@memberjunction/core-entities 5.28.0 → 5.30.0

package/dist/custom/Permissions/MJCollectionPermissionEntityExtended.js

@@ -0,0 +1,101 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { BaseEntity, EntityPermissionType, RunView } from '@memberjunction/core';
+import { RegisterClass, UUIDsEqual } from '@memberjunction/global';
+import { MJCollectionPermissionEntity } from '../../generated/entity_subclasses.js';
+import { assertCallerMayCreateShare, buildActionsSummary, checkShareManagePermission, dispatchShareNotificationAfterSave, } from './BaseShareEntityExtended.js';
+/**
+ * Extended Collection Permission entity — same dual-purpose pattern as
+ * {@link MJDashboardPermissionEntityExtended}. See that class for rationale.
+ *
+ * Note: Collections have no entry in the `MJ: Resource Type` catalog, so
+ * `ResourceTypeName` is omitted and the notification's `ResourceTypeID` is
+ * left null. The bell icon still shows the title/message; click-through
+ * deep-linking can be added later if a Collection ResourceType is seeded.
+ */
+let MJCollectionPermissionEntityExtended = class MJCollectionPermissionEntityExtended extends MJCollectionPermissionEntity {
+    CheckPermissions(type, throwError) {
+        if (type === EntityPermissionType.Update || type === EntityPermissionType.Delete) {
+            const user = this.ActiveUser;
+            if (user && checkShareManagePermission(user, this.SharedByUserID))
+                return true;
+        }
+        return super.CheckPermissions(type, throwError);
+    }
+    async Save(options) {
+        const isNewShare = !this.IsSaved;
+        const allowed = await assertCallerMayCreateShare(this, isNewShare, () => this.callerMayShareCollection(), 'Only the collection owner or someone with Share permission on this collection can create a new share.');
+        if (!allowed)
+            return false;
+        const saved = await super.Save(options);
+        if (saved) {
+            await dispatchShareNotificationAfterSave(this, isNewShare, this.SharedByUserID, (provider, grantorId) => ({
+                Provider: provider,
+                ContextUser: this.ContextCurrentUser,
+                GrantorUserID: grantorId,
+                GranteeUserID: this.UserID,
+                ResourceTypeLabel: 'Collection',
+                // No ResourceTypeName — Collections aren't in the Resource Type catalog
+                ResourceName: this.Collection ?? null,
+                ResourceRecordID: this.CollectionID,
+                ActionsSummary: this.actionsSummary(),
+                ExtraConfiguration: { PermissionID: this.ID },
+            }));
+        }
+        return saved;
+    }
+    actionsSummary() {
+        return buildActionsSummary({
+            view: this.CanRead,
+            edit: this.CanEdit,
+            delete: this.CanDelete,
+            share: this.CanShare,
+        });
+    }
+    /**
+     * Authorization for CREATING a new CollectionPermission row. Caller must
+     * be the collection owner or hold an existing Share-capable grant. Same
+     * two-query pattern as {@link MJArtifactPermissionEntityExtended.callerMayShareArtifact}.
+     */
+    async callerMayShareCollection() {
+        const user = this.ContextCurrentUser;
+        if (!user)
+            return false;
+        const rv = new RunView();
+        const [ownerResult, grantResult] = await rv.RunViews([
+            {
+                EntityName: 'MJ: Collections',
+                ExtraFilter: `ID='${this.CollectionID}'`,
+                Fields: ['ID', 'OwnerID'],
+                MaxRows: 1,
+                ResultType: 'simple',
+            },
+            {
+                EntityName: 'MJ: Collection Permissions',
+                ExtraFilter: `CollectionID='${this.CollectionID}' AND UserID='${user.ID}' AND CanShare=1`,
+                Fields: ['ID'],
+                MaxRows: 1,
+                ResultType: 'simple',
+            },
+        ]);
+        const ownerId = ownerResult.Success
+            ? ownerResult.Results?.[0]?.OwnerID
+            : undefined;
+        if (ownerId && UUIDsEqual(ownerId, user.ID))
+            return true;
+        return grantResult.Success && (grantResult.Results?.length ?? 0) > 0;
+    }
+};
+MJCollectionPermissionEntityExtended = __decorate([
+    RegisterClass(BaseEntity, 'MJ: Collection Permissions')
+], MJCollectionPermissionEntityExtended);
+export { MJCollectionPermissionEntityExtended };
+/** Tree-shaking prevention — referenced from the custom/Permissions barrel. */
+export function LoadMJCollectionPermissionEntityExtended() {
+    // intentionally empty
+}
+//# sourceMappingURL=MJCollectionPermissionEntityExtended.js.map

