@memberjunction/core-entities-server 6.1.0-edge.6 → 6.1.0

package/dist/custom/MJUserRoleEntityServer.server.js

@@ -4,11 +4,27 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-import { BaseEntity, BaseEntityResult, ValidationErrorInfo, ValidationErrorType } from '@memberjunction/core';
+var MJUserRoleEntityServer_1;
+import { BaseEntity, BaseEntityResult, IsRestrictingFieldRule, Metadata, ValidationErrorInfo, ValidationErrorType, } from '@memberjunction/core';
 import { RegisterClass, UUIDsEqual } from '@memberjunction/global';
 import { MJUserRoleEntity } from '@memberjunction/core-entities';
+import { FindSystemUserFieldAccessViolations, UserCache } from '@memberjunction/generic-database-provider';
 /**
- * Server-side `MJ: User Roles` entity enforcing MJ's role-elevation invariant (issue #4282).
+ * Server-side `MJ: User Roles` entity. It carries TWO independent guards that happen to protect the
+ * same table from opposite directions. They share no state and no helpers, and every write path
+ * must satisfy both:
+ *
+ *   A. **Role elevation** (issue #4282) — bounds what the CALLER may do, by their own roles.
+ *   B. **System-user field access** — bounds what may be done TO the system user's role set.
+ *
+ * Guard A and guard B are orthogonal: A asks "is this caller entitled to make this change", B asks
+ * "does this change leave the system user field-restricted". A change must clear both, so the
+ * checks compose as a conjunction and are evaluated A-then-B (A is an in-memory role-list test; B
+ * walks cached metadata and only ever runs when the system user is the target).
+ *
+ * ---------------------------------------------------------------------------------------------
+ * GUARD A — ROLE ELEVATION (issue #4282)
+ * ---------------------------------------------------------------------------------------------
  *
  * WHY THIS EXISTS AT ALL. Issue #4260 (`MJUserEntityServer`) closed the `User.Type` route to
  * elevated capability. Role assignment is the platform's OTHER authority mechanism and was
@@ -81,13 +97,48 @@ import { MJUserRoleEntity } from '@memberjunction/core-entities';
  * deployment whose system user is NOT an Owner will see those sync paths fail closed — loudly,
  * at the save — exactly as #4260 documented for `MJ: Users`.
  *
- * Pure: reads only this record's own field state and the caller's cached roles. No `RunView`, no
- * provider, no engine, no I/O — so it costs nothing per save/delete and is unit-testable without a
- * database.
+ * Guard A is pure: it reads only this record's own field state and the caller's cached roles. No
+ * `RunView`, no provider, no engine, no I/O — so it costs nothing per save/delete and is
+ * unit-testable without a database. (Guard B is NOT pure in that sense; see below.)
+ *
+ * ---------------------------------------------------------------------------------------------
+ * GUARD B — SYSTEM-USER FIELD ACCESS
+ * ---------------------------------------------------------------------------------------------
+ *
+ * This is the other half of the system-user guard for field-level security.
+ * `MJEntityFieldPermissionEntityServer` guards the RULES; this guards the account's ROLE SET, from
+ * both directions. Without both halves an administrator reaches the forbidden state simply by
+ * doing the steps in a different order.
+ *
+ * - **Assignment** ({@link SystemUserRejectionReason}) — refuses giving the system user a role that
+ *   already denies a field. Only DENYING rules count here, because adding a role can only add rules
+ *   to the aggregate: its `Allow` rows grant, its `No Access` rows are inert, and only a `Deny`
+ *   can take something away. A guard that counted every rule would refuse to reassemble the
+ *   account's own role set the moment field security was enabled anywhere.
+ * - **Removal** ({@link Delete}) — refuses taking a role away when that would leave the account
+ *   short of its entity-level access. Removal is the opposite shape: it drops rules OUT of the
+ *   aggregate, so what matters is not what the departing role said but whether an `Allow` survives
+ *   without it.
+ *
+ * Why the system user must stay unrestricted: the server runs background work as that account.
+ * It pre-warms the shared engine caches at startup, and in task mode — which job and agent
+ * runners use — engines instead load on first touch, so whichever caller gets there first
+ * configures the engine for the entire process. Engine caches are process-wide and shared
+ * across users. A restricted system user could therefore leave partially loaded records in a
+ * cache that everyone reads afterward, with nothing at the point of failure pointing back at
+ * the role assignment that caused it.
+ *
+ * Unlike guard A, guard B reads cached metadata (`Metadata.Entities`, the provider, `UserCache`).
+ * It still performs no database I/O, but it is not state-free, and it needs those caches populated
+ * to have an opinion — a cold `UserCache` skips the check rather than blocking an administrator.
+ *
+ * This restricts CONFIGURATION only. There is no user who is exempt from a Deny at runtime —
+ * not even the system user, whose access comes from the same rows as everyone else's.
