2) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithError(callback, err);
       }
-      if (!options3.acl.file.write) {
+      if (!userContext2.acl.file.write) {
         return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION);
       }
-      this._rename(id, oldName, newName, options3, callback, meta);
+      return this._rename(id, oldName, newName, userContext2, callback, meta);
     });
   }
-  renameAsync(id, oldName, newName, options2) {
-    return new Promise((resolve, reject) => this.rename(id, oldName, newName, options2, (err) => err ? reject(err) : resolve()));
+  /**
+   * Promise-version of rename
+   *
+   * @param id The id of the object owning the file
+   * @param oldName The current file or directory name
+   * @param newName The new file or directory name
+   * @param options The current request options including the user
+   * @param options.user The user on whose behalf the operation is performed
+   */
+  renameAsync(id, oldName, newName, options) {
+    return new Promise((resolve, reject) => this.rename(id, oldName, newName, options, (err) => err ? reject(err) : resolve()));
   }
-  async _touch(id, name, callback, meta) {
+  async _touch(id, name, meta, callback) {
     const metaID = this.getFileId(id, name, true);
     if (!this.client) {
       return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_DB_CLOSED);
@@ -1249,13 +1360,18 @@ class ObjectsInRedisClient {
       return import_db_base.tools.maybeCallbackWithRedisError(callback, e);
     }
   }
-  touch(id, name, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
-    }
-    if (options2?.acl) {
-      options2.acl = null;
+  /**
+   * Update the modification time of a file
+   *
+   * @param id The id of the object owning the file
+   * @param name The file name
+   * @param options The current request options including the user, or the callback
+   * @param callback Called once the file has been touched
+   */
+  touch(id, name, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
     if (typeof name !== "string" || !name.length || name === "/") {
       return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_NOT_FOUND);
@@ -1263,15 +1379,23 @@ class ObjectsInRedisClient {
     if (name.startsWith("/")) {
       name = name.substring(1);
     }
-    this.checkFileRights(id, name, options2, CONSTS.ACCESS_WRITE, (err, options3, meta) => {
+    this.checkFileRights(id, name, options, CONSTS.ACCESS_WRITE, (err, meta) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithError(callback, err);
       }
-      return this._touch(id, name, callback, meta);
+      return this._touch(id, name, meta, callback);
     });
   }
-  touchAsync(id, name, options2) {
-    return new Promise((resolve, reject) => this.touch(id, name, options2, (err) => err ? reject(err) : resolve()));
+  /**
+   * Promise-version of touch
+   *
+   * @param id The id of the object owning the file
+   * @param name The file name
+   * @param options The current request options including the user
+   * @param options.user The user on whose behalf the operation is performed
+   */
+  touchAsync(id, name, options) {
+    return new Promise((resolve, reject) => this.touch(id, name, options, (err) => err ? reject(err) : resolve()));
   }
   async _rmHelper(keys2) {
     if (!keys2.length) {
@@ -1285,7 +1409,7 @@ class ObjectsInRedisClient {
       await this.client.del(id);
     }
   }
-  async _rm(id, name, options2, meta) {
+  async _rm(id, name, userContext2, meta) {
     if (meta && !meta.isDir) {
       const metaID = this.getFileId(id, name, true);
       const dataID = this.getFileId(id, name, false);
@@ -1313,31 +1437,31 @@ class ObjectsInRedisClient {
       if (!keys2.length) {
         throw new Error(ERRORS.ERROR_NOT_FOUND);
       }
-      let objs2;
+      let strObjs;
       try {
-        objs2 = await this.client.mget(keys2);
+        strObjs = await this.client.mget(keys2);
       } catch {
       }
-      let result2;
-      const dontCheck = options2.user === CONSTS.SYSTEM_ADMIN_USER || options2.group !== CONSTS.SYSTEM_ADMIN_GROUP || options2.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP);
-      objs2 = objs2 || [];
+      let result;
+      const dontCheck = userContext2.user === CONSTS.SYSTEM_ADMIN_USER || userContext2.group === CONSTS.SYSTEM_ADMIN_GROUP || userContext2.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP);
+      strObjs ||= [];
       if (!dontCheck) {
-        result2 = [];
+        result = [];
         for (let i = 0; i < keys2.length; i++) {
+          const strObj = strObjs[i];
           try {
-            const strObj = objs2[i];
             const obj = strObj ? JSON.parse(strObj) : null;
-            if (utils.checkObject(obj, options2, CONSTS.ACCESS_READ)) {
-              result2.push(keys2[i]);
+            if (utils.checkObject(obj, userContext2, CONSTS.ACCESS_READ)) {
+              result.push(keys2[i]);
             }
           } catch {
-            this.log.error(`${this.namespace} Cannot parse JSON ${keys2[i]}: ${objs2[i]}`);
+            this.log.error(`${this.namespace} Cannot parse JSON ${keys2[i]}: ${strObj}`);
           }
         }
       } else {
-        result2 = keys2;
+        result = keys2;
       }
-      const files = result2.map((key) => {
+      const files = result.map((key) => {
         const name2 = key.substring(this.fileNamespaceL + id.length + 3, key.length - 7);
         const pos = name2.lastIndexOf("/");
         if (pos !== -1) {
@@ -1346,47 +1470,68 @@ class ObjectsInRedisClient {
         return { file: id, path: "" };
       });
       try {
-        await this._rmHelper(result2);
+        await this._rmHelper(result);
       } catch (e) {
         this.log.error(`${this.namespace} Could not remove files: ${e.message}`);
       }
       return files;
     }
   }
-  rm(id, name, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
-    }
-    if (options2?.acl) {
-      options2.acl = null;
+  /**
+   * Delete a file or directory of an object
+   *
+   * @param id The id of the object owning the file
+   * @param name The file or directory name to delete
+   * @param options The current request options including the user, or the callback
+   * @param callback Called with the list of removed files
+   */
+  rm(id, name, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
     if (typeof name !== "string") {
       name = "";
     }
-    this.checkFileRights(id, null, options2, CONSTS.ACCESS_DELETE, async (err, options3, meta) => {
+    this.checkFileRights(id, null, options, CONSTS.ACCESS_DELETE, async (err, meta, userContext2) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithError(callback, err);
       }
-      if (!options3.acl.file.delete) {
+      if (!userContext2.acl.file.delete) {
         return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION);
       }
       try {
-        const files = await this._rm(id, name, options3, meta?.notExists ? null : meta);
+        const files = await this._rm(id, name, userContext2, meta?.notExists ? null : meta);
         return import_db_base.tools.maybeCallbackWithError(callback, null, files);
       } catch (e) {
         return import_db_base.tools.maybeCallbackWithError(callback, e);
       }
     });
   }
-  rmAsync(id, name, options2) {
-    return new Promise((resolve, reject) => this.rm(id, name, options2, (err, files) => err ? reject(err) : resolve(files)));
+  /**
+   * Promise-version of rm
+   *
+   * @param id The id of the object owning the file
+   * @param name The file or directory name to delete
+   * @param options The current request options including the user
+   * @param options.user The user on whose behalf the operation is performed
+   */
+  rmAsync(id, name, options) {
+    return new Promise((resolve, reject) => this.rm(id, name, options, (err, files) => err ? reject(err) : resolve(files)));
   }
   // simulate. redis has no dirs
-  mkdir(id, dirName, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
+  /**
+   * Create a directory for an object's files (simulated, as redis has no real directories)
+   *
+   * @param id The id of the object owning the files
+   * @param dirName The directory name to create
+   * @param options The current request options including the user, or the callback
+   * @param callback Called once the directory has been created
+   */
+  mkdir(id, dirName, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
     if (typeof dirName !== "string") {
       dirName = "";
@@ -1395,22 +1540,29 @@ class ObjectsInRedisClient {
     if (dirName.startsWith("/")) {
       dirName = dirName.substring(1);
     }
-    this.checkFileRights(id, dirName, options2, CONSTS.ACCESS_WRITE, (err, options3) => {
+    this.checkFileRights(id, dirName, options, CONSTS.ACCESS_WRITE, (err, meta, userContext2) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithError(callback, err);
       }
-      if (!options3.acl.file.write) {
+      if (!userContext2.acl.file.write) {
         return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION);
       }
-      options3 = { ...options3, virtualFile: true };
+      meta = { ...options, virtualFile: true };
       const realName = dirName + (dirName.endsWith("/") ? "" : "/");
-      this.writeFile(id, `${realName}_data.json`, "", options3, callback);
+      return this.writeFile(id, `${realName}_data.json`, "", meta, callback);
     });
   }
-  mkdirAsync(id, dirName, options2) {
-    return new Promise((resolve, reject) => this.mkdir(id, dirName, options2, (err) => err ? reject(err) : resolve()));
+  /**
+   * Promise-version of mkdir
+   *
+   * @param id The id of the object owning the files
+   * @param dirName The directory name to create
+   * @param options The current request options including the user
+   */
+  mkdirAsync(id, dirName, options) {
+    return new Promise((resolve, reject) => this.mkdir(id, dirName, options, (err) => err ? reject(err) : resolve()));
   }
-  async _chownFileHelper(keys2, metas, options2, callback) {
+  async _chownFileHelper(keys2, metas, options, callback) {
     if (!keys2.length) {
       return import_db_base.tools.maybeCallback(callback);
     }
@@ -1419,8 +1571,8 @@ class ObjectsInRedisClient {
     }
     for (const id of keys2) {
       const meta = metas.shift();
-      meta.acl.owner = options2.owner;
-      meta.acl.ownerGroup = options2.ownerGroup;
+      meta.acl.owner = options.owner;
+      meta.acl.ownerGroup = options.ownerGroup;
       try {
         await this.client.set(id, JSON.stringify(meta));
       } catch (e) {
@@ -1429,7 +1581,7 @@ class ObjectsInRedisClient {
     }
     return import_db_base.tools.maybeCallback(callback);
   }
-  async _chownFile(id, name, options2, callback, meta) {
+  async _chownFile(id, name, options, meta, userContext2, callback) {
     if (!meta) {
       return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_NOT_FOUND);
     }
@@ -1439,8 +1591,8 @@ class ObjectsInRedisClient {
     }
     if (!meta.isDir && !meta.notExists) {
       const metaID = this.getFileId(id, name, true);
-      meta.acl.owner = options2.owner;
-      meta.acl.ownerGroup = options2.ownerGroup;
+      meta.acl.owner = options.owner;
+      meta.acl.ownerGroup = options.ownerGroup;
       try {
         await this.client.set(metaID, JSON.stringify(meta));
       } catch (e) {
@@ -1486,7 +1638,7 @@ class ObjectsInRedisClient {
     } catch (e) {
       return import_db_base.tools.maybeCallbackWithRedisError(callback, e);
     }
-    const dontCheck = options2.user === CONSTS.SYSTEM_ADMIN_USER || options2.group !== CONSTS.SYSTEM_ADMIN_GROUP || options2.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP);
+    const dontCheck = userContext2.user === CONSTS.SYSTEM_ADMIN_USER || userContext2.group === CONSTS.SYSTEM_ADMIN_GROUP || userContext2.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP);
     const keysFiltered = [];
     const objsFiltered = [];
     const processed = [];
@@ -1501,7 +1653,7 @@ class ObjectsInRedisClient {
         this.log.error(`${this.namespace} Cannot parse JSON ${keys2[i]}: ${metaStr}`);
         continue;
       }
-      if (dontCheck || utils.checkObject(meta2, options2, CONSTS.ACCESS_WRITE)) {
+      if (dontCheck || utils.checkObject(meta2, userContext2, CONSTS.ACCESS_WRITE)) {
         if (!meta2 || meta2.virtualFile) {
           continue;
         }
@@ -1521,76 +1673,92 @@ class ObjectsInRedisClient {
         });
       }
     }