package/dist/custom/Permissions/MJCollectionPermissionEntityExtended.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJCollectionPermissionEntityExtended.js","sourceRoot":"","sources":["../../../src/custom/Permissions/MJCollectionPermissionEntityExtended.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAqB,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EACH,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,EAC1B,kCAAkC,GACrC,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;GAQG;AAEI,IAAM,oCAAoC,GAA1C,MAAM,oCAAqC,SAAQ,4BAA4B;IACzE,gBAAgB,CAAC,IAA0B,EAAE,UAAmB;QACrE,IAAI,IAAI,KAAK,oBAAoB,CAAC,MAAM,IAAI,IAAI,KAAK,oBAAoB,CAAC,MAAM,EAAE,CAAC;YAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;YAC7B,IAAI,IAAI,IAAI,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC;gBAAE,OAAO,IAAI,CAAC;QACnF,CAAC;QACD,OAAO,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC;IAEQ,KAAK,CAAC,IAAI,CAAC,OAA2B;QAC3C,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAC5C,IAAI,EACJ,UAAU,EACV,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,EACrC,uGAAuG,CAC1G,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAE3B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACR,MAAM,kCAAkC,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;gBACtG,QAAQ,EAAE,QAAQ;gBAClB,WAAW,EAAE,IAAI,CAAC,kBAAkB;gBACpC,aAAa,EAAE,SAAS;gBACxB,aAAa,EAAE,IAAI,CAAC,MAAM;gBAC1B,iBAAiB,EAAE,YAAY;gBAC/B,wEAAwE;gBACxE,YAAY,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;gBACrC,gBAAgB,EAAE,IAAI,CAAC,YAAY;gBACnC,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;gBACrC,kBAAkB,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE;aAChD,CAAC,CAAC,CAAC;QACR,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,cAAc;QAClB,OAAO,mBAAmB,CAAC;YACvB,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,KAAK,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC,CAAC;IACP,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,wBAAwB;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC;YACjD;gBACI,UAAU,EAAE,iBAAiB;gBAC7B,WAAW,EAAE,OAAO,IAAI,CAAC,YAAY,GAAG;gBACxC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC;gBACzB,OAAO,EAAE,CAAC;gBACV,UAAU,EAAE,QAAQ;aACvB;YACD;gBACI,UAAU,EAAE,4BAA4B;gBACxC,WAAW,EAAE,iBAAiB,IAAI,CAAC,YAAY,iBAAiB,IAAI,CAAC,EAAE,kBAAkB;gBACzF,MAAM,EAAE,CAAC,IAAI,CAAC;gBACd,OAAO,EAAE,CAAC;gBACV,UAAU,EAAE,QAAQ;aACvB;SACJ,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO;YAC/B,CAAC,CAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAA6C,EAAE,OAAO;YAChF,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,OAAO,WAAW,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;CACJ,CAAA;AA7EY,oCAAoC;IADhD,aAAa,CAAC,UAAU,EAAE,4BAA4B,CAAC;GAC3C,oCAAoC,CA6EhD;;AAED,+EAA+E;AAC/E,MAAM,UAAU,wCAAwC;IACpD,sBAAsB;AAC1B,CAAC"}

package/dist/custom/Permissions/MJDashboardPermissionEntityExtended.d.ts

@@ -0,0 +1,32 @@
+import { EntityPermissionType, EntitySaveOptions } from '@memberjunction/core';
+import { MJDashboardPermissionEntity } from '../../generated/entity_subclasses.js';
+/**
+ * Extended Dashboard Permission entity. Adds two behaviors on top of the
+ * generated base:
+ *
+ *  1. **CheckPermissions override** — grantor and dashboard owner can always
+ *     Update/Delete their own grant. Without this, UI/Developer users can't
+ *     revoke their own shares because neither role has `CanDelete` on
+ *     `MJ: Dashboard Permissions`. The owner fallback also covers the
+ *     `SharedByUserID IS NULL` legacy case.
+ *
+ *  2. **Save override** — notifies the grantee via the shared `CreateShareNotification`
+ *     pipeline so `NotificationEngine` honors their in-app / email / SMS
+ *     preferences uniformly.
+ */
+export declare class MJDashboardPermissionEntityExtended extends MJDashboardPermissionEntity {
+    CheckPermissions(type: EntityPermissionType, throwError: boolean): boolean;
+    Save(options?: EntitySaveOptions): Promise<boolean>;
+    private isDashboardOwner;
+    /**
+     * Authorization for CREATING a new DashboardPermission row. Matches the
+     * `MJResourcePermissionEntityExtended.callerMayGrantShare` pattern:
+     * caller is either the dashboard owner, or holds an existing DashboardPermission
+     * on the same dashboard with `CanShare=true`.
+     */
+    private callerMayShareDashboard;
+    private actionsSummary;
+}
+/** Tree-shaking prevention — referenced from the custom/Permissions barrel. */
+export declare function LoadMJDashboardPermissionEntityExtended(): void;
+//# sourceMappingURL=MJDashboardPermissionEntityExtended.d.ts.map

