@memberjunction/server 6.1.0-edge.5 → 6.1.0-edge.7

package/dist/entitySubclasses/MJEntityPermissionEntityServer.server.js

@@ -5,15 +5,28 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 var MJEntityPermissionEntityServer_1;
-import { RegisterClass } from '@memberjunction/global';
+import { RegisterClass, UUIDsEqual } from '@memberjunction/global';
 import { BaseEntity } from '@memberjunction/core';
 import { MJEntityPermissionEntity } from '@memberjunction/core-entities';
 import { HttpPost } from '@memberjunction/network-utils';
+import { ReconcileFieldPermissionsQuietly } from '@memberjunction/core-entities-server';
 import { ___codeGenAPIPort, ___codeGenAPISubmissionDelay, ___codeGenAPIURL } from '../config.js';
 /**
  * Server-side only class that extends the entity permissions object to watch for changes to entity permissions, build a queue of entities that have been changed, and then from time to time, submit
  * them to an API server that will execute the underlying permission changes at the database level.
  *
+ * It is also the field-level-security lifecycle adapter for entity-permission changes. Snapshot
+ * initialization creates field-permission rows for the roles holding entity access AT THE TIME
+ * the flag is flipped; a role granted access afterwards has none, and on an enabled entity a
+ * field with no rows is denied — so that role would pass the entity gate and then see zero
+ * fields, which reads as a broken screen rather than a permissions gap. The reverse matters
+ * too: a role that loses entity access leaves rows that can no longer affect any decision.
+ *
+ * Both responsibilities live here because `ClassFactory` resolves ONE class per entity name.
+ * A second `@RegisterClass(BaseEntity, 'MJ: Entity Permissions')` in another package would not
+ * compose with this one — priority auto-increments by load order, so whichever loaded last
+ * would silently displace the other.
+ *
  * This class is within the memberjunction/server package because it is closely coupled to other aspects of what
  * happens in the server. That's why it is not in the core-entities-server package.
  */
@@ -90,19 +103,59 @@ let MJEntityPermissionEntityServer = class MJEntityPermissionEntityServer extend
             console.log('No entities to submit.');
         }
     }
-    Save(options) {
+    async Save(options) {
         // simply queue up the entity ID
         if (this.Dirty || options?.IgnoreDirtyState)
             MJEntityPermissionEntityServer_1.AddToQueue(this.EntityID);
-        return super.Save(options);
+        // Capture before the save — afterwards nothing is dirty and the dirty check reads false.
+        const affectsFieldSecurity = this.affectsFieldPermissionRows();
+        if (!(await super.Save(options)))
+            return false;
+        if (affectsFieldSecurity)
+            await this.reconcileFieldPermissions(this.EntityID);
+        return true;
     }
     async Delete(options) {
+        // Capture before the delete — afterwards this record's EntityID is gone.
+        const targetEntityID = this.EntityID;
         const success = await super.Delete(options);
         // simply queue up the entity ID if the delete worked
-        if (success)
-            MJEntityPermissionEntityServer_1.AddToQueue(this.EntityID);
+        if (success) {
+            MJEntityPermissionEntityServer_1.AddToQueue(targetEntityID);
+            await this.reconcileFieldPermissions(targetEntityID);
+        }
         return success;
     }
+    /**
+     * Whether this save can change which field-permission rows should exist.
+     *
+     * Only the access flags and the role matter — the field-permission delta keys off a role's
+     * effective entity-level access, so an edit to an RLS filter changes nothing here. A new
+     * record always counts, since it may be the grant that brings a role into scope.
+     */
+    affectsFieldPermissionRows() {
+        if (!this.IsSaved)
+            return true;
+        return ['Type', 'CanRead', 'CanUpdate', 'CanCreate', 'RoleID'].some((fieldName) => this.GetFieldByName(fieldName)?.Dirty === true);
+    }
+    /**
+     * Reconciles the target entity's field-permission rows, when that entity has field security
+     * switched on. The flag check keeps this free for the overwhelming majority of permission
+     * edits, which are on entities that never opted in.