-    this._chownFileHelper(keysFiltered, objsFiltered, options2, (err) => {
+    return this._chownFileHelper(keysFiltered, objsFiltered, options, (err) => {
       return import_db_base.tools.maybeCallbackWithError(callback, err, processed);
     });
   }
-  chownFile(id, name, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = {};
-    }
-    options2 = options2 || {};
-    if (typeof options2 !== "object") {
-      options2 = { owner: options2 };
-    }
+  /**
+   * Change the owner and owner group of a file
+   *
+   * @param id The id of the object owning the file
+   * @param name The file name
+   * @param options The current request options including the new owner and the user
+   * @param options.owner The new owner (user id) to assign to the file
+   * @param options.user The user on whose behalf the operation is performed
+   * @param options.ownerGroup The new owner group to assign to the file
+   * @param options.group The new owner group to assign (alias for ownerGroup)
+   * @param callback Called with the processed file(s)
+   */
+  chownFile(id, name, options, callback) {
     if (typeof name !== "string" || !name.length || name === "/") {
       return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_NOT_FOUND);
     }
     if (name.startsWith("/")) {
       name = name.substring(1);
     }
-    if (!options2.ownerGroup && options2.group) {
-      options2.ownerGroup = options2.group;
+    if (options?.group && !options.ownerGroup) {
+      options.ownerGroup = options.group;
     }
-    if (!options2.owner && options2.user) {
-      options2.owner = options2.user;
+    if (options?.user && !options.owner) {
+      options.owner = options.user;
     }
-    if (!options2.owner) {
+    if (!options?.owner) {
       this.log.error(`${this.namespace} user is not defined`);
       return import_db_base.tools.maybeCallbackWithError(callback, "invalid parameter");
     }
-    if (!options2.ownerGroup) {
-      this.getUserGroup(options2.owner, (user, groups) => {
-        if (!groups || !groups[0]) {
-          return import_db_base.tools.maybeCallbackWithError(callback, `user "${options2.owner}" belongs to no group`);
+    if (!options.ownerGroup) {
+      this.getUserGroup(options.owner, (user, groups) => {
+        if (!groups?.[0]) {
+          return import_db_base.tools.maybeCallbackWithError(callback, `user "${options.owner}" belongs to no group`);
         }
-        options2.ownerGroup = groups[0];
-        this.chownFile(id, name, options2, callback);
+        options.ownerGroup = groups[0];
+        this.chownFile(id, name, options, callback);
       });
       return;
     }
-    this.checkFileRights(id, name, options2, CONSTS.ACCESS_WRITE, (err, options3, meta) => {
+    this.checkFileRights(id, name, options, CONSTS.ACCESS_WRITE, (err, meta, userContext2) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithError(callback, err);
       }
-      if (!options3.acl.file.write) {
+      if (!userContext2.acl.file.write) {
         return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION);
       }
-      return this._chownFile(id, name, options3, callback, meta);
+      return this._chownFile(id, name, options, meta, userContext2, callback);
     });
   }
-  chownFileAsync(id, name, options2) {
-    return new Promise((resolve, reject) => this.chownFile(id, name, options2, (err, processed) => err ? reject(err) : resolve(processed)));
+  /**
+   * Promise-version of chownFile
+   *
+   * @param id The id of the object owning the file
+   * @param name The file name
+   * @param options The current request options including the new owner and the user
+   * @param options.user The user on whose behalf the operation is performed
+   * @param options.owner The new owner (user id) to assign to the file
+   * @param options.ownerGroup The new owner group to assign to the file
+   */
+  chownFileAsync(id, name, options) {
+    return new Promise((resolve, reject) => this.chownFile(id, name, options, (err, processed) => err ? reject(err) : resolve(processed)));
   }
   /**
    *
    * @param keys Key names to handle
    * @param metas Objects for the keys to handle
    * @param options options
+   * @param options.user The user on whose behalf the operation is performed
+   * @param options.mode The new permission mode to apply
    * @param callback callback function
    */
-  async _chmodFileHelper(keys2, metas, options2, callback) {
+  async _chmodFileHelper(keys2, metas, options, callback) {
     if (!keys2 || !keys2.length) {
       return import_db_base.tools.maybeCallback(callback);
     }
     if (!this.client) {
       return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_DB_CLOSED);
     }
-    for (const i in keys2) {
+    for (let i = 0; i < keys2.length; i++) {
       const id = keys2[i];
       const meta = metas[i];
-      meta.acl.permissions = options2.mode;
+      meta.acl.permissions = options.mode;
       try {
         await this.client.set(id, JSON.stringify(meta));
       } catch (e) {
@@ -1599,7 +1767,7 @@ class ObjectsInRedisClient {
     }
     return import_db_base.tools.maybeCallback(callback);
   }
-  async _chmodFile(id, name, options2, callback, meta) {
+  async _chmodFile(id, name, options, meta, userContext2, callback) {
     if (!meta) {
       return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_NOT_FOUND);
     }
@@ -1609,7 +1777,7 @@ class ObjectsInRedisClient {
     }
     if (!meta.isDir && !meta.notExists) {
       const metaID = this.getFileId(id, name, true);
-      meta.acl.permissions = options2.mode;
+      meta.acl.permissions = options.mode;
       try {
         await this.client.set(metaID, JSON.stringify(meta));
       } catch (e) {
@@ -1655,7 +1823,7 @@ class ObjectsInRedisClient {
     } catch (e) {
       return import_db_base.tools.maybeCallbackWithRedisError(callback, e);
     }
-    const dontCheck = options2.user === CONSTS.SYSTEM_ADMIN_USER || options2.group !== CONSTS.SYSTEM_ADMIN_GROUP || options2.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP);
+    const dontCheck = userContext2.user === CONSTS.SYSTEM_ADMIN_USER || userContext2.group === CONSTS.SYSTEM_ADMIN_GROUP || userContext2.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP);
     const keysFiltered = [];
     const objsFiltered = [];
     const processed = [];
@@ -1670,7 +1838,7 @@ class ObjectsInRedisClient {
         this.log.error(`${this.namespace} Cannot parse JSON ${keys2[i]}: ${strObj}`);
         continue;
       }
-      if (dontCheck || utils.checkObject(obj, options2, CONSTS.ACCESS_WRITE)) {
+      if (dontCheck || utils.checkObject(obj, userContext2, CONSTS.ACCESS_WRITE)) {
         if (!obj || obj.virtualFile) {
           continue;
         }
@@ -1690,59 +1858,86 @@ class ObjectsInRedisClient {
         });
       }
     }
-    this._chmodFileHelper(keysFiltered, objsFiltered, options2, (err) => import_db_base.tools.maybeCallbackWithError(callback, err, processed));
+    return this._chmodFileHelper(keysFiltered, objsFiltered, options, (err) => import_db_base.tools.maybeCallbackWithError(callback, err, processed));
   }
-  chmodFile(id, name, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
+  /**
+   * Change the file mode (permissions) of a single file
+   *
+   * @param id The id of the object owning the file
+   * @param name The file name
+   * @param options The current request options including the new mode and the user, or the callback
+   * @param options.user The user on whose behalf the operation is performed
+   * @param options.mode The new permission mode to apply
+   * @param callback Called with the processed file
+   */
+  chmodFile(id, name, options, callback) {
+    if (!options || options.mode === void 0) {
+      throw new Error("options.mode is not defined");
     }
-    options2 = options2 || {};
     if (typeof name !== "string" || !name.length || name === "/") {
       return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_NOT_FOUND);
     }
     if (name[0].startsWith("/")) {
       name = name.substring(1);
     }
-    if (typeof options2 !== "object") {
-      options2 = { mode: options2 };
+    if (typeof options !== "object") {
+      options = { mode: options };
     }
-    if (options2.mode === void 0) {
+    if (options.mode === void 0) {
       this.log.error(`${this.namespace} mode is not defined`);
       return import_db_base.tools.maybeCallbackWithError(callback, "invalid parameter");
-    } else if (typeof options2.mode === "string") {
-      options2.mode = parseInt(options2.mode, 16);
+    } else if (typeof options.mode === "string") {
+      options.mode = parseInt(options.mode, 16);
     }
-    this.checkFileRights(id, name, options2, CONSTS.ACCESS_WRITE, (err, options3, meta) => {
+    this.checkFileRights(id, name, options, CONSTS.ACCESS_WRITE, (err, meta, userContext2) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithError(callback, err);
       }
-      if (!options3.acl.file.write) {
+      if (!userContext2.acl.file.write) {
         return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION);
       }
-      return this._chmodFile(id, name, options3, callback, meta);
+      return this._chmodFile(id, name, options, meta, userContext2, callback);
     });
   }
-  chmodFileAsync(id, name, options2) {
-    return new Promise((resolve, reject) => this.chmodFile(id, name, options2, (err, processed) => err ? reject(err) : resolve(processed)));
+  /**
+   * Promise-version of chmodFile
+   *
+   * @param id The id of the object owning the file
+   * @param name The file name
+   * @param options The current request options including the new mode and the user
+   * @param options.user The user on whose behalf the operation is performed
+   * @param options.mode The new permission mode to apply
+   */
+  chmodFileAsync(id, name, options) {
+    return new Promise((resolve, reject) => this.chmodFile(id, name, options, (err, processed) => err ? reject(err) : resolve(processed)));
   }
-  enableFileCache(enabled, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
-    }
-    if (options2?.acl) {
-      options2.acl = null;
+  /**
+   * Enable or disable the file cache
+   *
+   * @param enabled Whether the file cache should be enabled
+   * @param options The current request options including the user, or the callback
+   * @param callback Called with the resulting cache state
+   */
+  enableFileCache(enabled, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
-    utils.checkObjectRights(this, null, null, options2, CONSTS.ACCESS_WRITE, (err, _options) => {
+    utils.checkObjectRights(this, null, null, options, CONSTS.ACCESS_WRITE, (err) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithError(callback, err);
       }
       return import_db_base.tools.maybeCallbackWithError(callback, null, false);
     });
   }
-  enableFileCacheAsync(enabled, options2) {
-    return new Promise((resolve, reject) => this.enableFileCache(enabled, options2, (err, res) => err ? reject(err) : resolve(res)));
+  /**
+   * Promise-version of enableFileCache
+   *
+   * @param enabled Whether the file cache should be enabled
+   * @param options The current request options including the user
+   */
+  enableFileCacheAsync(enabled, options) {
+    return new Promise((resolve, reject) => this.enableFileCache(enabled, options, (err, res) => err ? reject(err) : resolve(res)));
   }
   async _subscribeFile(id, pattern) {
     if (!this.sub) {
@@ -1788,9 +1983,16 @@ class ObjectsInRedisClient {
       }
     }
   }
-  subscribeUserFile(id, pattern, options2) {
+  /**
+   * Subscribe a user to file changes of an object
+   *
+   * @param id The id of the object owning the files
+   * @param pattern One or more file name patterns to subscribe to
+   * @param options The current request options including the user
+   */
+  subscribeUserFile(id, pattern, options) {
     return new Promise((resolve, reject) => {
-      utils.checkObjectRights(this, null, null, options2, "list", (err) => {
+      utils.checkObjectRights(this, null, null, options, "list", (err) => {
         if (err) {
           reject(err);
         } else {
@@ -1799,9 +2001,16 @@ class ObjectsInRedisClient {
       });
     });
   }
-  unsubscribeUserFile(id, pattern, options2) {
+  /**
+   * Unsubscribe a user from file changes of an object
+   *
+   * @param id The id of the object owning the files
+   * @param pattern One or more file name patterns to unsubscribe from