  */
-let MJUserRoleEntityServer = class MJUserRoleEntityServer extends MJUserRoleEntity {
+let MJUserRoleEntityServer = MJUserRoleEntityServer_1 = class MJUserRoleEntityServer extends MJUserRoleEntity {
     Validate() {
         const result = super.Validate();
+        // Guard A — the caller may only assign/move a role they hold themselves.
         if (!this.callerIsOwner()) {
             this.validateRoleHeld(result, this.RoleID, 'You may only assign a role that you hold yourself. Assigning a role you do not hold would ' +
                 'grant authority you were not given. Ask an Owner to make this assignment.');
@@ -95,6 +146,13 @@ let MJUserRoleEntityServer = class MJUserRoleEntityServer extends MJUserRoleEnti
                 this.validatePriorRoleHeld(result);
             }
         }
+        // Guard B — the system user may not be given a role that denies it a field. Applies to every
+        // caller, Owner included: an Owner is entitled to make the assignment but the resulting state
+        // is one the server cannot run in, so this is not an authority question.
+        const rejection = MJUserRoleEntityServer_1.SystemUserRejectionReason(this.UserID, this.RoleID, this.ProviderToUse);
+        if (rejection) {
+            result.Errors.push(new ValidationErrorInfo('RoleID', rejection, this.RoleID, ValidationErrorType.Failure));
+        }
         result.Success = result.Success && result.Errors.length === 0;
         return result;
     }
@@ -113,20 +171,36 @@ let MJUserRoleEntityServer = class MJUserRoleEntityServer extends MJUserRoleEnti
         return super.Save(options);
     }
     /**
-     * Invariant 3 — a non-Owner may only revoke a role they hold themselves.
+     * Enforces both guards on the delete path.
+     *
+     * Guard A, invariant 3 — a non-Owner may only revoke a role they hold themselves.
      *
-     * Reports the refusal the way `MJUserEntityServer.Delete` does — a `BaseEntityResult` on the
+     * Guard B — refuses REMOVING a role from the system user when that would cost the account its
+     * field access. The mirror of the assignment guard, and needed for the same reason the
+     * field-permission subclass guards its own delete path: the system user's access is ordinary
+     * `Allow` rows, and taking a role away drops that role's rows out of the aggregate. If the
+     * remaining roles have `No Access` on a field, the last removal denies it — with no `Deny`
+     * written anywhere and no field-permission row touched. It permits the removal when it also
+     * costs the account its entity-level read, since it is then denied one level up and field rules
+     * decide nothing — which is why the projection re-evaluates the entity ceiling too, rather than
+     * only the field rules.
+     *
+     * Reports refusals the way `MJUserEntityServer.Delete` does — a `BaseEntityResult` on the
      * result history, so `LatestResult.CompleteMessage` carries the reason, `Delete()` returning
      * `false` on a logical rejection rather than throwing (the CLAUDE.md Save/Delete error-handling
      * contract). Note that `SyncRolesUsersResolver.SyncUserRoles` treats a `false` from this method
      * as a hard error and throws, rolling its transaction back; that mutation runs as the system
-     * Owner, so it is exempt and never sees this refusal on a default install.
+     * Owner, so it is exempt from guard A and never sees that refusal on a default install.
      */
     async Delete(options) {
         if (!this.callerIsOwner() && !this.callerHoldsRole(this.RoleID)) {
             return this.refuse('delete', 'You may only revoke a role that you hold yourself. Revoking a role you do not hold would let you ' +
                 'strip authority you were never granted. Ask an Owner to make this change.');
         }
+        const rejection = this.systemUserRoleRemovalReason();
+        if (rejection) {
+            return this.refuse('delete', rejection);
+        }
         return super.Delete(options);
     }
     /**
@@ -200,6 +274,8 @@ let MJUserRoleEntityServer = class MJUserRoleEntityServer extends MJUserRoleEnti
      *
      * Reads `ActiveUser` rather than `ContextCurrentUser` directly so a per-request provider's
      * `CurrentUser` is honored on multi-provider servers.
+     *
+     * Applies to guard A only. Guard B has no Owner exemption — see `Validate()`.
      */
     callerIsOwner() {
         const caller = this.ActiveUser;
@@ -208,9 +284,93 @@ let MJUserRoleEntityServer = class MJUserRoleEntityServer extends MJUserRoleEnti
         }
         return caller.Type?.trim().toLowerCase() === 'owner';
     }
+    /**
+     * Why this role may not be taken off this user, or null when it may.
+     * Only ever rejects for the system user; every other user is unaffected.