+     *
+     * Runs AFTER the permission write commits, and failures are logged rather than thrown: the
+     * save that triggered it has already succeeded, so reporting it as failed would be wrong.
+     * Missing rows fail closed until the next reconciliation.
+     */
+    async reconcileFieldPermissions(entityID) {
+        if (!entityID)
+            return;
+        const provider = this.ProviderToUse;
+        const entityInfo = provider?.Entities?.find((e) => UUIDsEqual(e.ID, entityID));
+        if (!entityInfo?.EnableFieldLevelSecurity)
+            return;
+        await ReconcileFieldPermissionsQuietly(entityInfo, provider, this.ContextCurrentUser);
+    }
 };
 MJEntityPermissionEntityServer = MJEntityPermissionEntityServer_1 = __decorate([
     RegisterClass(BaseEntity, 'MJ: Entity Permissions')

package/dist/entitySubclasses/MJEntityPermissionEntityServer.server.js.map

@@ -1 +1 @@
-{"version":3,"file":"MJEntityPermissionEntityServer.server.js","sourceRoot":"","sources":["../../src/entitySubclasses/MJEntityPermissionEntityServer.server.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,UAAU,EAA0C,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEjG;;;;;;GAMG;AAEI,IAAM,8BAA8B,GAApC,MAAM,8BAA+B,SAAQ,wBAAwB;;aACzD,mBAAc,GAAa,EAAE,AAAf,CAAgB;aAC9B,sBAAiB,GAAgB,IAAI,AAApB,CAAqB;aACtC,qBAAgB,GAA0B,IAAI,AAA9B,CAA+B;aAC/C,qBAAgB,GAAW,4BAA4B,AAAvC,CAAwC;aACxD,aAAQ,GAAW,gBAAgB,AAA3B,CAA4B;aACpC,UAAK,GAAW,iBAAiB,AAA5B,CAA6B;aAClC,iBAAY,GAAW,yBAAyB,AAApC,CAAqC;IAElE,+CAA+C;IACrC,MAAM,CAAC,gBAAgB;QAC/B,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IAC9D,CAAC;IAEM,MAAM,KAAK,aAAa;QAC7B,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAEM,MAAM,CAAC,UAAU;QACtB,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAC/B,CAAC;IACM,MAAM,CAAC,UAAU,CAAC,QAAgB;QACvC,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrF,IAAI,CAAC,iBAAiB,GAAG,IAAI,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,yBAAyB,EAAE,CAAC;IACnC,CAAC;IAES,MAAM,CAAC,yBAAyB;QACxC,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,2DAA2D;YAC3D,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACpC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IAES,MAAM,CAAC,oBAAoB;QACnC,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,GAAG,EAAE;YACtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC5B,CAAC;IAES,MAAM,CAAC,KAAK,CAAC,WAAW;QAChC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAE9B,0CAA0C;QAC1C,sCAAsC;QACtC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,qFAAqF;gBACrF,kFAAkF;gBAClF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAA6C,IAAI,CAAC,gBAAgB,EAAE,EAAE;oBACnG,aAAa,EAAE,IAAI,CAAC,cAAc;iBACnC,CAAC,CAAC;gBAEH,+DAA+D;gBAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;oBAC9D,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;oBAC7C,iCAAiC;oBACjC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,CAAC;qBAAM,CAAC;oBACN,kCAAkC;oBAClC,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,IAAI,eAAe,CAAC,CAAC;gBAC3F,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,qBAAqB;gBACrB,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBAChD,qEAAqE;YACvE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAEQ,IAAI,CAAC,OAA2B;QACvC,gCAAgC;QAChC,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,EAAE,gBAAgB;YAAE,gCAA8B,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEtG,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAEQ,KAAK,CAAC,MAAM,CAAC,OAA4B;QAChD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE5C,qDAAqD;QACrD,IAAI,OAAO;YAAE,gCAA8B,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEtE,OAAO,OAAO,CAAC;IACjB,CAAC;;AA1FU,8BAA8B;IAD1C,aAAa,CAAC,UAAU,EAAE,wBAAwB,CAAC;GACvC,8BAA8B,CA2F1C"}