+   * @param options The current request options including the user
+   */
+  unsubscribeUserFile(id, pattern, options) {
     return new Promise((resolve, reject) => {
-      utils.checkObjectRights(this, null, null, options2, "list", (err) => {
+      utils.checkObjectRights(this, null, null, options, "list", (err) => {
         if (err) {
           reject(err);
         } else {
@@ -1840,38 +2049,64 @@ class ObjectsInRedisClient {
       });
     }
   }
-  subscribeConfig(pattern, options2, callback) {
-    utils.checkObjectRights(this, null, null, options2, "list", (err) => {
+  subscribeConfig(pattern, options, callback) {
+    utils.checkObjectRights(this, null, null, options, "list", (err) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithRedisError(callback, err);
       }
       return this._subscribe(pattern, false, callback);
     });
   }
-  subscribe(pattern, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
+  /**
+   * Subscribe to object changes matching the given pattern
+   *
+   * @param pattern One or more patterns to subscribe to
+   * @param options The current request options including the user, or the callback
+   * @param callback Called once the subscription is registered
+   */
+  subscribe(pattern, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
-    return this.subscribeConfig(pattern, options2, callback);
+    return this.subscribeConfig(pattern, options, callback);
   }
-  subscribeAsync(pattern, options2) {
-    return new Promise((resolve, reject) => this.subscribe(pattern, options2, (err) => err ? reject(err) : resolve()));
+  /**
+   * Promise-version of subscribe
+   *
+   * @param pattern One or more patterns to subscribe to
+   * @param options The current request options including the user
+   */
+  subscribeAsync(pattern, options) {
+    return new Promise((resolve, reject) => this.subscribe(pattern, options, (err) => err ? reject(err) : resolve()));
   }
-  subscribeUser(pattern, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
+  /**
+   * Subscribe a user to object changes matching the given pattern
+   *
+   * @param pattern One or more patterns to subscribe to
+   * @param options The current request options including the user, or the callback
+   * @param callback Called once the subscription is registered
+   */
+  subscribeUser(pattern, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
-    utils.checkObjectRights(this, null, null, options2, "list", (err) => {
+    utils.checkObjectRights(this, null, null, options, "list", (err) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithRedisError(callback, err);
       }
       return this._subscribe(pattern, true, callback);
     });
   }
-  subscribeUserAsync(pattern, options2) {
-    return new Promise((resolve, reject) => this.subscribeUser(pattern, options2, (err) => err ? reject(err) : resolve()));
+  /**
+   * Promise-version of subscribeUser
+   *
+   * @param pattern One or more patterns to subscribe to
+   * @param options The current request options including the user
+   */
+  subscribeUserAsync(pattern, options) {
+    return new Promise((resolve, reject) => this.subscribeUser(pattern, options, (err) => err ? reject(err) : resolve()));
   }
   async _unsubscribe(pattern, asUser) {
     const subClient = asUser ? this.sub : this.subSystem;
@@ -1896,8 +2131,8 @@ class ObjectsInRedisClient {
       }
     }
   }
-  unsubscribeConfig(pattern, options2, callback) {
-    utils.checkObjectRights(this, null, null, options2, "list", async (err) => {
+  unsubscribeConfig(pattern, options, callback) {
+    utils.checkObjectRights(this, null, null, options, "list", async (err) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithRedisError(callback, err);
       }
@@ -1909,22 +2144,42 @@ class ObjectsInRedisClient {
       }
     });
   }
-  unsubscribe(pattern, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
+  /**
+   * Unsubscribe from object changes matching the given pattern
+   *
+   * @param pattern One or more patterns to unsubscribe from
+   * @param options The current request options including the user, or the callback
+   * @param callback Called once the subscription is removed
+   */
+  unsubscribe(pattern, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
-    return this.unsubscribeConfig(pattern, options2, callback);
+    return this.unsubscribeConfig(pattern, options, callback);
   }
-  unsubscribeAsync(pattern, options2) {
-    return new Promise((resolve, reject) => this.unsubscribe(pattern, options2, (err) => err ? reject(err) : resolve()));
+  /**
+   * Promise-version of unsubscribe
+   *
+   * @param pattern One or more patterns to unsubscribe from
+   * @param options The current request options including the user
+   */
+  unsubscribeAsync(pattern, options) {
+    return new Promise((resolve, reject) => this.unsubscribe(pattern, options, (err) => err ? reject(err) : resolve()));
   }
-  unsubscribeUser(pattern, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
+  /**
+   * Unsubscribe a user from object changes matching the given pattern
+   *
+   * @param pattern One or more patterns to unsubscribe from
+   * @param options The current request options including the user, or the callback
+   * @param callback Called once the subscription is removed
+   */
+  unsubscribeUser(pattern, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
-    utils.checkObjectRights(this, null, null, options2, "list", async (err) => {
+    utils.checkObjectRights(this, null, null, options, "list", async (err) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithError(callback, err);
       }
@@ -1936,8 +2191,14 @@ class ObjectsInRedisClient {
       }
     });
   }
-  unsubscribeUserAsync(pattern, options2) {
-    return new Promise((resolve, reject) => this.unsubscribeUser(pattern, options2, (err) => err ? reject(err) : resolve()));
+  /**
+   * Promise-version of unsubscribeUser
+   *
+   * @param pattern One or more patterns to unsubscribe from
+   * @param options The current request options including the user
+   */
+  unsubscribeUserAsync(pattern, options) {
+    return new Promise((resolve, reject) => this.unsubscribeUser(pattern, options, (err) => err ? reject(err) : resolve()));
   }
   async _objectHelper(keys2, objs2) {
     if (!keys2.length) {
@@ -1967,8 +2228,8 @@ class ObjectsInRedisClient {
       await this.client.publish(id, message);
     }
   }
-  _chownObject(pattern, options2, callback) {
-    this.getKeys(pattern, options2, async (err, keys2) => {
+  _chownObject(pattern, options, userContext2, callback) {
+    this.getKeys(pattern, options, async (err, keys2) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithError(callback, err);
       }
@@ -1995,7 +2256,7 @@ class ObjectsInRedisClient {
           this.log.error(`${this.namespace} Cannot parse JSON ${keys2[i]}: ${strObj}`);
           continue;
         }
-        if (!obj || !utils.checkObject(obj, options2, CONSTS.ACCESS_WRITE)) {
+        if (!obj || !utils.checkObject(obj, userContext2, CONSTS.ACCESS_WRITE)) {
           continue;
         }
         if (!obj.acl) {
@@ -2009,8 +2270,8 @@ class ObjectsInRedisClient {
             obj.acl.state = this.defaultNewAcl?.state || CONSTS.ACCESS_USER_RW | CONSTS.ACCESS_GROUP_READ | CONSTS.ACCESS_EVERY_READ;
           }
         }
-        obj.acl.owner = options2.owner || obj.acl.owner;
-        obj.acl.ownerGroup = options2.ownerGroup || obj.acl.ownerGroup;
+        obj.acl.owner = options.owner || obj.acl.owner;
+        obj.acl.ownerGroup = options.ownerGroup || obj.acl.ownerGroup;
         filteredKeys.push(keys2[i]);
         filteredObjs.push(obj);
       }
@@ -2022,51 +2283,63 @@ class ObjectsInRedisClient {
       return import_db_base.tools.maybeCallbackWithError(callback, null, filteredObjs);
     }, true);
   }
-  chownObject(pattern, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = {};
-    }
-    options2 = options2 || {};
-    options2.acl = null;
-    if (typeof options2 !== "object") {
-      options2 = { owner: options2 };
-    }
-    if (!options2.ownerGroup && options2.group) {
-      options2.ownerGroup = options2.group;
+  /**
+   * Change the owner and owner group of all objects matching the given pattern
+   *
+   * @param pattern The pattern of object ids whose owner should be changed
+   * @param options The current request options including the new owner and the user, or the callback
+   * @param options.user The user on whose behalf the operation is performed
+   * @param options.owner The new owner (user id) to assign to the objects
+   * @param options.ownerGroup The new owner group to assign to the objects
+   * @param options.group The new owner group to assign (alias for ownerGroup)
+   * @param callback Called with the list of changed objects
+   */
+  chownObject(pattern, options, callback) {
+    if (options?.group && !options.ownerGroup) {
+      options.ownerGroup = options.group;
     }
-    if (!options2.owner && options2.user) {
-      options2.owner = options2.user;
+    if (options?.user && !options.owner) {
+      options.owner = options.user;
     }
-    if (!options2.owner) {
+    if (!options.owner) {
       this.log.error(`${this.namespace} user is not defined`);
       return import_db_base.tools.maybeCallbackWithError(callback, "invalid parameter");
     }
-    if (!options2.ownerGroup) {
-      this.getUserGroup(options2.owner, (user, groups) => {
-        if (!groups || !groups[0]) {
-          return import_db_base.tools.maybeCallbackWithError(callback, `user "${options2.owner}" belongs to no group`);
+    if (!options.ownerGroup) {
+      this.getUserGroup(options.owner, (user, groups) => {
+        if (!groups?.[0]) {
+          return import_db_base.tools.maybeCallbackWithError(callback, `user "${options.owner}" belongs to no group`);
         }
-        options2.ownerGroup = groups[0];
-        this.chownObject(pattern, options2, callback);
+        options.ownerGroup = groups[0];
+        return this.chownObject(pattern, options, callback);
       });
       return;
     }
-    utils.checkObjectRights(this, null, null, options2, CONSTS.ACCESS_WRITE, (err, options3) => {
+    utils.checkObjectRights(this, null, null, options, CONSTS.ACCESS_WRITE, (err, userContext2) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithRedisError(callback, err);
       }
-      if (!options3.acl.object || !options3.acl.object.write) {
+      if (!userContext2.acl.object || !userContext2.acl.object.write) {
         return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION);
       }
-      return this._chownObject(pattern, options3, callback);
+      return this._chownObject(pattern, options, userContext2, callback);
     });
   }
-  chownObjectAsync(pattern, options2) {
-    return new Promise((resolve, reject) => this.chownObject(pattern, options2, (err, list) => err ? reject(err) : resolve(list)));
+  /**
+   * Promise-version of chownObject
+   *
+   * @param pattern The pattern of object ids whose owner should be changed
+   * @param options The current request options including the new owner and the user
+   * @param options.user The user on whose behalf the operation is performed
+   * @param options.owner The new owner (user id) to assign to the objects
+   * @param options.ownerGroup The new owner group to assign to the objects
+   * @param options.group The new owner group to assign (alias for ownerGroup)
+   */
+  chownObjectAsync(pattern, options) {
+    return new Promise((resolve, reject) => this.chownObject(pattern, options, (err, list) => err ? reject(err) : resolve(list)));
   }
-  _chmodObject(pattern, options2, callback) {
-    this.getKeys(pattern, options2, async (err, keys2) => {
+  _chmodObject(pattern, options, userContext2, callback) {
+    this.getKeys(pattern, options, async (err, keys2) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithRedisError(callback, err);
       }
@@ -2093,7 +2366,7 @@ class ObjectsInRedisClient {
           this.log.error(`${this.namespace} Cannot parse JSON ${keys2[i]}: ${strObj}`);
           continue;
         }
-        if (!utils.checkObject(obj, options2, CONSTS.ACCESS_WRITE) || !obj) {
+        if (!utils.checkObject(obj, userContext2, CONSTS.ACCESS_WRITE) || !obj) {
           continue;
         }
         if (!obj.acl) {
@@ -2107,11 +2380,11 @@ class ObjectsInRedisClient {
             obj.acl.state = this.defaultNewAcl?.state || CONSTS.ACCESS_USER_RW | CONSTS.ACCESS_GROUP_READ | CONSTS.ACCESS_EVERY_READ;
           }