+     */
+    systemUserRoleRemovalReason() {
+        const systemUser = UserCache.Instance?.GetSystemUser?.();
+        if (!systemUser || !this.UserID || !this.RoleID || !UUIDsEqual(systemUser.ID, this.UserID)) {
+            return null; // not the system user — nothing to guard
+        }
+        const provider = this.ProviderToUse;
+        const lost = FindSystemUserFieldAccessViolations(provider, systemUser, { WithoutRoleID: this.RoleID });
+        if (lost.length === 0) {
+            return null;
+        }
+        const shown = lost.slice(0, 3).map(v => `${v.EntityName}.${v.FieldName}`).join(', ');
+        const more = lost.length > 3 ? `, and ${lost.length - 3} more` : '';
+        return (`Removing this role from the MJ system user would leave it unable to use ${lost.length} field(s) ` +
+            `(${shown}${more}). The server runs background work as that account and shares one engine cache across ` +
+            `all users, so restricting it would let partially loaded records reach everyone. Field security has no ` +
+            `exempt user — grant those fields to another role the system user holds first.`);
+    }
+    /**
+     * Why this role may not be given to this user, or null when it may.
+     * Only ever rejects for the system user; every other user is unaffected.
+     */
+    static SystemUserRejectionReason(userID, roleID, provider) {
+        if (!userID || !roleID) {
+            return null;
+        }
+        // UserCache is populated on the server; a cold cache skips the check rather than
+        // blocking an administrator on missing state.
+        const systemUser = UserCache.Instance?.GetSystemUser?.();
+        if (!systemUser || !UUIDsEqual(systemUser.ID, userID)) {
+            return null; // not the system user — nothing to guard
+        }
+        const restricted = MJUserRoleEntityServer_1.EntitiesWithRestrictingFieldRulesForRole(roleID, provider);
+        if (restricted.length === 0) {
+            return null;
+        }
+        const shown = restricted.slice(0, 3).join(', ');
+        const more = restricted.length > 3 ? `, and ${restricted.length - 3} more` : '';
+        return (`This role denies access to at least one field (on ${shown}${more}), so it cannot be assigned to the MJ system user. ` +
+            `The server runs background work as that account and shares one engine cache across all users — ` +
+            `restricting it would let partially loaded records reach everyone. ` +
+            `Assign this role to a regular user, or remove its field permissions first.`);
+    }
+    /**
+     * Names of entities where this role carries at least one RESTRICTING field rule — a `Deny`
+     * on any verb. Walks cached metadata only — no database access. Runs only when the system
+     * user is the save target, which is rare.
+     *
+     * Grants and neutrals are ignored, and must be: the system user holds the standard roles
+     * (UI, Developer, Integration), snapshot initialization writes those roles `Allow` rows on
+     * every entity they can read, and field security has no runtime exemption to fall back on.
+     * A guard that counted any rule at all would refuse to reassemble the system user's own role
+     * set the moment field security was enabled anywhere.
+     *
+     * Deliberately does NOT gate on {@link EntityInfo.EnableFieldLevelSecurity}, even though
+     * rules on a disabled entity are inactive and gating would be the cheaper walk. Gating
+     * would leave the two halves of this guard unable to compose, and the gap is reachable in
+     * three ordinary steps: disable field security on an entity, assign the role (now carrying
+     * no active rules) to the system user, re-enable. Each step is permitted and the end state
+     * is the one both guards exist to prevent. Disabling preserves rules so re-enabling does
+     * not lose them, so a rule on a disabled entity is dormant rather than gone.
+     */
+    static EntitiesWithRestrictingFieldRulesForRole(roleID, provider) {
+        const md = provider ?? new Metadata();
+        const names = [];
+        for (const entity of md.Entities) {
+            const hit = entity.Fields.some(f => f.HasFieldPermissions &&
+                f.FieldPermissions.some(fp => UUIDsEqual(fp.RoleID, roleID) && IsRestrictingFieldRule(fp)));
+            if (hit) {
+                names.push(entity.Name);
+            }
+        }
+        return names;
+    }
 };
-MJUserRoleEntityServer = __decorate([
+MJUserRoleEntityServer = MJUserRoleEntityServer_1 = __decorate([
     RegisterClass(BaseEntity, 'MJ: User Roles')
 ], MJUserRoleEntityServer);
 export { MJUserRoleEntityServer };
+/**
+ * Loader stub — prevents the class from being tree-shaken out of the bundle. Mirrors the
+ * pattern used by the other server-side entity subclasses in this package.