package/dist/custom/Permissions/MJDashboardPermissionEntityExtended.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJDashboardPermissionEntityExtended.d.ts","sourceRoot":"","sources":["../../../src/custom/Permissions/MJDashboardPermissionEntityExtended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAI3F,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAQhF;;;;;;;;;;;;;GAaG;AACH,qBACa,mCAAoC,SAAQ,2BAA2B;IACvE,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO;IAUpE,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IA4BlE,OAAO,CAAC,gBAAgB;IAKxB;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAY/B,OAAO,CAAC,cAAc;CAQzB;AAED,+EAA+E;AAC/E,wBAAgB,uCAAuC,IAAI,IAAI,CAE9D"}

package/dist/custom/Permissions/MJDashboardPermissionEntityExtended.js

@@ -0,0 +1,95 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { BaseEntity, EntityPermissionType } from '@memberjunction/core';
+import { RegisterClass, UUIDsEqual } from '@memberjunction/global';
+import { DashboardEngine } from '../../engines/dashboards.js';
+import { MJDashboardPermissionEntity } from '../../generated/entity_subclasses.js';
+import { assertCallerMayCreateShare, buildActionsSummary, checkShareManagePermission, dispatchShareNotificationAfterSave, } from './BaseShareEntityExtended.js';
+/**
+ * Extended Dashboard Permission entity. Adds two behaviors on top of the
+ * generated base:
+ *
+ *  1. **CheckPermissions override** — grantor and dashboard owner can always
+ *     Update/Delete their own grant. Without this, UI/Developer users can't
+ *     revoke their own shares because neither role has `CanDelete` on
+ *     `MJ: Dashboard Permissions`. The owner fallback also covers the
+ *     `SharedByUserID IS NULL` legacy case.
+ *
+ *  2. **Save override** — notifies the grantee via the shared `CreateShareNotification`
+ *     pipeline so `NotificationEngine` honors their in-app / email / SMS
+ *     preferences uniformly.
+ */
+let MJDashboardPermissionEntityExtended = class MJDashboardPermissionEntityExtended extends MJDashboardPermissionEntity {
+    CheckPermissions(type, throwError) {
+        if (type === EntityPermissionType.Update || type === EntityPermissionType.Delete) {
+            const user = this.ActiveUser;
+            if (user && checkShareManagePermission(user, this.SharedByUserID, (userId) => this.isDashboardOwner(userId))) {
+                return true;
+            }
+        }
+        return super.CheckPermissions(type, throwError);
+    }
+    async Save(options) {
+        const isNewShare = !this.IsSaved;
+        const allowed = await assertCallerMayCreateShare(this, isNewShare, () => this.callerMayShareDashboard(), 'Only the dashboard owner or someone with Share permission on this dashboard can create a new share.');
+        if (!allowed)
+            return false;
+        const saved = await super.Save(options);
+        if (saved) {
+            await dispatchShareNotificationAfterSave(this, isNewShare, this.SharedByUserID, (provider, grantorId) => ({
+                Provider: provider,
+                ContextUser: this.ContextCurrentUser,
+                GrantorUserID: grantorId,
+                GranteeUserID: this.UserID,
+                ResourceTypeLabel: 'Dashboard',
+                ResourceTypeName: 'Dashboards',
+                ResourceName: this.Dashboard ?? null,
+                ResourceRecordID: this.DashboardID,
+                ActionsSummary: this.actionsSummary(),
+                ExtraConfiguration: { PermissionID: this.ID },
+            }));
+        }
+        return saved;
+    }
+    isDashboardOwner(userId) {
+        const dashboard = DashboardEngine.Instance.Dashboards.find((d) => UUIDsEqual(d.ID, this.DashboardID));
+        return !!dashboard?.UserID && UUIDsEqual(dashboard.UserID, userId);
+    }
+    /**
+     * Authorization for CREATING a new DashboardPermission row. Matches the
+     * `MJResourcePermissionEntityExtended.callerMayGrantShare` pattern:
+     * caller is either the dashboard owner, or holds an existing DashboardPermission
+     * on the same dashboard with `CanShare=true`.
+     */
+    callerMayShareDashboard() {
+        const user = this.ContextCurrentUser;
+        if (!user)
+            return false;
+        if (this.isDashboardOwner(user.ID))
+            return true;
+        return DashboardEngine.Instance.DashboardPermissions.some((p) => UUIDsEqual(p.DashboardID, this.DashboardID) &&
+            UUIDsEqual(p.UserID, user.ID) &&
+            p.CanShare === true);
+    }
+    actionsSummary() {
+        return buildActionsSummary({
+            view: this.CanRead,
+            edit: this.CanEdit,
+            delete: this.CanDelete,
+            share: this.CanShare,
+        });
+    }
+};
+MJDashboardPermissionEntityExtended = __decorate([
+    RegisterClass(BaseEntity, 'MJ: Dashboard Permissions')
+], MJDashboardPermissionEntityExtended);
+export { MJDashboardPermissionEntityExtended };
+/** Tree-shaking prevention — referenced from the custom/Permissions barrel. */
+export function LoadMJDashboardPermissionEntityExtended() {
+    // intentionally empty
+}
+//# sourceMappingURL=MJDashboardPermissionEntityExtended.js.map