         }
-        if (options2.object !== void 0) {
-          obj.acl.object = options2.object;
+        if (options.object !== void 0) {
+          obj.acl.object = options.object;
         }
-        if (options2.state !== void 0 && "state" in obj.acl) {
-          obj.acl.state = options2.state;
+        if (options.state !== void 0 && "state" in obj.acl) {
+          obj.acl.state = options.state;
         }
         filteredKeys.push(keys2[i]);
         filteredObjs.push(obj);
@@ -2123,39 +2396,55 @@ class ObjectsInRedisClient {
       }
     }, true);
   }
-  chmodObject(pattern, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
-    }
-    options2 = options2 || {};
-    options2.acl = null;
-    if (typeof options2 !== "object") {
-      options2 = { object: options2 };
+  /**
+   * Change the file mode (permissions) of all files matching the given pattern
+   *
+   * @param pattern The pattern of object ids whose files should be changed
+   * @param options The current request options including the new mode and the user, or the callback
+   * @param options.mode The new permission mode to apply
+   * @param options.user The user on whose behalf the operation is performed
+   * @param options.object The permission bitmask for object access
+   * @param options.state The permission bitmask for state access
+   * @param callback Called with the list of changed objects
+   */
+  chmodObject(pattern, options, callback) {
+    if (!options) {
+      this.log.error(`${this.namespace} mode is not defined`);
+      return import_db_base.tools.maybeCallbackWithError(callback, "invalid parameter");
     }
-    if (options2.mode && !options2.object) {
-      options2.object = options2.mode;
+    if (options.mode && !options.object) {
+      options.object = options.mode;
     }
-    if (options2.object === void 0) {
+    if (options.object === void 0) {
       this.log.error(`${this.namespace} mode is not defined`);
       return import_db_base.tools.maybeCallbackWithError(callback, "invalid parameter");
-    } else if (typeof options2.mode === "string") {
-      options2.mode = parseInt(options2.mode, 16);
+    } else if (typeof options.mode === "string") {
+      options.mode = parseInt(options.mode, 16);
     }
-    utils.checkObjectRights(this, null, null, options2, CONSTS.ACCESS_WRITE, (err, options3) => {
+    utils.checkObjectRights(this, null, null, options, CONSTS.ACCESS_WRITE, (err, userContext2) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithRedisError(callback, err);
       }
-      if (!options3.acl.file.write) {
+      if (!userContext2.acl.file.write) {
         return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION);
       }
-      return this._chmodObject(pattern, options3, callback);
+      return this._chmodObject(pattern, options, userContext2, callback);
     });
   }
-  chmodObjectAsync(pattern, options2) {
-    return new Promise((resolve, reject) => this.chmodObject(pattern, options2, (err, list) => err ? reject(err) : resolve(list)));
+  /**
+   * Promise-version of chmodObject
+   *
+   * @param pattern The pattern of object ids whose files should be changed
+   * @param options The current request options including the new mode and the user
+   * @param options.mode The new permission mode to apply
+   * @param options.user The user on whose behalf the operation is performed
+   * @param options.object The permission bitmask for object access
+   * @param options.state The permission bitmask for state access
+   */
+  chmodObjectAsync(pattern, options) {
+    return new Promise((resolve, reject) => this.chmodObject(pattern, options, (err, list) => err ? reject(err) : resolve(list)));
   }
-  async _getObject(id, options2, callback) {
+  async _getObject(id, userContext2, callback) {
     if (!this.client) {
       return import_db_base.tools.maybeCallbackWithRedisError(callback, ERRORS.ERROR_DB_CLOSED);
     }
@@ -2179,43 +2468,48 @@ class ObjectsInRedisClient {
       }
     }
     if (obj) {
-      if (utils.checkObject(obj, options2, CONSTS.ACCESS_READ)) {
+      if (utils.checkObject(obj, userContext2, CONSTS.ACCESS_READ)) {
         return import_db_base.tools.maybeCallbackWithError(callback, null, obj);
       }
       return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION);
     }
     return import_db_base.tools.maybeCallbackWithRedisError(callback, err, obj);
   }
-  getObject(id, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
+  /**
+   * Get a single object by its id
+   *
+   * @param id The id of the object to read
+   * @param options The current request options including the user, or the callback
+   * @param callback Called with the read object
+   */
+  getObject(id, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
     if (!callback) {
-      return new Promise((resolve, reject) => this.getObject(id, options2, (err, obj) => err ? reject(err) : resolve(obj)));
+      return new Promise((resolve, reject) => this.getObject(id, options, (err, obj) => err ? reject(err) : resolve(obj)));
     }
     if (typeof callback === "function") {
-      if (options2?.acl) {
-        options2.acl = null;
-      }
-      utils.checkObjectRights(this, null, null, options2, CONSTS.ACCESS_READ, (err, options3) => {
+      utils.checkObjectRights(this, null, null, options, CONSTS.ACCESS_READ, (err, userContext2) => {
         if (err) {
           return import_db_base.tools.maybeCallbackWithError(callback, err);
         }
-        return this._getObject(id, options3, callback);
+        return this._getObject(id, userContext2, callback);
       });
     }
   }
   /**
+   * Promise-version of getObject
    *
-   * @param id
-   * @param options
+   * @param id The id of the object to read
+   * @param options The current request options including the user
    * @deprecated use `getObject` without callback instead
    */
-  getObjectAsync(id, options2) {
-    return new Promise((resolve, reject) => this.getObject(id, options2, (err, obj) => err ? reject(err) : resolve(obj)));
+  getObjectAsync(id, options) {
+    return new Promise((resolve, reject) => this.getObject(id, options, (err, obj) => err ? reject(err) : resolve(obj)));
   }
-  async _getKeys(pattern, options2, callback, dontModify) {
+  async _getKeys(pattern, userContext2, dontModify, callback) {
     if (!this.client) {
       return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_DB_CLOSED);
     }
@@ -2232,23 +2526,23 @@ class ObjectsInRedisClient {
     if (!this.client) {
       return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_DB_CLOSED);
     }
-    const result2 = [];
+    const result = [];
     if (keys2) {
       keys2.sort();
-      const result3 = [];
-      const dontCheck = options2.user === CONSTS.SYSTEM_ADMIN_USER || options2.group !== CONSTS.SYSTEM_ADMIN_GROUP || options2.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP);
+      const result2 = [];
+      const dontCheck = userContext2.user === CONSTS.SYSTEM_ADMIN_USER || userContext2.group === CONSTS.SYSTEM_ADMIN_GROUP || userContext2.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP);
       if (dontCheck) {
         for (let i = 0; i < keys2.length; i++) {
           const id = keys2[i].substring(this.objNamespaceL);
           if (r.test(id)) {
             if (!dontModify) {
-              result3.push(id);
+              result2.push(id);
             } else {
-              result3.push(keys2[i]);
+              result2.push(keys2[i]);
             }
           }
         }
-        return import_db_base.tools.maybeCallbackWithError(callback, null, result3);
+        return import_db_base.tools.maybeCallbackWithError(callback, null, result2);
       }
       let metas;
       try {
@@ -2266,39 +2560,54 @@ class ObjectsInRedisClient {
           this.log.error(`${this.namespace} Cannot parse JSON ${keys2[i]}: ${metaStr}`);
           continue;
         }
-        if (r.test(keys2[i]) && utils.checkObject(meta, options2, CONSTS.ACCESS_READ)) {
+        if (r.test(keys2[i]) && utils.checkObject(meta, userContext2, CONSTS.ACCESS_READ)) {
           if (!dontModify) {
-            result3.push(keys2[i].substring(this.objNamespaceL));
+            result2.push(keys2[i].substring(this.objNamespaceL));
           } else {
-            result3.push(keys2[i]);
+            result2.push(keys2[i]);
           }
         }
       }
-      return import_db_base.tools.maybeCallbackWithError(callback, null, result3);
+      return import_db_base.tools.maybeCallbackWithError(callback, null, result2);
     }
-    return import_db_base.tools.maybeCallbackWithError(callback, null, result2);
+    return import_db_base.tools.maybeCallbackWithError(callback, null, result);
   }
-  getKeys(pattern, options2, callback, dontModify) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
+  /**
+   * Get all object ids matching the given pattern
+   *
+   * @param pattern The pattern to match object ids against
+   * @param options The current request options including the user, or the callback
+   * @param callback Called with the matching keys
+   * @param dontModify If true, the returned keys are not stripped of the namespace
+   */
+  getKeys(pattern, options, callback, dontModify) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
     if (!callback) {
-      return new Promise((resolve, reject) => this.getKeys(pattern, options2, (err, obj) => err ? reject(err) : resolve(obj), dontModify));
+      return new Promise((resolve, reject) => this.getKeys(pattern, options, (err, obj) => err ? reject(err) : resolve(obj), dontModify));
     }
     if (typeof callback === "function") {
-      utils.checkObjectRights(this, null, null, options2, "list", (err, options3) => {
+      utils.checkObjectRights(this, null, null, options, "list", (err, userContext2) => {
         if (err) {
           return import_db_base.tools.maybeCallbackWithRedisError(callback, err);
         }
-        return this._getKeys(pattern, options3, callback, dontModify);
+        return this._getKeys(pattern, userContext2, dontModify, callback);
       });
     }
   }
-  getKeysAsync(id, options2) {
-    return this.getKeys(id, options2);
+  /**
+   * Promise-version of getKeys
+   *
+   * @param pattern The pattern to match object ids against
+   * @param options The current request options including the user
+   * @param options.user The user on whose behalf the keys are read
+   */
+  getKeysAsync(pattern, options) {
+    return this.getKeys(pattern, options);
   }
-  async _getObjects(keys2, options2, callback, dontModify) {
+  async _getObjects(keys2, userContext2, callback, dontModify) {
     if (!keys2) {
       return import_db_base.tools.maybeCallbackWithError(callback, "no keys");
     }
@@ -2326,9 +2635,9 @@ class ObjectsInRedisClient {
     } catch (e) {
       this.log.warn(`${this.namespace} redis mget ${!objs2 ? 0 : objs2.length} ${_keys.length}, err: ${e.message}`);
     }
-    let result2 = [];
+    let result = [];
     if (objs2) {
-      const dontCheck = options2 && (options2.user === CONSTS.SYSTEM_ADMIN_USER || options2.group !== CONSTS.SYSTEM_ADMIN_GROUP || options2.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP));
+      const dontCheck = userContext2 && (userContext2.user === CONSTS.SYSTEM_ADMIN_USER || userContext2.group === CONSTS.SYSTEM_ADMIN_GROUP || userContext2.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP));
       if (!dontCheck) {
         for (let i = 0; i < objs2.length; i++) {
           const strObj = objs2[i];
@@ -2337,17 +2646,17 @@ class ObjectsInRedisClient {
             obj = strObj ? JSON.parse(strObj) : null;
           } catch {
             this.log.error(`${this.namespace} Cannot parse JSON ${_keys[i]}: ${objs2[i]}`);
-            result2.push({ error: ERRORS.ERROR_PERMISSION });
+            result.push({ error: ERRORS.ERROR_PERMISSION });
             continue;
           }
-          if (utils.checkObject(obj, options2, CONSTS.ACCESS_READ)) {
-            result2.push(obj);
+          if (utils.checkObject(obj, userContext2, CONSTS.ACCESS_READ)) {
+            result.push(obj);
           } else {
-            result2.push({ error: ERRORS.ERROR_PERMISSION });
+            result.push({ error: ERRORS.ERROR_PERMISSION });
           }
         }
       } else {
-        result2 = objs2.map((obj, i) => {
+        result = objs2.map((obj, i) => {
           try {
             return obj !== null ? JSON.parse(obj) : obj;
           } catch {
