@memberjunction/server 6.1.0-edge.6 → 6.1.0

package/src/entitySubclasses/MJEntityPermissionEntityServer.server.ts

@@ -1,13 +1,26 @@
-import { RegisterClass } from '@memberjunction/global';
-import { BaseEntity, EntityDeleteOptions, EntitySaveOptions } from '@memberjunction/core';
+import { RegisterClass, UUIDsEqual } from '@memberjunction/global';
+import { BaseEntity, EntityDeleteOptions, EntitySaveOptions, IMetadataProvider } from '@memberjunction/core';
 import { MJEntityPermissionEntity } from '@memberjunction/core-entities';
 import { HttpPost } from '@memberjunction/network-utils';
+import { ReconcileFieldPermissionsQuietly } from '@memberjunction/core-entities-server';
 import { ___codeGenAPIPort, ___codeGenAPISubmissionDelay, ___codeGenAPIURL } from '../config.js';
 
 /**
  * Server-side only class that extends the entity permissions object to watch for changes to entity permissions, build a queue of entities that have been changed, and then from time to time, submit
  * them to an API server that will execute the underlying permission changes at the database level.
- * 
+ *
+ * It is also the field-level-security lifecycle adapter for entity-permission changes. Snapshot
+ * initialization creates field-permission rows for the roles holding entity access AT THE TIME
+ * the flag is flipped; a role granted access afterwards has none, and on an enabled entity a
+ * field with no rows is denied — so that role would pass the entity gate and then see zero
+ * fields, which reads as a broken screen rather than a permissions gap. The reverse matters
+ * too: a role that loses entity access leaves rows that can no longer affect any decision.
+ *
+ * Both responsibilities live here because `ClassFactory` resolves ONE class per entity name.
+ * A second `@RegisterClass(BaseEntity, 'MJ: Entity Permissions')` in another package would not
+ * compose with this one — priority auto-increments by load order, so whichever loaded last
+ * would silently displace the other.
+ *
  * This class is within the memberjunction/server package because it is closely coupled to other aspects of what
  * happens in the server. That's why it is not in the core-entities-server package.
  */
@@ -88,19 +101,65 @@ export class MJEntityPermissionEntityServer extends MJEntityPermissionEntity {
     }
   }
 
-  override Save(options?: EntitySaveOptions): Promise<boolean> {
+  override async Save(options?: EntitySaveOptions): Promise<boolean> {
     // simply queue up the entity ID
     if (this.Dirty || options?.IgnoreDirtyState) MJEntityPermissionEntityServer.AddToQueue(this.EntityID);
 
-    return super.Save(options);
+    // Capture before the save — afterwards nothing is dirty and the dirty check reads false.
+    const affectsFieldSecurity = this.affectsFieldPermissionRows();
+
+    if (!(await super.Save(options))) return false;
+
+    if (affectsFieldSecurity) await this.reconcileFieldPermissions(this.EntityID);
+    return true;
   }
 
   override async Delete(options: EntityDeleteOptions): Promise<boolean> {
+    // Capture before the delete — afterwards this record's EntityID is gone.
+    const targetEntityID = this.EntityID;
+
     const success = await super.Delete(options);
 
     // simply queue up the entity ID if the delete worked
-    if (success) MJEntityPermissionEntityServer.AddToQueue(this.EntityID);
+    if (success) {
+      MJEntityPermissionEntityServer.AddToQueue(targetEntityID);
+      await this.reconcileFieldPermissions(targetEntityID);
+    }
 
     return success;
   }
+
+  /**
+   * Whether this save can change which field-permission rows should exist.
+   *
+   * Only the access flags and the role matter — the field-permission delta keys off a role's
+   * effective entity-level access, so an edit to an RLS filter changes nothing here. A new
+   * record always counts, since it may be the grant that brings a role into scope.
+   */
+  protected affectsFieldPermissionRows(): boolean {
+    if (!this.IsSaved) return true;
+
+    return ['Type', 'CanRead', 'CanUpdate', 'CanCreate', 'RoleID'].some(
+      (fieldName) => this.GetFieldByName(fieldName)?.Dirty === true
+    );
+  }
+
+  /**
+   * Reconciles the target entity's field-permission rows, when that entity has field security
+   * switched on. The flag check keeps this free for the overwhelming majority of permission
+   * edits, which are on entities that never opted in.
+   *
+   * Runs AFTER the permission write commits, and failures are logged rather than thrown: the
+   * save that triggered it has already succeeded, so reporting it as failed would be wrong.
+   * Missing rows fail closed until the next reconciliation.
+   */
+  protected async reconcileFieldPermissions(entityID: string): Promise<void> {
+    if (!entityID) return;
+
+    const provider = this.ProviderToUse as unknown as IMetadataProvider;
+    const entityInfo = provider?.Entities?.find((e) => UUIDsEqual(e.ID, entityID));
+    if (!entityInfo?.EnableFieldLevelSecurity) return;
+
+    await ReconcileFieldPermissionsQuietly(entityInfo, provider, this.ContextCurrentUser);
+  }
 }