package/dist/custom/Permissions/MJDashboardPermissionEntityExtended.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJDashboardPermissionEntityExtended.js","sourceRoot":"","sources":["../../../src/custom/Permissions/MJDashboardPermissionEntityExtended.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAqB,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EACH,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,EAC1B,kCAAkC,GACrC,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;;;;;GAaG;AAEI,IAAM,mCAAmC,GAAzC,MAAM,mCAAoC,SAAQ,2BAA2B;IACvE,gBAAgB,CAAC,IAA0B,EAAE,UAAmB;QACrE,IAAI,IAAI,KAAK,oBAAoB,CAAC,MAAM,IAAI,IAAI,KAAK,oBAAoB,CAAC,MAAM,EAAE,CAAC;YAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;YAC7B,IAAI,IAAI,IAAI,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC3G,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC;IAEQ,KAAK,CAAC,IAAI,CAAC,OAA2B;QAC3C,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAC5C,IAAI,EACJ,UAAU,EACV,GAAG,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,EACpC,qGAAqG,CACxG,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAE3B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACR,MAAM,kCAAkC,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;gBACtG,QAAQ,EAAE,QAAQ;gBAClB,WAAW,EAAE,IAAI,CAAC,kBAAkB;gBACpC,aAAa,EAAE,SAAS;gBACxB,aAAa,EAAE,IAAI,CAAC,MAAM;gBAC1B,iBAAiB,EAAE,WAAW;gBAC9B,gBAAgB,EAAE,YAAY;gBAC9B,YAAY,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;gBACpC,gBAAgB,EAAE,IAAI,CAAC,WAAW;gBAClC,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;gBACrC,kBAAkB,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE;aAChD,CAAC,CAAC,CAAC;QACR,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,gBAAgB,CAAC,MAAc;QACnC,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACtG,OAAO,CAAC,CAAC,SAAS,EAAE,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACK,uBAAuB;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,OAAO,eAAe,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CACrD,CAAC,CAAC,EAAE,EAAE,CACF,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC;YAC3C,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7B,CAAC,CAAC,QAAQ,KAAK,IAAI,CAC1B,CAAC;IACN,CAAC;IAEO,cAAc;QAClB,OAAO,mBAAmB,CAAC;YACvB,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,KAAK,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC,CAAC;IACP,CAAC;CACJ,CAAA;AAtEY,mCAAmC;IAD/C,aAAa,CAAC,UAAU,EAAE,2BAA2B,CAAC;GAC1C,mCAAmC,CAsE/C;;AAED,+EAA+E;AAC/E,MAAM,UAAU,uCAAuC;IACnD,sBAAsB;AAC1B,CAAC"}

package/dist/custom/Permissions/index.d.ts

@@ -0,0 +1,13 @@
+export * from './MJDashboardPermissionEntityExtended.js';
+export * from './MJCollectionPermissionEntityExtended.js';
+export * from './MJArtifactPermissionEntityExtended.js';
+export * from './MJAccessControlRuleEntityExtended.js';
+export * from './shareNotification.js';
+export * from './BaseShareEntityExtended.js';
+/**
+ * Forces all extended permission entity classes to load so their @RegisterClass
+ * decorators fire and override the generated entity classes in the ClassFactory.
+ * Called from `@memberjunction/core-entities` barrel on package import.
+ */
+export declare function LoadPermissionEntityExtensions(): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/custom/Permissions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/custom/Permissions/index.ts"],"names":[],"mappings":"AAAA,cAAc,uCAAuC,CAAC;AACtD,cAAc,wCAAwC,CAAC;AACvD,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAO1C;;;;GAIG;AACH,wBAAgB,8BAA8B,IAAI,IAAI,CAKrD"}