@@ -2357,35 +2666,46 @@ class ObjectsInRedisClient {
         });
       }
     }
-    return import_db_base.tools.maybeCallbackWithError(callback, null, result2);
+    return import_db_base.tools.maybeCallbackWithError(callback, null, result);
   }
-  getObjects(keys2, options2, callback, dontModify) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
+  /**
+   * Get multiple objects by their ids
+   *
+   * @param keys The ids of the objects to read
+   * @param options The current request options including the user, or the callback
+   * @param callback Called with the read objects
+   * @param dontModify If true, the returned objects are not cloned/modified
+   */
+  getObjects(keys2, options, callback, dontModify) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
     if (!callback) {
       return new Promise((resolve, reject) => (
         // @ts-expect-error need to clarify, that objs is not undefined if no error is provided
-        this.getObjects(keys2, options2, (err, objs2) => err ? reject(err) : resolve(objs2), dontModify)
+        this.getObjects(keys2, options, (err, objs2) => err ? reject(err) : resolve(objs2), dontModify)
       ));
     }
-    if (options2?.acl) {
-      options2.acl = null;
-    }
     if (typeof callback === "function") {
-      utils.checkObjectRights(this, null, null, options2, CONSTS.ACCESS_READ, (err, options3) => {
+      utils.checkObjectRights(this, null, null, options, CONSTS.ACCESS_READ, (err, userContext2) => {
         if (err) {
           return import_db_base.tools.maybeCallbackWithRedisError(callback, err);
         }
-        return this._getObjects(keys2, options3, callback, dontModify);
+        return this._getObjects(keys2, userContext2, callback, dontModify);
       });
     }
   }
-  getObjectsAsync(keys2, options2) {
-    return this.getObjects(keys2, options2);
+  /**
+   * Promise-version of getObjects
+   *
+   * @param keys The ids of the objects to read
+   * @param options The current request options including the user
+   */
+  getObjectsAsync(keys2, options) {
+    return this.getObjects(keys2, options);
   }
-  async _getObjectsByPattern(pattern, options2, callback) {
+  async _getObjectsByPattern(pattern, userContext2, callback) {
     if (!pattern || typeof pattern !== "string") {
       return import_db_base.tools.maybeCallbackWithError(callback, `invalid pattern ${JSON.stringify(pattern)}`);
     }
@@ -2404,32 +2724,43 @@ class ObjectsInRedisClient {
     if (this.settings.connection.enhancedLogging) {
       this.log.silly(`${this.namespace} redis keys ${keys2.length} ${pattern}`);
     }
-    this._getObjects(keys2, options2, callback, true);
+    this._getObjects(keys2, userContext2, callback, true).catch((e) => this.log.error(`${this.namespace} Cannot get objects: ${e.message}`));
   }
-  getObjectsByPattern(pattern, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
+  /**
+   * Get all objects whose id matches the given pattern
+   *
+   * @param pattern The pattern to match object ids against
+   * @param options The current request options including the user, or the callback
+   * @param callback Called with the matching objects
+   */
+  getObjectsByPattern(pattern, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
     if (!callback) {
-      return new Promise((resolve, reject) => this.getObjectsByPattern(pattern, options2, (err, obj) => err ? reject(err) : resolve(obj)));
-    }
-    if (options2?.acl) {
-      options2.acl = null;
+      return new Promise((resolve, reject) => this.getObjectsByPattern(pattern, options, (err, obj) => err ? reject(err) : resolve(obj)));
     }
     if (typeof callback === "function") {
-      utils.checkObjectRights(this, null, null, options2, CONSTS.ACCESS_READ, (err, options3) => {
+      utils.checkObjectRights(this, null, null, options, CONSTS.ACCESS_READ, (err, userContext2) => {
         if (err) {
           return import_db_base.tools.maybeCallbackWithRedisError(callback, err);
         }
-        return this._getObjectsByPattern(pattern, options3, callback);
+        return this._getObjectsByPattern(pattern, userContext2, callback);
       });
     }
   }
-  getObjectsByPatternAsync(pattern, options2) {
-    return new Promise((resolve, reject) => this.getObjectsByPattern(pattern, options2, (err, objs2) => err ? reject(err) : resolve(objs2)));
+  /**
+   * Promise-version of getObjectsByPattern
+   *
+   * @param pattern The pattern to match object ids against
+   * @param options The current request options including the user
+   * @param options.user The user on whose behalf the objects are read
+   */
+  getObjectsByPatternAsync(pattern, options) {
+    return new Promise((resolve, reject) => this.getObjectsByPattern(pattern, options, (err, objs2) => err ? reject(err) : resolve(objs2)));
   }
-  async _setObject(id, obj, options2) {
+  async _setObject(id, obj, userContext2) {
     if (!id || typeof id !== "string" || utils.REG_CHECK_ID.test(id)) {
       throw new Error(`Invalid ID: ${id}`);
     }
@@ -2438,7 +2769,7 @@ class ObjectsInRedisClient {
       throw new Error("obj is null");
     }
     if (!import_db_base.tools.isObject(obj)) {
-      this.log.warn(`${this.namespace} setObject: Argument object is no object: ${obj}`);
+      this.log.warn(`${this.namespace} setObject: Argument object is no object: ${JSON.stringify(obj)}`);
       throw new Error("obj is no object");
     }
     if (!this.client) {
@@ -2530,15 +2861,15 @@ class ObjectsInRedisClient {
       if (obj.type !== "state") {
         delete obj.acl.state;
       }
-      if (options2.user && options2.user !== CONSTS.SYSTEM_ADMIN_USER) {
-        obj.acl.owner = options2.user;
+      if (userContext2.user && userContext2.user !== CONSTS.SYSTEM_ADMIN_USER) {
+        obj.acl.owner = userContext2.user;
       }
-      if (options2.group && options2.group !== CONSTS.SYSTEM_ADMIN_GROUP) {
-        obj.acl.ownerGroup = options2.group;
+      if (userContext2.group && userContext2.group !== CONSTS.SYSTEM_ADMIN_GROUP) {
+        obj.acl.ownerGroup = userContext2.group;
       }
     }
-    if (this.defaultNewAcl && obj.acl && !obj.acl.ownerGroup && options2.group) {
-      obj.acl.ownerGroup = options2.group;
+    if (this.defaultNewAcl && obj.acl && !obj.acl.ownerGroup && userContext2.group) {
+      obj.acl.ownerGroup = userContext2.group;
     }
     const message = JSON.stringify(obj);
     const commands = [];
@@ -2569,32 +2900,29 @@ class ObjectsInRedisClient {
     return { id };
   }
   /**
-   * set anew or update object
+   * set anew or update an object
    *
    * This function writes the object into DB
    *
    * @param id ID of the object
-   * @param obj
+   * @param obj The object to write
    * @param options options for access control are optional
    * @param callback return function
    */
-  setObject(id, obj, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = {};
+  setObject(id, obj, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = {};
     }
     if (!callback) {
-      return new Promise((resolve, reject) => this.setObject(id, obj, options2, (err, res) => err ? reject(err) : resolve(res)));
-    }
-    if (options2?.acl) {
-      options2.acl = null;
+      return new Promise((resolve, reject) => this.setObject(id, obj, options, (err, res) => err ? reject(err) : resolve(res)));
     }
-    utils.checkObjectRights(this, null, null, options2, CONSTS.ACCESS_WRITE, async (err) => {
+    utils.checkObjectRights(this, null, null, options, CONSTS.ACCESS_WRITE, async (err, userContext2) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithRedisError(callback, err);
       }
       try {
-        const res = await this._setObject(id, obj, options2 || {});
+        const res = await this._setObject(id, obj, userContext2);
         return import_db_base.tools.maybeCallbackWithError(callback, null, res);
       } catch (e) {
         return import_db_base.tools.maybeCallbackWithError(callback, e);
@@ -2602,19 +2930,20 @@ class ObjectsInRedisClient {
     });
   }
   /**
+   * Promise-version of setObject
    *
-   * @param id
-   * @param obj
-   * @param options
+   * @param id ID of the object
+   * @param obj The object to write
+   * @param options options for access control are optional
    * @deprecated use `setObject` without callback instead
    */
-  setObjectAsync(id, obj, options2) {
+  setObjectAsync(id, obj, options) {
     return new Promise((resolve, reject) => (
       // @ts-expect-error TODO we are returning type Object for ease of use to devs, but formally these are AnyObjects, e.g. not guaranteed to have common
-      this.setObject(id, obj, options2, (err, res) => err ? reject(err) : resolve(res))
+      this.setObject(id, obj, options, (err, res) => err ? reject(err) : resolve(res))
     ));
   }
-  async _delObject(id, options2) {
+  async _delObject(id, userContext2) {
     if (!id || typeof id !== "string" || utils.REG_CHECK_ID.test(id)) {
       throw new Error(`Invalid ID: ${id}`);
     }
@@ -2638,7 +2967,7 @@ class ObjectsInRedisClient {
       this.log.warn(`${this.namespace} Cannot parse ${id} - ${oldObjStr}: ${e.message}`);
       oldObj = null;
     }
-    if (!utils.checkObject(oldObj, options2, CONSTS.ACCESS_WRITE)) {
+    if (!utils.checkObject(oldObj, userContext2, CONSTS.ACCESS_WRITE)) {
       throw new Error(ERRORS.ERROR_PERMISSION);
     } else {
       const commands = [];
@@ -2662,34 +2991,45 @@ class ObjectsInRedisClient {
       await this.client.publish(this.objNamespace + id, "null");
     }
   }
-  delObject(id, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
+  /**
+   * Delete an object
+   *
+   * @param id The id of the object to delete
+   * @param options The current request options including the user, or the callback
+   * @param callback Called once the object has been deleted
+   */
+  delObject(id, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
     if (!callback) {
-      return new Promise((resolve, reject) => this.delObject(id, options2, (err) => err ? reject(err) : resolve()));
+      return new Promise((resolve, reject) => this.delObject(id, options, (err) => err ? reject(err) : resolve()));
     }
-    if (options2?.acl) {
-      options2.acl = null;
-    }
-    utils.checkObjectRights(this, null, null, options2, CONSTS.ACCESS_DELETE, async (err, options3) => {
+    utils.checkObjectRights(this, null, null, options, CONSTS.ACCESS_DELETE, async (err, userContext2) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithError(callback, err);
       }
       try {
-        await this._delObject(id, options3);
+        await this._delObject(id, userContext2);
         return import_db_base.tools.maybeCallback(callback);
       } catch (e) {
         return import_db_base.tools.maybeCallbackWithRedisError(callback, e);
       }
     });
   }
-  delObjectAsync(id, options2) {
-    return this.delObject(id, options2);
+  /**
+   * Promise-version of delObject
+   *
+   * @param id The id of the object to delete
+   * @param options The current request options including the user
+   * @param options.user The user on whose behalf the operation is performed
+   */
+  delObjectAsync(id, options) {
+    return this.delObject(id, options);
   }
   /**
-   * Function to checks if comparisons will work according to the configured Locale
+   * Function to check if comparisons will work according to the configured Locale
    */
   async isSystemLocaleSupported() {
     if (!this.client) {
@@ -2704,14 +3044,12 @@ class ObjectsInRedisClient {
     }
   }
   // this function is very ineffective. Because reads all objects and then process them
-  async _applyViewFunc(func, params, options = {}) {
+  async _applyViewFunc(func, params, userContext) {
     if (!this.client) {
       throw new Error(ERRORS.ERROR_DB_CLOSED);
     }
-    const result = {
-      rows: []
-    };
-    const filterEntries = (arr, duplicateFiltering) => {
+    let rows = [];
+    const filterEntries = /* @__PURE__ */ __name((arr, duplicateFiltering) => {
       if (duplicateFiltering) {
         const included = /* @__PURE__ */ new Map();
         return arr.filter((obj) => {
@@ -2725,10 +3063,10 @@ class ObjectsInRedisClient {
       return arr.filter((obj) => {
         return obj.value !== null;
       });
-    };
-    params = params || {};
-    params.startkey = params.startkey || "";
-    params.endkey = params.endkey || "\u9999";
+    }, "filterEntries");
+    params ||= {};
+    params.startkey ||= "";