+ */
+export function LoadMJUserRoleEntityServer() {
+    // no-op
+}
 //# sourceMappingURL=MJUserRoleEntityServer.server.js.map

package/dist/custom/MJUserRoleEntityServer.server.js.map

@@ -1 +1 @@
-{"version":3,"file":"MJUserRoleEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJUserRoleEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAoD,mBAAmB,EAAE,mBAAmB,EAAoB,MAAM,sBAAsB,CAAC;AAClL,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,gBAAgB;IACxC,QAAQ;QACpB,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,gBAAgB,CACjB,MAAM,EACN,IAAI,CAAC,MAAM,EACX,4FAA4F;gBAC5F,2EAA2E,CAC9E,CAAC;YACF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACa,KAAK,CAAC,IAAI,CAAC,OAA2B;QAClD,IAAI,OAAO,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,MAAM,CACd,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAClC,6FAA6F;gBAC7F,mFAAmF,CACtF,CAAC;QACN,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;;;OASG;IACa,KAAK,CAAC,MAAM,CAAC,OAA6B;QACtD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC,MAAM,CACd,QAAQ,EACR,mGAAmG;gBACnG,2EAA2E,CAC9E,CAAC;QACN,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,MAAwB,EAAE,MAAiC,EAAE,OAAe;QACjG,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO;QACX,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IAChH,CAAC;IAED;;;;;;;;;OASG;IACK,qBAAqB,CAAC,MAAwB;QAClD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,QAAqC,CAAC;QACzF,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CACtC,QAAQ,EACR,6FAA6F;gBAC7F,0FAA0F;gBAC1F,qBAAqB,EACrB,WAAW,IAAI,IAAI,EACnB,mBAAmB,CAAC,OAAO,CAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,IAAI,CAAC,gBAAgB,CACjB,MAAM,EACN,WAAW,EACX,uGAAuG;YACvG,uFAAuF,CAC1F,CAAC;IACN,CAAC;IAED,4GAA4G;IACpG,MAAM,CAAC,IAAoC,EAAE,OAAe;QAChE,MAAM,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACtC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACK,eAAe,CAAC,MAAiC;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QAC/B,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,aAAa;QACjB,MAAM,MAAM,GAAoB,IAAI,CAAC,UAAU,CAAC;QAChD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;IACzD,CAAC;CACJ,CAAA;AArJY,sBAAsB;IADlC,aAAa,CAAC,UAAU,EAAE,gBAAgB,CAAC;GAC/B,sBAAsB,CAqJlC"}
+{"version":3,"file":"MJUserRoleEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJUserRoleEntityServer.server.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EACH,UAAU,EACV,gBAAgB,EAKhB,sBAAsB,EACtB,QAAQ,EAER,mBAAmB,EACnB,mBAAmB,GAEtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,mCAAmC,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAE3G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6HG;AAEI,IAAM,sBAAsB,8BAA5B,MAAM,sBAAuB,SAAQ,gBAAgB;IACxC,QAAQ;QACpB,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAEhC,yEAAyE;QACzE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,gBAAgB,CACjB,MAAM,EACN,IAAI,CAAC,MAAM,EACX,4FAA4F;gBAC5F,2EAA2E,CAC9E,CAAC;YACF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;QACL,CAAC;QAED,6FAA6F;QAC7F,8FAA8F;QAC9F,yEAAyE;QACzE,MAAM,SAAS,GAAG,wBAAsB,CAAC,yBAAyB,CAC9D,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,aAA6C,CACrD,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACZ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/G,CAAC;QAED,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACa,KAAK,CAAC,IAAI,CAAC,OAA2B;QAClD,IAAI,OAAO,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,MAAM,CACd,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAClC,6FAA6F;gBAC7F,mFAAmF,CACtF,CAAC;QACN,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACa,KAAK,CAAC,MAAM,CAAC,OAA6B;QACtD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC,MAAM,CACd,QAAQ,EACR,mGAAmG;gBACnG,2EAA2E,CAC9E,CAAC;QACN,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACrD,IAAI,SAAS,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,MAAwB,EAAE,MAAiC,EAAE,OAAe;QACjG,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO;QACX,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IAChH,CAAC;IAED;;;;;;;;;OASG;IACK,qBAAqB,CAAC,MAAwB;QAClD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,QAAqC,CAAC;QACzF,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CACtC,QAAQ,EACR,6FAA6F;gBAC7F,0FAA0F;gBAC1F,qBAAqB,EACrB,WAAW,IAAI,IAAI,EACnB,mBAAmB,CAAC,OAAO,CAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,IAAI,CAAC,gBAAgB,CACjB,MAAM,EACN,WAAW,EACX,uGAAuG;YACvG,uFAAuF,CAC1F,CAAC;IACN,CAAC;IAED,4GAA4G;IACpG,MAAM,CAAC,IAAoC,EAAE,OAAe;QAChE,MAAM,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACtC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACK,eAAe,CAAC,MAAiC;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QAC/B,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,aAAa;QACjB,MAAM,MAAM,GAAoB,IAAI,CAAC,UAAU,CAAC;QAChD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;IACzD,CAAC;IAED;;;OAGG;IACK,2BAA2B;QAC/B,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC;QACzD,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzF,OAAO,IAAI,CAAC,CAAC,yCAAyC;QAC1D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAA6C,CAAC;QACpE,MAAM,IAAI,GAAG,mCAAmC,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACvG,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,CACH,2EAA2E,IAAI,CAAC,MAAM,YAAY;YAClG,IAAI,KAAK,GAAG,IAAI,wFAAwF;YACxG,wGAAwG;YACxG,+EAA+E,CAClF,CAAC;IACN,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,yBAAyB,CAAC,MAAqB,EAAE,MAAqB,EAAE,QAA4B;QAC9G,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,iFAAiF;QACjF,8CAA8C;QAC9C,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC;QACzD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC,CAAC,yCAAyC;QAC1D,CAAC;QAED,MAAM,UAAU,GAAG,wBAAsB,CAAC,wCAAwC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrG,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,CACH,qDAAqD,KAAK,GAAG,IAAI,qDAAqD;YACtH,iGAAiG;YACjG,oEAAoE;YACpE,4EAA4E,CAC/E,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,MAAM,CAAC,wCAAwC,CAAC,MAAc,EAAE,QAA4B;QAChG,MAAM,EAAE,GAAG,QAAQ,IAAI,IAAI,QAAQ,EAAE,CAAC;QACtC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,QAAwB,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,CACA,CAAC,CAAC,mBAAmB;gBACrB,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,sBAAsB,CAAC,EAAE,CAAC,CAAC,CACjG,CAAC;YACF,IAAI,GAAG,EAAE,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ,CAAA;AAjRY,sBAAsB;IADlC,aAAa,CAAC,UAAU,EAAE,gBAAgB,CAAC;GAC/B,sBAAsB,CAiRlC;;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACtC,QAAQ;AACZ,CAAC"}

package/dist/custom/fieldPermissionDelta.d.ts

@@ -0,0 +1,57 @@
+import { EntityInfo, FieldPermissionAccess } from '@memberjunction/core';
+/**
+ * A permission row that should exist but does not, at its snapshot defaults.