package/dist/custom/Permissions/index.js

@@ -0,0 +1,22 @@
+export * from './MJDashboardPermissionEntityExtended.js';
+export * from './MJCollectionPermissionEntityExtended.js';
+export * from './MJArtifactPermissionEntityExtended.js';
+export * from './MJAccessControlRuleEntityExtended.js';
+export * from './shareNotification.js';
+export * from './BaseShareEntityExtended.js';
+import { LoadMJDashboardPermissionEntityExtended } from './MJDashboardPermissionEntityExtended.js';
+import { LoadMJCollectionPermissionEntityExtended } from './MJCollectionPermissionEntityExtended.js';
+import { LoadMJArtifactPermissionEntityExtended } from './MJArtifactPermissionEntityExtended.js';
+import { LoadMJAccessControlRuleEntityExtended } from './MJAccessControlRuleEntityExtended.js';
+/**
+ * Forces all extended permission entity classes to load so their @RegisterClass
+ * decorators fire and override the generated entity classes in the ClassFactory.
+ * Called from `@memberjunction/core-entities` barrel on package import.
+ */
+export function LoadPermissionEntityExtensions() {
+    LoadMJDashboardPermissionEntityExtended();
+    LoadMJCollectionPermissionEntityExtended();
+    LoadMJArtifactPermissionEntityExtended();
+    LoadMJAccessControlRuleEntityExtended();
+}
+//# sourceMappingURL=index.js.map

package/dist/custom/Permissions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/custom/Permissions/index.ts"],"names":[],"mappings":"AAAA,cAAc,uCAAuC,CAAC;AACtD,cAAc,wCAAwC,CAAC;AACvD,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAE1C,OAAO,EAAE,uCAAuC,EAAE,MAAM,uCAAuC,CAAC;AAChG,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAClG,OAAO,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AAC9F,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAE5F;;;;GAIG;AACH,MAAM,UAAU,8BAA8B;IAC1C,uCAAuC,EAAE,CAAC;IAC1C,wCAAwC,EAAE,CAAC;IAC3C,sCAAsC,EAAE,CAAC;IACzC,qCAAqC,EAAE,CAAC;AAC5C,CAAC"}

package/dist/custom/Permissions/shareNotification.d.ts

@@ -0,0 +1,72 @@
+import { IMetadataProvider } from '@memberjunction/core';
+/**
+ * Input to {@link CreateShareNotification} — everything needed to deliver a
+ * share notification to the grantee of a newly-created permission record.
+ */
+export interface ShareNotificationInput {
+    /** Metadata provider — must be the Database provider (server-side). */
+    Provider: IMetadataProvider;
+    /** Context user to authorize the save. */
+    ContextUser: import('@memberjunction/core').UserInfo;
+    /** ID of the user who granted the share — the `from`. */
+    GrantorUserID: string;
+    /** ID of the user receiving the share — the `to` and the notification recipient. */
+    GranteeUserID: string;
+    /**
+     * Human-readable resource type label used in notification text (e.g., "Dashboard",
+     * "Collection"). Distinct from `ResourceTypeName` below — this is purely cosmetic.
+     */
+    ResourceTypeLabel: string;
+    /**
+     * Optional name from the {@link MJResourceTypeEntity} catalog (e.g., `"Dashboards"`,
+     * `"Artifacts"`, `"Records"`). When provided AND found in the catalog, the resolved
+     * ResourceType.ID is written to `MJUserNotification.ResourceTypeID` so the bell icon
+     * can deep-link via the matching `DriverClass`.
+     */
+    ResourceTypeName?: string;
+    /** Optional display name for the shared resource. */
+    ResourceName?: string | null;
+    /** Primary key of the shared resource. */
+    ResourceRecordID: string;
+    /** Short sentence describing what was granted. Goes in the notification body. */
+    ActionsSummary?: string;
+    /** Extra JSON payload for the notification (e.g., PermissionID, DomainName). */
+    ExtraConfiguration?: Record<string, unknown>;
+    /**
+     * Optional override for the notification title. When omitted, the dispatcher
+     * auto-generates `"<grantor> shared <resource> with you"`. Used by
+     * access-request workflow notifications (e.g., "New request for access to …")
+     * that don't match the default share-event phrasing.
+     */
+    Title?: string;
+    /**
+     * Optional override for the notification message body. When omitted, the
+     * dispatcher auto-generates a short sentence from `ActionsSummary`.
+     */
+    Message?: string;
+}
+/**
+ * Registerable handler that actually delivers a share notification. Declared
+ * here so server-side code (e.g., `@memberjunction/notifications`) can plug in
+ * richer delivery (in-app + email + SMS via `NotificationEngine`) without
+ * `@memberjunction/core-entities` having to import the notifications package —
+ * that direction would create a circular dependency.
+ */
+export type ShareNotificationHandler = (input: ShareNotificationInput) => Promise<boolean>;
+/**
+ * Register a custom dispatcher (e.g., one backed by `NotificationEngine.SendNotification`).
+ * Typically called once at server startup. Subsequent calls replace the handler.
+ * Passing `null` restores the default in-app-only behavior.
+ */
+export declare function RegisterShareNotificationHandler(handler: ShareNotificationHandler | null): void;
+/**
+ * Create and deliver a share notification. If a custom handler has been
+ * registered via {@link RegisterShareNotificationHandler}, it's called first;
+ * otherwise (and as a fallback on handler error) we write an in-app
+ * `MJ: User Notifications` row directly.
+ *
+ * Returns `true` when the notification was delivered successfully. Never
+ * throws — sharing succeeds even if notification delivery fails.
+ */
+export declare function CreateShareNotification(input: ShareNotificationInput): Promise<boolean>;
+//# sourceMappingURL=shareNotification.d.ts.map