+    params.endkey ||= "\u9999";
     const wildcardPos = params.endkey.indexOf("\u9999");
     let wildCardLastPos = true;
     if (wildcardPos !== -1 && wildcardPos !== params.endkey.length - 1) {
@@ -2747,16 +3085,7 @@ class ObjectsInRedisClient {
         }
         let objs2;
         try {
-          objs2 = await this.client.evalsha([
-            this.scripts.filter,
-            6,
-            this.objNamespace,
-            params.startkey,
-            params.endkey,
-            matches[1],
-            cursor,
-            `${this.setNamespace}object.type.${matches[1]}`
-          ]);
+          objs2 = await this.client.evalsha(this.scripts.filter, 6, this.objNamespace, params.startkey, params.endkey, matches[1], cursor, `${this.setNamespace}object.type.${matches[1]}`);
         } catch (e) {
           this.log.warn(`${this.namespace} Cannot get view: ${e.message}`);
           throw e;
@@ -2783,7 +3112,8 @@ class ObjectsInRedisClient {
           }
           if (matches[2] && matches[2].trim() === "doc._id") {
             return { id: obj._id, value: obj };
-          } else if (matches[2] && matches[2].trim() === "doc.common.name" && obj.common) {
+          }
+          if (matches[2] && matches[2].trim() === "doc.common.name" && obj.common) {
             if (typeof obj.common.name === "object") {
               if (obj.common.name.en) {
                 return { id: obj.common.name.en, value: obj };
@@ -2796,25 +3126,26 @@ class ObjectsInRedisClient {
           return { id: "parseError", value: null };
         });
         if (currRows.length) {
-          result.rows = [...result.rows, ...currRows];
+          rows = [...rows, ...currRows];
         }
       } while (cursor !== "0");
       if (func.reduce === "_stats") {
         let max = null;
-        for (let i = 0; i < result.rows.length; i++) {
-          if (max === null || result.rows[i].value > max) {
-            max = result.rows[i].value;
+        for (let i = 0; i < rows.length; i++) {
+          const _value = rows[i].value;
+          if (max === null || _value !== null && _value > max) {
+            max = _value;
           }
         }
         if (max !== null) {
-          result.rows = [{ id: "_stats", value: { max } }];
+          rows = [{ id: "_stats", value: { max } }];
         } else {
-          result.rows = [];
+          rows = [];
         }
       }
-      result.rows = filterEntries(result.rows, filterRequired);
-      return result;
-    } else if (
+      return { rows: filterEntries(rows, filterRequired) };
+    }
+    if (
       // filter by script
       wildCardLastPos && func?.map && this.scripts.script && func.map.includes("doc.common.engineType")
     ) {
@@ -2826,15 +3157,7 @@ class ObjectsInRedisClient {
         }
         let res;
         try {
-          res = await this.client.evalsha([
-            this.scripts.script,
-            5,
-            this.objNamespace,
-            params.startkey,
-            params.endkey,
-            cursor,
-            `${this.setNamespace}object.type.script`
-          ]);
+          res = await this.client.evalsha(this.scripts.script, 5, this.objNamespace, params.startkey, params.endkey, cursor, `${this.setNamespace}object.type.script`);
         } catch (e) {
           this.log.warn(`${this.namespace} Cannot get "scripts" view: ${e.message}`);
           throw e;
@@ -2858,12 +3181,12 @@ class ObjectsInRedisClient {
           }
         });
         if (currRows.length) {
-          result.rows = [...result.rows, ...currRows];
+          rows = [...rows, ...currRows];
         }
       } while (cursor !== "0");
-      result.rows = filterEntries(result.rows, filterRequired);
-      return result;
-    } else if (
+      return { rows: filterEntries(rows, filterRequired) };
+    }
+    if (
       // filter by hm-rega programs
       wildCardLastPos && func?.map && this.scripts.programs && func.map.includes("doc.native.TypeName === 'PROGRAM'")
     ) {
@@ -2875,15 +3198,7 @@ class ObjectsInRedisClient {
         }
         let objs2;
         try {
-          objs2 = await this.client.evalsha([
-            this.scripts.programs,
-            5,
-            `${this.objNamespace}hm-rega.`,
-            params.startkey,
-            params.endkey,
-            cursor,
-            `${this.setNamespace}object.type.channel`
-          ]);
+          objs2 = await this.client.evalsha(this.scripts.programs, 5, `${this.objNamespace}hm-rega.`, params.startkey, params.endkey, cursor, `${this.setNamespace}object.type.channel`);
         } catch (e) {
           this.log.warn(`${this.namespace} Cannot get view: ${e.message}`);
           throw e;
@@ -2905,12 +3220,12 @@ class ObjectsInRedisClient {
           }
         });
         if (currRows.length) {
-          result.rows = [...result.rows, ...currRows];
+          rows = [...rows, ...currRows];
         }
       } while (cursor !== "0");
-      result.rows = filterEntries(result.rows, filterRequired);
-      return result;
-    } else if (
+      return { rows: filterEntries(rows, filterRequired) };
+    }
+    if (
       // filter by hm-rega variables
       wildCardLastPos && func?.map && this.scripts.variables && func.map.includes("doc.native.TypeName === 'ALARMDP'")
     ) {
@@ -2922,15 +3237,7 @@ class ObjectsInRedisClient {
         }
         let objs2;
         try {
-          objs2 = await this.client.evalsha([
-            this.scripts.variables,
-            5,
-            `${this.objNamespace}hm-rega.`,
-            params.startkey,
-            params.endkey,
-            cursor,
-            `${this.setNamespace}object.type.state`
-          ]);
+          objs2 = await this.client.evalsha(this.scripts.variables, 5, `${this.objNamespace}hm-rega.`, params.startkey, params.endkey, cursor, `${this.setNamespace}object.type.state`);
         } catch (e) {
           this.log.warn(`${this.namespace} Cannot get view ${e.message}`);
           throw e;
@@ -2952,12 +3259,12 @@ class ObjectsInRedisClient {
           }
         });
         if (currRows.length) {
-          result.rows = [...result.rows, ...currRows];
+          rows = [...rows, ...currRows];
         }
       } while (cursor !== "0");
-      result.rows = filterEntries(result.rows, filterRequired);
-      return result;
-    } else if (
+      return { rows: filterEntries(rows, filterRequired) };
+    }
+    if (
       // filter by custom, redis also returns if common.custom is not present
       wildCardLastPos && func?.map && this.scripts.custom && func.map.includes("doc.common.custom")
     ) {
@@ -2969,15 +3276,7 @@ class ObjectsInRedisClient {
         }
         let objs2;
         try {
-          objs2 = await this.client.evalsha([
-            this.scripts.custom,
-            5,
-            this.objNamespace,
-            params.startkey,
-            params.endkey,
-            cursor,
-            `${this.setNamespace}object.common.custom`
-          ]);
+          objs2 = await this.client.evalsha(this.scripts.custom, 5, this.objNamespace, params.startkey, params.endkey, cursor, `${this.setNamespace}object.common.custom`);
         } catch (e) {
           this.log.warn(`${this.namespace} Cannot get view: ${e.message}`);
           throw e;
@@ -3000,15 +3299,14 @@ class ObjectsInRedisClient {
           }
           if (obj?.common?.custom) {
             if (useFullObject) {
-              result.rows.push({ id: obj._id, value: obj });
+              rows.push({ id: obj._id, value: obj });
             } else {
-              result.rows.push({ id: obj._id, value: obj.common.custom });
+              rows.push({ id: obj._id, value: obj.common.custom });
             }
           }
         }
       } while (cursor !== "0");
-      result.rows = filterEntries(result.rows, filterRequired);
-      return result;
+      return { rows: filterEntries(rows, filterRequired) };
     }
     if (!wildCardLastPos) {
       this.log.debug(`${this.namespace} Search can't be optimized because wildcard not at the end, fallback to keys!: ${func.map}`);
@@ -3051,9 +3349,9 @@ class ObjectsInRedisClient {
     } catch {
       objs = [];
     }
-    const _emit_ = (id, obj) => {
-      result.rows.push({ id, value: obj });
-    };
+    const _emit_ = /* @__PURE__ */ __name((id, obj) => {
+      rows.push({ id, value: obj });
+    }, "_emit_");
     const f = eval(`(${func.map.replace(/^function\(([a-z0-9A-Z_]+)\)/g, "function($1, emit)")})`);
     for (let i = 0; i < keys.length; i++) {
       const strObj = objs[i];
@@ -3064,7 +3362,7 @@ class ObjectsInRedisClient {
         this.log.error(`${this.namespace} Cannot parse JSON ${keys[i]}: ${objs[i]}`);
         continue;
       }
-      if (!utils.checkObject(obj, options, CONSTS.ACCESS_READ)) {
+      if (!utils.checkObject(obj, userContext, CONSTS.ACCESS_READ)) {
         continue;
       }
       if (obj) {
@@ -3077,20 +3375,21 @@ class ObjectsInRedisClient {
     }
     if (func.reduce === "_stats") {
       let max = null;
-      for (let i = 0; i < result.rows.length; i++) {
-        if (max === null || result.rows[i].value > max) {
-          max = result.rows[i].value;
+      for (let i = 0; i < rows.length; i++) {
+        const _value = rows[i].value;
+        if (max === null || _value !== null && _value > max) {
+          max = rows[i].value;
         }
       }
       if (max !== null) {
-        result.rows = [{ id: "_stats", value: { max } }];
+        rows = [{ id: "_stats", value: { max } }];
       } else {
-        result.rows = [];
+        rows = [];
       }
     }
-    return result;
+    return { rows };
   }
-  async _getObjectView(design, search, params2, options2) {
+  async _getObjectView(design, search, params2, userContext2) {
     if (!this.client) {
       throw new Error(ERRORS.ERROR_DB_CLOSED);
     }
@@ -3109,7 +3408,7 @@ class ObjectsInRedisClient {
         throw new Error(`Cannot parse JSON: "_design/${design}" / "${obj}"`);
       }
       if (obj.views?.[search]) {
-        return this._applyViewFunc(obj.views[search], params2, options2);
+        return this._applyViewFunc(obj.views[search], params2, userContext2);
       }
       this.log.error(`${this.namespace} Cannot find search "${search}" in "${design}"`);
       throw new Error(`Cannot find search "${search}" in "${design}"`);
@@ -3118,24 +3417,30 @@ class ObjectsInRedisClient {
       throw new Error(`Cannot find view "${design}"`);
     }
   }
-  getObjectView(design, search, params2, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
+  /**
+   * Run a predefined object view (design document) and return the matching rows
+   *
+   * @param design The design document name
+   * @param search The view name within the design document
+   * @param params Query parameters such as startkey and endkey
+   * @param options The current request options including the user, or the callback
+   * @param callback Called with the matching rows
+   */
+  getObjectView(design, search, params2, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
     if (!callback) {
-      return new Promise((resolve, reject) => this.getObjectView(design, search, params2, options2, (err, obj) => err ? reject(err) : resolve(obj)));
-    }
-    if (options2?.acl) {
-      options2.acl = null;
+      return new Promise((resolve, reject) => this.getObjectView(design, search, params2, options, (err, obj) => err ? reject(err) : resolve(obj)));
     }
     if (typeof callback === "function") {
-      utils.checkObjectRights(this, null, null, options2, "list", async (err, options3) => {
+      utils.checkObjectRights(this, null, null, options, "list", async (err, userContext2) => {
         if (err) {
           return import_db_base.tools.maybeCallbackWithRedisError(callback, err);
         }
         try {
-          const res = await this._getObjectView(design, search, params2, options3);
+          const res = await this._getObjectView(design, search, params2, userContext2);
           return import_db_base.tools.maybeCallbackWithError(callback, null, res);
         } catch (e) {
           return import_db_base.tools.maybeCallbackWithRedisError(callback, e);
@@ -3143,16 +3448,25 @@ class ObjectsInRedisClient {
       });
     }
   }
-  getObjectViewAsync(design, search, params2, options2) {
-    return this.getObjectView(design, search, params2, options2);
+  /**
+   * Promise-version of getObjectView
+   *
+   * @param design The design document name