+ */
+export type FieldPermissionSnapshotRow = {
+    EntityFieldID: string;
+    RoleID: string;
+    ReadAccess: FieldPermissionAccess;
+    UpdateAccess: FieldPermissionAccess;
+    CreateAccess: FieldPermissionAccess;
+};
+/**
+ * What reconciliation must write to bring an entity's field-permission rows back in line with
+ * its fields and its entity-level permissions.
+ *
+ * There is no `ToUpdate`. An existing row is never touched, because an administrator's
+ * tightening has to survive every reconciliation — including disable → schema change →
+ * re-enable. That single rule is what makes "keep the rows, functionally inactive" on disable
+ * and "graceful reconciliation" on re-enable the same code path.
+ */
+export type FieldPermissionDelta = {
+    /** (field, role) pairs that should have a row and do not. */
+    ToInsert: FieldPermissionSnapshotRow[];
+    /** IDs of rows that should no longer exist. */
+    ToDelete: string[];
+};
+/**
+ * Computes the field-permission rows an entity is missing and the ones it should no longer
+ * have. Pure — no I/O, no entity objects, no provider. Everything comes off `EntityInfo`.
+ *
+ * **Snapshot defaults mirror entity-level permissions**, so enabling field security on an
+ * entity changes no behavior until an administrator tightens a specific field. A role that can
+ * read the entity gets `ReadAccess = 'Allow'`; its Update and Create follow the entity-level
+ * grants, defaulting to `No Access`.
+ *
+ * **A role without entity-level read gets no rows at all.** The entity-level gate already
+ * excludes it, so rows would be noise — and a row granting Update without Read would violate
+ * the Read-required CHECK constraint anyway.
+ *
+ * **Unrestrictable fields (primary keys, `__mj_` columns) get no rows.** They are forced open
+ * in the aggregation regardless, so rows for them are clutter that would also trip the
+ * save-time guard.
+ *
+ * **No role is excluded — including the ones the MJ system user holds.** Those rows are what
+ * keeps the system user working now that the aggregation has no bypass for it: it holds the
+ * standard roles (UI, Developer, Integration), which carry entity read on essentially
+ * everything, so the snapshot grants them `Allow` here and the save-time guards refuse any
+ * later `Deny` aimed at them. Access the server relies on is therefore visible in the data
+ * rather than implied by an exemption in code.
+ */
+export declare function ComputeFieldPermissionDelta(entity: EntityInfo): FieldPermissionDelta;
+/**
+ * True when the delta would change nothing, so callers can skip opening a transaction at all.
+ * Reconciliation runs on ordinary saves, and the overwhelmingly common answer is "nothing to do".
+ */
+export declare function IsEmptyFieldPermissionDelta(delta: FieldPermissionDelta): boolean;
+//# sourceMappingURL=fieldPermissionDelta.d.ts.map

package/dist/custom/fieldPermissionDelta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fieldPermissionDelta.d.ts","sourceRoot":"","sources":["../../src/custom/fieldPermissionDelta.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,UAAU,EAAwB,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAEhH;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,qBAAqB,CAAC;IAClC,YAAY,EAAE,qBAAqB,CAAC;IACpC,YAAY,EAAE,qBAAqB,CAAC;CACvC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAC/B,6DAA6D;IAC7D,QAAQ,EAAE,0BAA0B,EAAE,CAAC;IACvC,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAqBF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,UAAU,GAAG,oBAAoB,CAcpF;AAoKD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAEhF"}

package/dist/custom/fieldPermissionDelta.js

@@ -0,0 +1,196 @@
+import { FieldPermissionAccess } from '@memberjunction/core';
+/**
+ * Computes the field-permission rows an entity is missing and the ones it should no longer
+ * have. Pure — no I/O, no entity objects, no provider. Everything comes off `EntityInfo`.