+{"version":3,"file":"MJEntityPermissionEntityServer.server.js","sourceRoot":"","sources":["../../src/entitySubclasses/MJEntityPermissionEntityServer.server.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,UAAU,EAA6D,MAAM,sBAAsB,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,gCAAgC,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEjG;;;;;;;;;;;;;;;;;;GAkBG;AAEI,IAAM,8BAA8B,GAApC,MAAM,8BAA+B,SAAQ,wBAAwB;;aACzD,mBAAc,GAAa,EAAE,AAAf,CAAgB;aAC9B,sBAAiB,GAAgB,IAAI,AAApB,CAAqB;aACtC,qBAAgB,GAA0B,IAAI,AAA9B,CAA+B;aAC/C,qBAAgB,GAAW,4BAA4B,AAAvC,CAAwC;aACxD,aAAQ,GAAW,gBAAgB,AAA3B,CAA4B;aACpC,UAAK,GAAW,iBAAiB,AAA5B,CAA6B;aAClC,iBAAY,GAAW,yBAAyB,AAApC,CAAqC;IAElE,+CAA+C;IACrC,MAAM,CAAC,gBAAgB;QAC/B,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IAC9D,CAAC;IAEM,MAAM,KAAK,aAAa;QAC7B,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAEM,MAAM,CAAC,UAAU;QACtB,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAC/B,CAAC;IACM,MAAM,CAAC,UAAU,CAAC,QAAgB;QACvC,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrF,IAAI,CAAC,iBAAiB,GAAG,IAAI,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,yBAAyB,EAAE,CAAC;IACnC,CAAC;IAES,MAAM,CAAC,yBAAyB;QACxC,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,2DAA2D;YAC3D,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACpC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IAES,MAAM,CAAC,oBAAoB;QACnC,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,GAAG,EAAE;YACtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC5B,CAAC;IAES,MAAM,CAAC,KAAK,CAAC,WAAW;QAChC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAE9B,0CAA0C;QAC1C,sCAAsC;QACtC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,qFAAqF;gBACrF,kFAAkF;gBAClF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAA6C,IAAI,CAAC,gBAAgB,EAAE,EAAE;oBACnG,aAAa,EAAE,IAAI,CAAC,cAAc;iBACnC,CAAC,CAAC;gBAEH,+DAA+D;gBAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;oBAC9D,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;oBAC7C,iCAAiC;oBACjC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,CAAC;qBAAM,CAAC;oBACN,kCAAkC;oBAClC,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,IAAI,eAAe,CAAC,CAAC;gBAC3F,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,qBAAqB;gBACrB,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBAChD,qEAAqE;YACvE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAEQ,KAAK,CAAC,IAAI,CAAC,OAA2B;QAC7C,gCAAgC;QAChC,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,EAAE,gBAAgB;YAAE,gCAA8B,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEtG,yFAAyF;QACzF,MAAM,oBAAoB,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAE/D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAE/C,IAAI,oBAAoB;YAAE,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IAEQ,KAAK,CAAC,MAAM,CAAC,OAA4B;QAChD,yEAAyE;QACzE,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE5C,qDAAqD;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,gCAA8B,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YAC1D,MAAM,IAAI,CAAC,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACO,0BAA0B;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE/B,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CACjE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,IAAI,CAC9D,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACO,KAAK,CAAC,yBAAyB,CAAC,QAAgB;QACxD,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAA6C,CAAC;QACpE,MAAM,UAAU,GAAG,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,UAAU,EAAE,wBAAwB;YAAE,OAAO;QAElD,MAAM,gCAAgC,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACxF,CAAC;;AAxIU,8BAA8B;IAD1C,aAAa,CAAC,UAAU,EAAE,wBAAwB,CAAC;GACvC,8BAA8B,CAyI1C"}