+   * @param search The view name within the design document
+   * @param params Query parameters such as startkey and endkey
+   * @param options The current request options including the user
+   * @param options.user The user on whose behalf the view is queried
+   */
+  getObjectViewAsync(design, search, params2, options) {
+    return this.getObjectView(design, search, params2, options);
   }
-  async _getObjectList(params2, options2) {
+  async _getObjectList(params2, userContext2) {
     if (!this.client) {
       throw new Error(ERRORS.ERROR_DB_CLOSED);
     }
-    params2 = params2 || {};
-    params2.startkey = params2.startkey || "";
-    params2.endkey = params2.endkey || "\u9999";
+    params2 ||= {};
+    params2.startkey ||= "";
+    params2.endkey ||= "\u9999";
     const pattern = params2.endkey.substring(0, params2.startkey.length) === params2.startkey ? `${this.objNamespace + params2.startkey}*` : `${this.objNamespace}*`;
     const keys2 = await this._getKeysViaScan(pattern);
     if (!this.client) {
@@ -3181,7 +3495,7 @@ class ObjectsInRedisClient {
       objs2 = await this.client.mget(_keys);
     } catch {
     }
-    const result2 = {
+    const result = {
       rows: []
     };
     if (objs2) {
@@ -3194,32 +3508,36 @@ class ObjectsInRedisClient {
           this.log.error(`${this.namespace} Cannot parse JSON ${_keys[i]}: ${objs2[i]}`);
           continue;
         }
-        if (!obj || !utils.checkObject(obj, options2, CONSTS.ACCESS_READ)) {
+        if (!obj || !utils.checkObject(obj, userContext2, CONSTS.ACCESS_READ)) {
           continue;
         }
-        result2.rows.push({ id: obj._id, value: obj, doc: obj });
+        result.rows.push({ id: obj._id, value: obj, doc: obj });
       }
     }
-    return result2;
+    return result;
   }
-  getObjectList(params2, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
+  /**
+   * Get the list of objects matching the given parameters
+   *
+   * @param params Query parameters such as startkey and endkey
+   * @param options The current request options including the user, or the callback
+   * @param callback Called with the matching objects
+   */
+  getObjectList(params2, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
     if (!callback) {
-      return new Promise((resolve, reject) => this.getObjectList(params2, options2, (err, obj) => err ? reject(err) : resolve(obj)));
-    }
-    if (options2?.acl) {
-      options2.acl = null;
+      return new Promise((resolve, reject) => this.getObjectList(params2, options, (err, obj) => err ? reject(err) : resolve(obj)));
     }
     if (typeof callback === "function") {
-      utils.checkObjectRights(this, null, null, options2, "list", async (err, options3) => {
+      utils.checkObjectRights(this, null, null, options, "list", async (err, userContext2) => {
         if (err) {
           return import_db_base.tools.maybeCallbackWithRedisError(callback, err);
         }
         try {
-          const res = await this._getObjectList(params2, options3 || {});
+          const res = await this._getObjectList(params2, userContext2);
           return import_db_base.tools.maybeCallbackWithError(callback, null, res);
         } catch (e) {
           return import_db_base.tools.maybeCallbackWithError(callback, e);
@@ -3227,156 +3545,147 @@ class ObjectsInRedisClient {
       });
     }
   }
-  getObjectListAsync(params2, options2) {
-    return this.getObjectList(params2, options2);
+  /**
+   * Promise-version of getObjectList
+   *
+   * @param params Query parameters such as startkey and endkey
+   * @param options The current request options including the user
+   */
+  getObjectListAsync(params2, options) {
+    return this.getObjectList(params2, options);
   }
-  // could be optimized, to read object only once. Now it will read 3 times
-  async _extendObject(id, obj, options2, callback) {
+  // could be optimized, to read an object only once. Now it will read 3 times
+  async _extendObject(id, obj, options, userContext2) {
     if (!id || typeof id !== "string" || utils.REG_CHECK_ID.test(id)) {
-      return import_db_base.tools.maybeCallbackWithError(callback, `Invalid ID: ${id}`);
+      throw new Error(`Invalid ID: ${id}`);
     }
     if (!this.client) {
-      return import_db_base.tools.maybeCallbackWithRedisError(callback, ERRORS.ERROR_DB_CLOSED);
+      throw new Error(ERRORS.ERROR_DB_CLOSED);
     }
+    const oldObjStr = await this.client.get(this.objNamespace + id);
     let oldObj;
     try {
-      oldObj = await this.client.get(this.objNamespace + id);
-    } catch (e) {
-      return import_db_base.tools.maybeCallbackWithRedisError(callback, e);
-    }
-    try {
-      oldObj = oldObj ? JSON.parse(oldObj) : null;
+      oldObj = oldObjStr ? JSON.parse(oldObjStr) : null;
     } catch {
-      this.log.error(`${this.namespace} Cannot parse JSON ${id}: ${oldObj}`);
-      return import_db_base.tools.maybeCallbackWithError(callback, `Cannot parse JSON ${id}: ${oldObj}`);
+      this.log.error(`${this.namespace} Cannot parse JSON ${id}: ${oldObjStr}`);
+      throw new Error(`Cannot parse JSON ${id}: ${oldObjStr}`);
     }
-    if (!utils.checkObject(oldObj, options2, CONSTS.ACCESS_WRITE)) {
-      return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION);
+    if (!utils.checkObject(oldObj, userContext2, CONSTS.ACCESS_WRITE)) {
+      throw new Error(ERRORS.ERROR_PERMISSION);
     }
     let _oldObj;
     if (oldObj?.nonEdit) {
       _oldObj = (0, import_deep_clone.default)(oldObj);
     }
     const oldObjHasCustom = !!oldObj?.common?.custom;
-    oldObj = oldObj || {};
-    obj = (0, import_deep_clone.default)(obj);
-    if (oldObj.common && oldObj.common.custom !== void 0 && oldObj.common.custom !== null && !import_db_base.tools.isObject(oldObj.common.custom)) {
-      delete oldObj.common.custom;
-    }
-    const oldType = oldObj.type;
-    oldObj = (0, import_node.default)(true, oldObj, obj);
-    oldObj._id = id;
-    if (this.defaultNewAcl && !oldObj.acl) {
-      oldObj.acl = (0, import_deep_clone.default)(this.defaultNewAcl);
-      delete oldObj.acl.file;
-      if (oldObj.type !== "state") {
-        delete oldObj.acl.state;
-      }
-      if (options2.owner) {
-        oldObj.acl.owner = options2.owner;
-        if (!options2.ownerGroup) {
-          oldObj.acl.ownerGroup = null;
-          return void this.getUserGroup(options2.owner, (user, groups) => {
-            if (!groups || !groups[0]) {
-              options2.ownerGroup = this.defaultNewAcl?.ownerGroup || CONSTS.SYSTEM_ADMIN_GROUP;
-            } else {
-              options2.ownerGroup = groups[0];
-            }
-            this._extendObject(id, obj, options2, callback);
-          });
+    const objClone = (0, import_deep_clone.default)(obj);
+    let oldObjNotNull = oldObj || {};
+    if (oldObjNotNull.common?.custom !== void 0 && oldObjNotNull.common.custom !== null && !import_db_base.tools.isObject(oldObjNotNull.common.custom)) {
+      delete oldObjNotNull.common.custom;
+    }
+    const oldType = oldObjNotNull.type;
+    oldObjNotNull = (0, import_node.default)(true, oldObjNotNull, objClone);
+    oldObjNotNull._id = id;
+    if (this.defaultNewAcl && !oldObjNotNull.acl) {
+      oldObjNotNull.acl = {
+        owner: this.defaultNewAcl.owner,
+        ownerGroup: this.defaultNewAcl.ownerGroup,
+        object: this.defaultNewAcl.object
+      };
+      if (oldObjNotNull.type === "state") {
+        oldObjNotNull.acl.state = this.defaultNewAcl.state;
+      }
+      if (options.owner) {
+        oldObjNotNull.acl.owner = options.owner;
+        if (!options.ownerGroup) {
+          const [, groups] = await utils.getUserGroupAsync(this, options.owner);
+          if (!groups?.[0]) {
+            options.ownerGroup = this.defaultNewAcl.ownerGroup || CONSTS.SYSTEM_ADMIN_GROUP;
+          } else {
+            options.ownerGroup = groups[0];
+          }
         }
       }
     }
-    if (this.defaultNewAcl && options2.ownerGroup && oldObj.acl && !oldObj.acl.ownerGroup) {
-      oldObj.acl.ownerGroup = options2.ownerGroup;
+    if (this.defaultNewAcl && options.ownerGroup && oldObjNotNull.acl && !oldObjNotNull.acl.ownerGroup) {
+      oldObjNotNull.acl.ownerGroup = options.ownerGroup;
     }
     if (obj.common && "alias" in obj.common && obj.common.alias.id) {
       if (typeof obj.common.alias.id === "object") {
         if (typeof obj.common.alias.id.write !== "string" || typeof obj.common.alias.id.read !== "string") {
-          return import_db_base.tools.maybeCallbackWithError(callback, "Invalid alias ID");
+          throw new Error("Invalid alias ID");
         }
         if (obj.common.alias.id.write.startsWith("alias.") || obj.common.alias.id.read.startsWith("alias.")) {
-          return import_db_base.tools.maybeCallbackWithError(callback, "Cannot make alias on alias");
+          throw new Error("Cannot make alias on alias");
         }
       } else {
         if (typeof obj.common.alias.id !== "string") {
-          return import_db_base.tools.maybeCallbackWithError(callback, "Invalid alias ID");
+          throw new Error("Invalid alias ID");
         }
         if (obj.common.alias.id.startsWith("alias.")) {
-          return import_db_base.tools.maybeCallbackWithError(callback, "Cannot make alias on alias");
+          throw new Error("Cannot make alias on alias");
         }
       }
     }
-    if (_oldObj && !import_db_base.tools.checkNonEditable(_oldObj, oldObj)) {
-      return import_db_base.tools.maybeCallbackWithError(callback, "Invalid password for update of vendor information");
+    if (_oldObj && !import_db_base.tools.checkNonEditable(_oldObj, oldObjNotNull)) {
+      throw new Error("Invalid password for update of vendor information");
     }
-    const message = JSON.stringify(oldObj);
-    try {
-      const commands = [];
-      if (this.useSets) {
-        if (oldObj.type && !oldType) {
-          commands.push(["sadd", `${this.setNamespace}object.type.${obj.type}`, this.objNamespace + id]);
-        } else if (oldObj.type && oldType && oldObj.type !== oldType) {
-          commands.push(["sadd", `${this.setNamespace}object.type.${obj.type}`, this.objNamespace + id], ["srem", `${this.setNamespace}object.type.${oldObj.type}`, this.objNamespace + id]);
-        } else if (oldType && !oldObj.type) {
-          commands.push(["srem", `${this.setNamespace}object.type.${obj.type}`, this.objNamespace + id]);
-        }
-      }
-      if (oldObj.common?.custom && !oldObjHasCustom) {
-        commands.push(["sadd", `${this.setNamespace}object.common.custom`, this.objNamespace + id]);
-      } else if (oldObjHasCustom && (!oldObj.common || !oldObj.common.custom)) {
-        commands.push(["srem", `${this.setNamespace}object.common.custom`, this.objNamespace + id]);
-      }
-      if (!commands.length) {
-        await this.client.set(this.objNamespace + id, message);
-      } else {
-        commands.push(["set", this.objNamespace + id, message]);
-        await this.client.multi(commands).exec();
-      }
-      if (this.existingMetaObjects[id] === false && oldObj && oldObj.type === "meta") {
-        this.existingMetaObjects[id] = true;
+    const message = JSON.stringify(oldObjNotNull);
+    const commands = [];
+    if (this.useSets) {
+      if (oldObjNotNull.type && !oldType) {
+        commands.push(["sadd", `${this.setNamespace}object.type.${obj.type}`, this.objNamespace + id]);
+      } else if (oldObjNotNull.type && oldType && oldObjNotNull.type !== oldType) {
+        commands.push(["sadd", `${this.setNamespace}object.type.${obj.type}`, this.objNamespace + id], ["srem", `${this.setNamespace}object.type.${oldObjNotNull.type}`, this.objNamespace + id]);
+      } else if (oldType && !oldObjNotNull.type) {
+        commands.push(["srem", `${this.setNamespace}object.type.${obj.type}`, this.objNamespace + id]);
       }
-      await this.client.publish(this.objNamespace + id, message);
-      return import_db_base.tools.maybeCallbackWithError(callback, null, { id, value: oldObj }, id);
-    } catch (e) {
-      return import_db_base.tools.maybeCallbackWithRedisError(callback, e);
     }
-  }
-  extendObject(id, obj, options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
+    if (oldObjNotNull.common?.custom && !oldObjHasCustom) {
+      commands.push(["sadd", `${this.setNamespace}object.common.custom`, this.objNamespace + id]);
+    } else if (oldObjHasCustom && (!oldObjNotNull.common || !oldObjNotNull.common.custom)) {