+ *
+ * **Snapshot defaults mirror entity-level permissions**, so enabling field security on an
+ * entity changes no behavior until an administrator tightens a specific field. A role that can
+ * read the entity gets `ReadAccess = 'Allow'`; its Update and Create follow the entity-level
+ * grants, defaulting to `No Access`.
+ *
+ * **A role without entity-level read gets no rows at all.** The entity-level gate already
+ * excludes it, so rows would be noise — and a row granting Update without Read would violate
+ * the Read-required CHECK constraint anyway.
+ *
+ * **Unrestrictable fields (primary keys, `__mj_` columns) get no rows.** They are forced open
+ * in the aggregation regardless, so rows for them are clutter that would also trip the
+ * save-time guard.
+ *
+ * **No role is excluded — including the ones the MJ system user holds.** Those rows are what
+ * keeps the system user working now that the aggregation has no bypass for it: it holds the
+ * standard roles (UI, Developer, Integration), which carry entity read on essentially
+ * everything, so the snapshot grants them `Allow` here and the save-time guards refuse any
+ * later `Deny` aimed at them. Access the server relies on is therefore visible in the data
+ * rather than implied by an exemption in code.
+ */
+export function ComputeFieldPermissionDelta(entity) {
+    const accessByRoleID = buildRoleEntityAccessMap(entity);
+    const rolesWithEntityPermission = buildRolesWithAnyEntityPermission(entity);
+    const restrictableFields = entity.Fields.filter(isRestrictable);
+    // The two halves ask DIFFERENT questions of the same permission rows, and must not share an
+    // answer. Creating a snapshot row is a grant, so it is offered only to roles that can actually
+    // READ the entity (`accessByRoleID`). Deleting a row destroys an administrator's configuration,
+    // so it is justified only when the row can no longer influence any decision — which turns on
+    // whether the role relates to the entity at all, never on the strength of that relationship.
+    return {
+        ToInsert: computeMissingRows(restrictableFields, accessByRoleID),
+        ToDelete: computeOrphanRowIDs(entity, rolesWithEntityPermission),
+    };
+}
+/**
+ * A field is restrictable when field security could meaningfully apply to it. Primary keys and
+ * `__mj_` system columns are not, and neither is any field on the security-configuration or
+ * identity entities.
+ */
+function isRestrictable(field) {
+    return !field.IsUnrestrictableField && !field.IsOnUnrestrictableEntity;
+}
+/**
+ * Every role holding ANY entity-permission row for this entity, whatever it grants and whichever
+ * `Type` it carries.
+ *
+ * This is the orphan test's criterion, and it is deliberately weaker than
+ * {@link buildRoleEntityAccessMap}. A field rule bound to a role is live at runtime purely on ROLE
+ * MEMBERSHIP — `EntityFieldInfo.AggregateFieldRulesForUser` matches on
+ * `user.UserRoles.find(...)` and never consults that role's entity-level access. So a role that
+ * grants nothing at entity level still contributes its field rules to the aggregate of any user who
+ * holds it AND gets entity access from a different role. Judging such a row inert because its own
+ * role cannot read the entity confuses a per-role fact with a per-user one, and deleting it on that
+ * basis destroys a `Deny` that was fully in force — turning "a Deny always wins" into
+ * "a Deny wins until reconciliation runs".
+ *
+ * Membership of this set is what `MJEntityFieldPermissionEntityServer.Validate()` requires before a
+ * field rule may be written at all, so the rule reconciliation enforces on cleanup is the same one
+ * authoring enforces on write.
+ */
+function buildRolesWithAnyEntityPermission(entity) {
+    const roleIDs = new Set();
+    for (const permission of entity.Permissions) {
+        const roleID = normalizeID(permission.RoleID);
+        if (roleID) {
+            roleIDs.add(roleID);
+        }
+    }
+    return roleIDs;
+}
+/**
+ * Each role's effective entity-level access, aggregating its own Allow/Deny rows the same way
+ * `EntityInfo.GetUserPermisions` does one level up: a Deny beats an Allow for the same action.
+ *
+ * Roles resolving to no read access are omitted entirely, so callers can treat presence in the
+ * map as "this role should have rows."