package/dist/custom/Permissions/shareNotification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shareNotification.d.ts","sourceRoot":"","sources":["../../../src/custom/Permissions/shareNotification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAY,MAAM,sBAAsB,CAAC;AAKnE;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACnC,uEAAuE;IACvE,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,0CAA0C;IAC1C,WAAW,EAAE,OAAO,sBAAsB,EAAE,QAAQ,CAAC;IACrD,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,0CAA0C;IAC1C,gBAAgB,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAI3F;;;;GAIG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,GAAG,IAAI,CAE/F;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmB7F"}

package/dist/custom/Permissions/shareNotification.js

@@ -0,0 +1,98 @@
+import { LogError } from '@memberjunction/core';
+import { ResourcePermissionEngine } from '../ResourcePermissions/ResourcePermissionEngine.js';
+let registeredHandler = null;
+/**
+ * Register a custom dispatcher (e.g., one backed by `NotificationEngine.SendNotification`).
+ * Typically called once at server startup. Subsequent calls replace the handler.
+ * Passing `null` restores the default in-app-only behavior.
+ */
+export function RegisterShareNotificationHandler(handler) {
+    registeredHandler = handler;
+}
+/**
+ * Create and deliver a share notification. If a custom handler has been
+ * registered via {@link RegisterShareNotificationHandler}, it's called first;
+ * otherwise (and as a fallback on handler error) we write an in-app
+ * `MJ: User Notifications` row directly.
+ *
+ * Returns `true` when the notification was delivered successfully. Never
+ * throws — sharing succeeds even if notification delivery fails.
+ */
+export async function CreateShareNotification(input) {
+    // Self-shares are a no-op (guards against duplicate-notification loops on seeded data).
+    if (input.GrantorUserID === input.GranteeUserID)
+        return true;
+    if (!input.GranteeUserID || !input.ResourceRecordID)
+        return true;
+    if (registeredHandler) {
+        try {
+            return await registeredHandler(input);
+        }
+        catch (err) {
+            LogError(`Share notification handler threw; falling back to in-app only delivery: ${err instanceof Error ? err.message : String(err)}`);
+            // Fall through to default implementation below
+        }
+    }
+    return defaultInAppDispatch(input);
+}
+/**
+ * Default dispatcher: saves a single `MJ: User Notifications` row. No email /
+ * SMS delivery. Used when no custom handler is registered (e.g., on the client,
+ * or before the server startup wires up the NotificationEngine handler).
+ */
+async function defaultInAppDispatch(input) {
+    try {
+        const grantor = await input.Provider.GetEntityObject('MJ: Users', input.ContextUser);
+        await grantor.Load(input.GrantorUserID);
+        const grantorName = grantor.Name || grantor.Email || 'Another user';
+        const notification = await input.Provider.GetEntityObject('MJ: User Notifications', input.ContextUser);
+        const resourceLabel = input.ResourceName
+            ? `"${input.ResourceName}"`
+            : `a ${input.ResourceTypeLabel.toLowerCase()}`;
+        notification.UserID = input.GranteeUserID;
+        notification.Title = input.Title ?? `${grantorName} shared ${resourceLabel} with you`;
+        notification.Message =
+            input.Message ??
+                (input.ActionsSummary
+                    ? `${grantorName} shared ${resourceLabel} with you (${input.ActionsSummary}).`
+                    : `${grantorName} shared ${resourceLabel} with you.`);
+        notification.Unread = true;
+        const resolvedTypeId = await resolveResourceTypeId(input.ResourceTypeName, input.ContextUser);
+        if (resolvedTypeId)
+            notification.ResourceTypeID = resolvedTypeId;
+        notification.ResourceRecordID = input.ResourceRecordID;
+        notification.ResourceConfiguration = JSON.stringify({
+            DomainName: input.ResourceTypeLabel,
+            ...input.ExtraConfiguration,
+        });
+        const saved = await notification.Save();
+        if (!saved) {
+            LogError(`CreateShareNotification (default): save failed — ${notification.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+            return false;
+        }
+        return true;
+    }
+    catch (err) {
+        LogError(`CreateShareNotification (default): ${err instanceof Error ? err.message : String(err)}`);
+        return false;
+    }
+}
+/**
+ * Ensure the `ResourcePermissionEngine` is configured, then resolve
+ * `MJ: Resource Type.Name → ID`. Returns null when the engine fails to load or
+ * the type isn't in the catalog.
+ */
+async function resolveResourceTypeId(name, contextUser) {
+    if (!name)
+        return null;
+    try {
+        const engine = ResourcePermissionEngine.Instance;
+        await engine.Config(false, contextUser);
+        return engine.ResourceTypeIdByName(name);
+    }
+    catch (err) {
+        LogError(`resolveResourceTypeId('${name}'): ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}
+//# sourceMappingURL=shareNotification.js.map