+      commands.push(["srem", `${this.setNamespace}object.common.custom`, this.objNamespace + id]);
     }
-    if (!callback) {
-      return new Promise((resolve, reject) => this.extendObject(id, obj, options2, (err, res) => err ? reject(err) : resolve(res)));
+    if (!commands.length) {
+      await this.client.set(this.objNamespace + id, message);
+    } else {
+      commands.push(["set", this.objNamespace + id, message]);
+      await this.client.multi(commands).exec();
     }
-    if (options2?.acl) {
-      options2.acl = null;
+    if (this.existingMetaObjects[id] === false && oldObjNotNull?.type === "meta") {
+      this.existingMetaObjects[id] = true;
     }
-    utils.checkObjectRights(this, null, null, options2, CONSTS.ACCESS_WRITE, (err, options3) => {
-      if (err) {
-        return import_db_base.tools.maybeCallbackWithRedisError(callback, err);
-      }
-      return this._extendObject(id, obj, options3, callback);
-    });
+    await this.client.publish(this.objNamespace + id, message);
+    return { id, value: oldObjNotNull };
   }
-  extendObjectAsync(id, obj, options2) {
-    return new Promise((resolve, reject) => this.extendObject(id, obj, options2 || null, (err, res) => err ? reject(err) : resolve(res)));
+  /**
+   * Extend an existing object with the given partial object, creating it if it does not exist
+   *
+   * @param id The id of the object to extend
+   * @param obj The partial object to merge into the existing object
+   * @param options The current request options including the user, or the callback
+   */
+  async extendObject(id, obj, options) {
+    const userContext2 = await (0, import_objectsUtils.checkObjectRightsAsync)(this, null, null, options, CONSTS.ACCESS_WRITE);
+    return this._extendObject(id, obj, options || {}, userContext2);
   }
   /**
    * Returns the object id if found
    *
-   * @param idOrName
-   * @param type
-   * @param options
-   * @param callback
+   * @param idOrName The id or name to search for
+   * @param type The expected common type, or null for any
+   * @param options The current request options (may include a language)
+   * @param options.language The language to use when resolving names
+   * @param options.user The user on whose behalf the lookup is performed
+   * @param userContext The resolved user context to check the rights against
+   * @param callback Called with the found id and the original id/name
    */
-  _findObject(idOrName, type, options2, callback) {
-    this._getObject(idOrName, options2, (err, obj) => {
-      if (obj && utils.checkObject(obj, options2, CONSTS.ACCESS_READ) && (!type || obj.common?.type === type)) {
+  _findObject(idOrName, type, options, userContext2, callback) {
+    this._getObject(idOrName, userContext2, (err, obj) => {
+      if (obj && utils.checkObject(obj, userContext2, CONSTS.ACCESS_READ) && (!type || obj.common?.type === type)) {
         return import_db_base.tools.maybeCallbackWithError(callback, null, idOrName, obj.common.name);
       }
-      this._getKeys("*", options2, async (err2, keys2) => {
+      return this._getKeys("*", userContext2, true, async (err2, keys2) => {
         if (!this.client) {
           return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_DB_CLOSED);
         }
@@ -3402,7 +3711,7 @@ class ObjectsInRedisClient {
           if (obj2?.common && (!type || "type" in obj2.common && obj2.common.type === type)) {
             let name = obj2?.common?.name;
             if (name && typeof name === "object") {
-              name = name[options2.language || "en"] || name.en;
+              name = name[options.language || "en"] || name.en;
             }
             if (name === idOrName) {
               return import_db_base.tools.maybeCallbackWithError(callback, null, obj2._id, obj2.common.name);
@@ -3410,35 +3719,45 @@ class ObjectsInRedisClient {
           }
         }
         return import_db_base.tools.maybeCallbackWithError(callback, null, void 0, idOrName);
-      }, true);
-    });
+      });
+    }).catch((e) => this.log.error(`${this.namespace} Cannot find object: ${e.message}`));
   }
-  findObject(idOrName, type, options2, callback) {
+  /**
+   * Find an object by its id or name
+   *
+   * @param idOrName The id or name to search for
+   * @param type The expected common type, or null for any
+   * @param options The current request options (may include a language), or the callback
+   * @param callback Called with the found id and the original id/name
+   */
+  findObject(idOrName, type, options, callback) {
     if (typeof type === "function") {
       callback = type;
-      options2 = null;
+      options = null;
       type = null;
     }
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
     if (!callback) {
-      return new Promise((resolve, reject) => this.findObject(idOrName, type, options2, (err, id, _idOrName) => err ? reject(err) : resolve(id)));
-    }
-    if (options2?.acl) {
-      options2.acl = null;
+      return new Promise((resolve, reject) => this.findObject(idOrName, type, options, (err, id, _idOrName) => err ? reject(err) : resolve(id)));
     }
     if (typeof callback === "function") {
-      utils.checkObjectRights(this, null, null, options2, CONSTS.ACCESS_LIST, (err, options3) => {
+      utils.checkObjectRights(this, null, null, options, CONSTS.ACCESS_LIST, (err, userContext2) => {
         if (err) {
           return import_db_base.tools.maybeCallbackWithError(callback, err);
         }
-        return this._findObject(idOrName, type, options3, callback);
+        return this._findObject(idOrName, type, options, userContext2, callback);
       });
     }
   }
   // can be called only from js-controller
+  /**
+   * Add object property paths that should be preserved when an object is overwritten (controller only)
+   *
+   * @param settings One or more property paths to preserve
+   */
   addPreserveSettings(settings) {
     if (!Array.isArray(settings)) {
       settings = [settings];
@@ -3475,26 +3794,40 @@ class ObjectsInRedisClient {
       return import_db_base.tools.maybeCallbackWithRedisError(callback, e);
     }
   }
-  destroyDB(options2, callback) {
-    if (typeof options2 === "function") {
-      callback = options2;
-      options2 = null;
+  /**
+   * Delete the whole objects database (requires admin rights)
+   *
+   * @param options The current request options including the user, or the callback
+   * @param callback Called once the database has been destroyed
+   */
+  destroyDB(options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = null;
     }
-    options2 = options2 || {};
-    utils.checkObjectRights(this, null, null, options2, CONSTS.ACCESS_WRITE, (err, options3) => {
+    options = options || {};
+    utils.checkObjectRights(this, null, null, options, CONSTS.ACCESS_WRITE, (err, userContext2) => {
       if (err) {
         return import_db_base.tools.maybeCallbackWithRedisError(callback, err);
       }
-      if (!options3.acl.file.write || options3.user !== CONSTS.SYSTEM_ADMIN_USER) {
+      if (!userContext2.acl.file.write || userContext2.user !== CONSTS.SYSTEM_ADMIN_USER) {
         return import_db_base.tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION);
       }
       return this._destroyDB(callback);
     });
   }
-  destroyDBAsync(options2) {
-    return new Promise((resolve, reject) => this.destroyDB(options2, (err) => err ? reject(err) : resolve()));
+  /**
+   * Promise-version of destroyDB
+   *
+   * @param options The current request options including the user
+   * @param options.user The user on whose behalf the database is destroyed
+   */
+  destroyDBAsync(options) {
+    return new Promise((resolve, reject) => this.destroyDB(options, (err) => err ? reject(err) : resolve()));
   }
-  // Destructor of the class. Called by shutting down.
+  /**
+   * Destructor of the class. Called when shutting down to close the redis connections.
+   */
   async destroy() {
     this.stop = true;
     if (this.client) {
@@ -3522,6 +3855,9 @@ class ObjectsInRedisClient {
       }
     }
   }
+  /**
+   * Load and register the Lua scripts used for atomic operations on the redis server
+   */
   async loadLuaScripts() {
     let luaDirName;
     if (this.noLegacyMultihost && this.useSets) {
@@ -3540,15 +3876,13 @@ class ObjectsInRedisClient {
       return { name: name.replace(/\.lua$/, ""), text: script, hash };
     });
     const hashes = scripts.map((e) => e.hash);
-    hashes.unshift("EXISTS");
     if (!this.client) {
       throw new Error(import_db_base.tools.ERRORS.ERROR_DB_CLOSED);
     }
-    let arr;
     try {
-      arr = await this.client.script(hashes);
+      const arr = await this.client.script("EXISTS", ...hashes);
       if (arr) {
-        scripts.forEach((e, i) => scripts[i].loaded = !!arr[i]);
+        scripts.forEach((_e, i) => scripts[i].loaded = !!arr[i]);
       }
     } catch {
     }
@@ -3559,7 +3893,7 @@ class ObjectsInRedisClient {
       if (!script.loaded) {
         let hash;
         try {
-          hash = await this.client.script(["LOAD", script.text]);
+          hash = await this.client.script("LOAD", script.text);
           script.loaded = true;
         } catch (e) {
           script.loaded = false;
@@ -3568,16 +3902,16 @@ class ObjectsInRedisClient {
             throw new Error(`Cannot load "${script.name}" into objects database: ${e.message}`);
           }
         }
-        script.hash = hash;
+        script.hash = hash || "";
       }
     }
     this.scripts = {};
     scripts.forEach((e) => this.scripts[e.name] = e.hash);
   }
   /**
-   * Get all keys matching a pattern using redis SCAN command, duplicates are filtered out
+   * Get all keys matching a pattern using redis SCAN command; duplicates are filtered out
    *
-   * @param pattern - pattern to match, e. g. io.hm-rpc.0*
+   * @param pattern - pattern to match, e.g. io.hm-rpc.0*
    * @param count - count argument used by redis SCAN, default is 250
    */
   _getKeysViaScan(pattern, count = 250) {
@@ -3597,6 +3931,7 @@ class ObjectsInRedisClient {
       stream.on("end", () => {
         resolve(Array.from(new Set(uniqueKeys)));
       });
+      stream.on("error", reject);
     });
   }
   /**
@@ -3667,17 +4002,11 @@ class ObjectsInRedisClient {
     if (!this.noLegacyMultihost) {
       return Promise.resolve(0);
     }
-    return this.client.evalsha([
-      this.scripts.redlock_extend,
-      3,
-      `${this.metaNamespace}objects.primaryHost`,
-      this.hostname,
-      ms
-    ]);
+    return this.client.evalsha(this.scripts.redlock_extend, 3, `${this.metaNamespace}objects.primaryHost`, this.hostname, ms);
   }
   /**
-   * Sets current host as primary if no primary host active
-   * Value will expire after ms milliseconds
+   * Sets the current host as primary if no primary host active
+   * Value expires after ms milliseconds
    *
    * @param ms - ms until value expires
    * @returns 1 if lock acquired else 0
@@ -3689,16 +4018,10 @@ class ObjectsInRedisClient {
     if (!this.noLegacyMultihost) {
       return Promise.resolve(0);
     }
-    return this.client.evalsha([
-      this.scripts.redlock_acquire,
-      3,
-      `${this.metaNamespace}objects.primaryHost`,
-      this.hostname,
-      ms
-    ]);
+    return this.client.evalsha(this.scripts.redlock_acquire, 3, `${this.metaNamespace}objects.primaryHost`, this.hostname, ms);
   }
   /**
-   * Get name of the primary host
+   * Get the name of the primary host
    */
   getPrimaryHost() {
     if (!this.client) {
@@ -3719,14 +4042,7 @@ class ObjectsInRedisClient {
     if (!this.noLegacyMultihost) {
       return Promise.resolve();
     }
-    return this.client.evalsha([
-      this.scripts.redlock_release,
-      4,
-      `${this.metaNamespace}objects.primaryHost`,
-      this.hostname,
-      this.settings.connection.options.db,
-      `${this.metaNamespace}objects.primaryHost`
-    ]);
+    return this.client.evalsha(this.scripts.redlock_release, 4, `${this.metaNamespace}objects.primaryHost`, this.hostname, this.settings.connection.options.db || 0, `${this.metaNamespace}objects.primaryHost`);
   }
   /**
    * Sets the protocol version to the DB
@@ -3746,7 +4062,7 @@ class ObjectsInRedisClient {
     }
   }
   /**
-   * Subscribe to expired events to get expiration of primary host
+   * Subscribe to expired events to get expiration of the primary host
    */
   async subscribePrimaryHost() {
     if (this.subSystem) {