+ */
+function buildRoleEntityAccessMap(entity) {
+    const allow = new Map();
+    const deny = new Map();
+    for (const permission of entity.Permissions) {
+        const roleID = normalizeID(permission.RoleID);
+        if (!roleID) {
+            continue;
+        }
+        const bucket = isDenyPermission(permission) ? deny : allow;
+        foldPermissionInto(bucket, roleID, permission);
+    }
+    const effective = new Map();
+    for (const [roleID, granted] of allow) {
+        const blocked = deny.get(roleID) ?? { CanRead: false, CanUpdate: false, CanCreate: false };
+        const access = {
+            CanRead: granted.CanRead && !blocked.CanRead,
+            CanUpdate: granted.CanUpdate && !blocked.CanUpdate,
+            CanCreate: granted.CanCreate && !blocked.CanCreate,
+        };
+        if (access.CanRead) {
+            effective.set(roleID, access);
+        }
+    }
+    return effective;
+}
+function isDenyPermission(permission) {
+    return (permission.Type ?? 'Allow').trim().toLowerCase() === 'deny';
+}
+function foldPermissionInto(bucket, roleID, permission) {
+    const current = bucket.get(roleID) ?? { CanRead: false, CanUpdate: false, CanCreate: false };
+    current.CanRead = current.CanRead || !!permission.CanRead;
+    current.CanUpdate = current.CanUpdate || !!permission.CanUpdate;
+    current.CanCreate = current.CanCreate || !!permission.CanCreate;
+    bucket.set(roleID, current);
+}
+/**
+ * Every (restrictable field × qualifying role) pair that has no row yet, at snapshot defaults.
+ */
+function computeMissingRows(fields, accessByRoleID) {
+    const missing = [];
+    for (const field of fields) {
+        const existingRoleIDs = new Set(field.FieldPermissions.map(fp => normalizeID(fp.RoleID)).filter(Boolean));
+        for (const [roleID, access] of accessByRoleID) {
+            if (existingRoleIDs.has(roleID)) {
+                continue;
+            }
+            // A read-only field cannot be written through the API by anyone — it is excluded from
+            // the generated create input and from the update SET list — so an Update or Create
+            // verb on it can never decide anything. Writing `Allow` there would author a rule
+            // that reads as a granted permission and is in fact inert, on ~1,000 fields x every
+            // qualifying role. Read stays meaningful and is untouched: restricting a foreign-key
+            // display column ("who does this record belong to") is a legitimate and common use.
+            const writable = !field.ReadOnly;
+            missing.push({
+                EntityFieldID: field.ID,
+                RoleID: roleID,
+                // Read is Allow by construction — buildRoleEntityAccessMap omits roles without
+                // it — which is what keeps these rows on the right side of the Read-required
+                // CHECK constraint no matter what Update and Create resolve to.
+                ReadAccess: FieldPermissionAccess.Allow,
+                UpdateAccess: writable && access.CanUpdate ? FieldPermissionAccess.Allow : FieldPermissionAccess.NoAccess,
+                CreateAccess: writable && access.CanCreate ? FieldPermissionAccess.Allow : FieldPermissionAccess.NoAccess,
+            });
+        }
+    }
+    return missing;
+}
+/**
+ * Rows that should no longer exist. Two ways a row becomes an orphan:
+ *
+ *  - its field is no longer restrictable (a column was made a primary key, or the entity joined
+ *    the unrestrictable list), so the aggregation returns fully-open for it regardless of any rule;
+ *  - its role holds no entity-permission row for this entity at all, so no user can carry the rule
+ *    into an aggregate through this entity — which also covers a role that no longer exists.
+ *
+ * A row whose FIELD was dropped disappears with the field's cascade, so it never reaches this
+ * walk — `entity.Fields` is the live set.
+ *
+ * **A role's entity-level ACCESS is deliberately not part of this test**, and an earlier version of
+ * this function that used it was wrong. It reasoned that a role without entity read is excluded by
+ * the entity gate, so its field rules cannot matter. But `EntityInfo.GetUserPermisions` aggregates
+ * the entity gate across ALL of a user's roles, exactly as the field aggregation does — so a user
+ * reading the entity through role S still carries role R's field rules, whatever R grants on its
+ * own. Deleting them silently restored access an administrator had explicitly denied, and
+ * `computeMissingRows` only ever writes `Allow`, so it never came back.
+ */
+function computeOrphanRowIDs(entity, rolesWithEntityPermission) {
+    const orphans = [];
+    for (const field of entity.Fields) {
+        const fieldIsRestrictable = isRestrictable(field);
+        for (const permission of field.FieldPermissions) {
+            const roleID = normalizeID(permission.RoleID);
+            if (!fieldIsRestrictable || !roleID || !rolesWithEntityPermission.has(roleID)) {
+                orphans.push(permission.ID);
+            }
+        }
+    }
+    return orphans;
+}
+/**
+ * Lowercased ID for map keys. UUIDs arrive with different casing depending on their source, so
+ * normalize once here rather than scanning with a comparator on every lookup.
+ */
+function normalizeID(id) {
+    return (id ?? '').trim().toLowerCase();
+}
+/**
+ * True when the delta would change nothing, so callers can skip opening a transaction at all.
+ * Reconciliation runs on ordinary saves, and the overwhelmingly common answer is "nothing to do".