package/dist/custom/Permissions/shareNotification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shareNotification.js","sourceRoot":"","sources":["../../../src/custom/Permissions/shareNotification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AA0D3F,IAAI,iBAAiB,GAAoC,IAAI,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAAC,OAAwC;IACrF,iBAAiB,GAAG,OAAO,CAAC;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAA6B;IACvE,wFAAwF;IACxF,IAAI,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEjE,IAAI,iBAAiB,EAAE,CAAC;QACpB,IAAI,CAAC;YACD,OAAO,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,QAAQ,CACJ,2EACI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACnD,EAAE,CACL,CAAC;YACF,+CAA+C;QACnD,CAAC;IACL,CAAC;IAED,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAA6B;IAC7D,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAe,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACnG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;QAEpE,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,eAAe,CACrD,wBAAwB,EACxB,KAAK,CAAC,WAAW,CACpB,CAAC;QAEF,MAAM,aAAa,GAAG,KAAK,CAAC,YAAY;YACpC,CAAC,CAAC,IAAI,KAAK,CAAC,YAAY,GAAG;YAC3B,CAAC,CAAC,KAAK,KAAK,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,CAAC;QAEnD,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC;QAC1C,YAAY,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,WAAW,WAAW,aAAa,WAAW,CAAC;QACtF,YAAY,CAAC,OAAO;YAChB,KAAK,CAAC,OAAO;gBACb,CAAC,KAAK,CAAC,cAAc;oBACjB,CAAC,CAAC,GAAG,WAAW,WAAW,aAAa,cAAc,KAAK,CAAC,cAAc,IAAI;oBAC9E,CAAC,CAAC,GAAG,WAAW,WAAW,aAAa,YAAY,CAAC,CAAC;QAC9D,YAAY,CAAC,MAAM,GAAG,IAAI,CAAC;QAE3B,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC9F,IAAI,cAAc;YAAE,YAAY,CAAC,cAAc,GAAG,cAAc,CAAC;QAEjE,YAAY,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;QACvD,YAAY,CAAC,qBAAqB,GAAG,IAAI,CAAC,SAAS,CAAC;YAChD,UAAU,EAAE,KAAK,CAAC,iBAAiB;YACnC,GAAG,KAAK,CAAC,kBAAkB;SAC9B,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,QAAQ,CAAC,oDAAoD,YAAY,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;YAC9H,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,QAAQ,CAAC,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAChC,IAAwB,EACxB,WAAoD;IAEpD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,CAAC;QACjD,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,QAAQ,CAAC,0BAA0B,IAAI,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC"}

package/dist/custom/ResourcePermissions/MJResourcePermissionEntityExtended.d.ts

@@ -1,9 +1,64 @@
-import { EntitySaveOptions } from "@memberjunction/core";
+import { EntityDeleteOptions, EntityPermissionType, EntitySaveOptions } from "@memberjunction/core";
 import { MJResourcePermissionEntity } from "../../generated/entity_subclasses.js";
 /**
  * Subclass for the Resource Permissiosn entity that implements some workflow logic
  */
 export declare class MJResourcePermissionEntityExtended extends MJResourcePermissionEntity {
+    /**
+     * Set by the async `Delete`/`Save` overrides after they confirm the
+     * context user is authorized via resource ownership or Owner-level grant.
+     * Read by the (sync) `CheckPermissions` override to bypass the role-based
+     * gate that would otherwise block non-admin users from revoking shares.
+     */
+    private _authorizedByOwnerOverride;
+    /**
+     * Relaxes the default role-based Update/Delete gate for three parties
+     * who legitimately need to manage a share:
+     *
+     *  1. **Grantor** — whoever created the grant (`SharedByUserID`).
+     *  2. **Resource owner** — the user who owns the underlying resource.
+     *     Checked synchronously via in-memory engine caches (currently
+     *     `ConversationEngine` for Conversations; add other engines as
+     *     resource types adopt this pattern).
+     *  3. **Owner-level grantee** — anyone else holding an `Owner` permission
+     *     on the same resource, consulted via the cached
+     *     `ResourcePermissionEngine.Permissions`.
+     *
+     * Without this, resource owners can't revoke shares other users created —
+     * the UI/Developer roles don't have `CanDelete` on `MJ: Resource Permissions`.
+     */
+    CheckPermissions(type: EntityPermissionType, throwError: boolean): boolean;
+    /**
+     * Async owner lookup that loads the target resource and returns `true`
+     * if the context user owns it. Generic — uses the resource type catalog
+     * to find the owner field name, so any resource type seeded in
+     * `MJ: Resource Types` works without per-type code here.
+     */
+    private currentUserOwnsResourceAsync;
+    /**
+     * Compute whether the context user may Update/Delete this permission row.
+     * Combines the sync checks (fast path, uses engine caches) with the async
+     * resource-owner lookup (works on the server where caches aren't populated).
+     */
+    private callerMayManageShare;
+    /**
+     * Async wrapper that runs the full authorization check (including the
+     * async resource-owner lookup) before delegating to the base delete. Sets
+     * `_authorizedByOwnerOverride` so the sync `CheckPermissions` called by
+     * the base class will bypass the role-based gate.
+     */
+    Delete(options?: EntityDeleteOptions): Promise<boolean>;
+    /**
+     * Checks resource-type-specific engine caches synchronously to decide
+     * whether `userId` owns the record this permission row points at.
+     */
+    private currentUserOwnsResource;
+    /**
+     * Owner-level grantees (direct or via role) can manage shares on the
+     * resource. Reads from `ResourcePermissionEngine`'s cached permissions —
+     * must already be configured; on the server this happens at startup.
+     */
+    private currentUserHasOwnerGrant;
     /**
      * This override encapsulates some busienss logic for the Resource Permissions entity as follows:
      * 1) Whenever a new permission record is created that has a status of "Requested", we generate a new Notifications record for the owner of the resource being requested
@@ -12,5 +67,12 @@ export declare class MJResourcePermissionEntityExtended extends MJResourcePermis
      * @param options
      */
     Save(options?: EntitySaveOptions): Promise<boolean>;
+    /**
+     * `true` when the context user may create an Approved grant on this resource:
+     * they are either the resource's owner, or they already hold an Owner-level
+     * `MJ: Resource Permissions` row on it (direct or via role). Returns `false`
+     * when there is no context user.
+     */
+    private callerMayGrantShare;
 }
 //# sourceMappingURL=MJResourcePermissionEntityExtended.d.ts.map

package/dist/custom/ResourcePermissions/MJResourcePermissionEntityExtended.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MJResourcePermissionEntityExtended.d.ts","sourceRoot":"","sources":["../../../src/custom/ResourcePermissions/MJResourcePermissionEntityExtended.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,iBAAiB,EAAyC,MAAM,sBAAsB,CAAC;AAE1H,OAAO,EAAE,0BAA0B,EAA0C,MAAM,mCAAmC,CAAC;AAGvH;;GAEG;AACH,qBACa,kCAAmC,SAAQ,0BAA0B;IAC9E;;;;;;OAMG;IACY,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;CAmFrE"}
+{"version":3,"file":"MJResourcePermissionEntityExtended.d.ts","sourceRoot":"","sources":["../../../src/custom/ResourcePermissions/MJResourcePermissionEntityExtended.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,mBAAmB,EAAE,oBAAoB,EAAE,iBAAiB,EAA+B,MAAM,sBAAsB,CAAC;AAE3J,OAAO,EAAE,0BAA0B,EAAgB,MAAM,mCAAmC,CAAC;AAS7F;;GAEG;AACH,qBACa,kCAAmC,SAAQ,0BAA0B;IAC9E;;;;;OAKG;IACH,OAAO,CAAC,0BAA0B,CAAS;IAC3C;;;;;;;;;;;;;;;OAeG;IACM,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO;IAanF;;;;;OAKG;YACW,4BAA4B;IAqC1C;;;;OAIG;YACW,oBAAoB;IASlC;;;;;OAKG;IACY,MAAM,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAetE;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAW/B;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAehC;;;;;;OAMG;IACY,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IA+IlE;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAa9B"}