+ */
+export function IsEmptyFieldPermissionDelta(delta) {
+    return delta.ToInsert.length === 0 && delta.ToDelete.length === 0;
+}
+//# sourceMappingURL=fieldPermissionDelta.js.map

package/dist/custom/fieldPermissionDelta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fieldPermissionDelta.js","sourceRoot":"","sources":["../../src/custom/fieldPermissionDelta.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqD,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAgDhH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAkB;IAC1D,MAAM,cAAc,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,yBAAyB,GAAG,iCAAiC,CAAC,MAAM,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAEhE,4FAA4F;IAC5F,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,6FAA6F;IAC7F,OAAO;QACH,QAAQ,EAAE,kBAAkB,CAAC,kBAAkB,EAAE,cAAc,CAAC;QAChE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,CAAC;KACnE,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAsB;IAC1C,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,iCAAiC,CAAC,MAAkB;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,MAAkB;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyC,CAAC;IAE9D,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,SAAS;QACb,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyC,CAAC;IACnE,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC3F,MAAM,MAAM,GAAkC;YAC1C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO;YAC5C,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS;YAClD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS;SACrD,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAgC;IACtD,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;AACxE,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAkD,EAAE,MAAc,EAAE,UAAgC;IAC5H,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7F,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;IAC1D,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;IAChE,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;IAChE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CACvB,MAAyB,EACzB,cAA0D;IAE1D,MAAM,OAAO,GAAiC,EAAE,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1G,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAC5C,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,SAAS;YACb,CAAC;YACD,sFAAsF;YACtF,mFAAmF;YACnF,kFAAkF;YAClF,oFAAoF;YACpF,qFAAqF;YACrF,oFAAoF;YACpF,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC;gBACT,aAAa,EAAE,KAAK,CAAC,EAAE;gBACvB,MAAM,EAAE,MAAM;gBACd,+EAA+E;gBAC/E,6EAA6E;gBAC7E,gEAAgE;gBAChE,UAAU,EAAE,qBAAqB,CAAC,KAAK;gBACvC,YAAY,EAAE,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ;gBACzG,YAAY,EAAE,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ;aAC5G,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,mBAAmB,CAAC,MAAkB,EAAE,yBAAsC;IACnF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,mBAAmB,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAClD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,mBAAmB,IAAI,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5E,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAChC,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,EAA6B;IAC9C,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAA2B;IACnE,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;AACtE,CAAC"}

package/dist/custom/fieldPermissionReconciler.d.ts

@@ -0,0 +1,34 @@
+import { EntityInfo, IMetadataProvider, UserInfo } from '@memberjunction/core';
+/** What a reconciliation run actually wrote. */
+export type FieldPermissionReconcileResult = {
+    Inserted: number;
+    Deleted: number;
+};
+/**
+ * Brings an entity's field-permission rows in line with its fields and entity-level
+ * permissions, writing the whole delta in one transaction.
+ *
+ * Every row goes through `BaseEntity.Save()` / `.Delete()` rather than direct SQL, so the
+ * save-time target guard, validation and entity actions all run — the delta function and the
+ * guard agree instead of one bypassing the other. `AllowDirectSQLInsert` stays off.
+ *
+ * Returns immediately when there is nothing to do, which is the overwhelmingly common case:
+ * reconciliation is triggered from ordinary saves, and a transaction opened to write zero rows
+ * is pure cost.
+ *
+ * @param entity the entity to reconcile — its `Fields` and `Permissions` are the desired state
+ * @param provider the provider to transact on and to build entity objects from
+ * @param contextUser the user the writes are attributed to
+ */
+export declare function ReconcileFieldPermissions(entity: EntityInfo, provider: IMetadataProvider, contextUser: UserInfo): Promise<FieldPermissionReconcileResult>;
+/**
+ * Runs {@link ReconcileFieldPermissions} and swallows failures into a logged error.
+ *
+ * For the adapters that reconcile as a SIDE EFFECT of some other save — a role being granted
+ * entity access, say. The triggering save has already committed by then, so throwing would
+ * report a failure for work that succeeded. The rows stay missing until the next reconciliation,
+ * which is a visible loss of access rather than a silent loss of protection: a field with no row
+ * on an enabled entity is denied.
+ */
+export declare function ReconcileFieldPermissionsQuietly(entity: EntityInfo, provider: IMetadataProvider, contextUser: UserInfo): Promise<FieldPermissionReconcileResult>;
+//# sourceMappingURL=fieldPermissionReconciler.d.ts.map

package/dist/custom/fieldPermissionReconciler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fieldPermissionReconciler.d.ts","sourceRoot":"","sources":["../../src/custom/fieldPermissionReconciler.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,UAAU,EACV,iBAAiB,EAIjB,QAAQ,EACX,MAAM,sBAAsB,CAAC;AAI9B,gDAAgD;AAChD,MAAM,MAAM,8BAA8B,GAAG;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAIF;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,yBAAyB,CAC3C,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,QAAQ,GACtB,OAAO,CAAC,8BAA8B,CAAC,CAmBzC;AAuDD;;;;;;;;GAQG;AACH,wBAAsB,gCAAgC,CAClD,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,QAAQ,GACtB,OAAO,CAAC,8BAA8B,CAAC,CAOzC"}