@mj-biz-apps/orders-core-entities-server 5.20.0 → 5.21.0

package/dist/AccessOverride.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Approved exceptions to payment-gated access (bizapps-orders#268).
+ *
+ * An `EntitlementAccessOverride` lets one order's grants stand Active past the rule that would
+ * suspend them: `WaivePaymentHold` past the hold on a new purchase awaiting its first payment,
+ * `DeferCutoff` past the renewal cutoff. It is a row, with a reason, a last day and a Tasks approval,
+ * so an exception is on the record and the payment re-decision honours it instead of reversing it.
+ *
+ * THREE ENTRY POINTS:
+ *   · {@link RequestAccessOverride} — checks the requester's authorization for that override type,
+ *     writes the Requested row, and raises its approval task.
+ *   · {@link RecordAccessOverrideDecision} — the in-app decision. Records the Tasks decision, then
+ *     applies it.
+ *   · {@link ApplyAccessOverrideDecision} — reads the task's outcome and moves the override to
+ *     Approved, Rejected or Withdrawn. Idempotent: an override that is no longer Requested is left
+ *     alone. The in-app decision and the task type's hook Action (a decision made in the Tasks inbox)
+ *     both call it, so either path lands the same result, once.
+ *
+ * WHO MAY APPROVE is not settled (bizapps-orders#360). The approval task is raised unassigned, and a
+ * decision takes effect only through that task; who may record one is left to #360.
+ *
+ * FAILS CLOSED. Without the authorization rows in metadata nobody may request — an exception to a
+ * payment rule is not something to hand out because a sync has not run.
+ *
+ * CONNECTS TO:
+ *   RULE:     ./EntitlementBehavior.ts (ApplyAccessOverrides, AccessOverrideCanApply)
+ *   ENFORCE:  ./PaymentGatedAccess.ts (ReconcilePaymentGatedGrants, the nightly expiry)
+ *   TASKS:    @mj-biz-apps/tasks-core TaskOrchestrationService (CreateApprovalRequest, RecordDecision)
+ *   CALLERS:  RequestAccessOverrideOperation, RecordAccessOverrideDecisionOperation,
+ *             packages/Server/src/custom/apply-access-override-decision.action.ts
+ */
+import { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import { ACCESS_OVERRIDE_AUTH } from '@mj-biz-apps/orders-entities';
+import { type AccessOverrideType } from './EntitlementBehavior.js';
+export { ACCESS_OVERRIDE_AUTH };
+/** The TaskType the approval is raised under. Its hook Actions apply a decision made in the Tasks inbox. */
+export declare const ACCESS_OVERRIDE_TASK_TYPE_CODE = "ORDERS_ACCESS_OVERRIDE";
+/**
+ * Whether `user` may request an override of this type, through its own authorization or the parent.
+ * Throws when the authorization rows are not in metadata: see FAILS CLOSED above.
+ */
+export declare function UserMayRequestAccessOverride(type: AccessOverrideType, user: UserInfo, provider: IMetadataProvider): boolean;
+export interface RequestAccessOverrideInput {
+    OrderHeaderID: string;
+    OverrideType: AccessOverrideType;
+    Reason: string;
+    /** Last day the override holds, `YYYY-MM-DD`, inclusive. Required; not before today. */
+    EffectiveThrough: string;
+}
+export interface RequestAccessOverrideOutput {
+    Success: boolean;
+    Message?: string;
+    AccessOverrideID?: string;
+    ApprovalTaskID?: string;
+}
+/**
+ * Record a request for an access override and raise its approval task. Nothing about access changes
+ * until the request is approved.
+ *
+ * Logical refusals come back as `Success: false` with the reason; only faults throw.
+ */
+export declare function RequestAccessOverride(input: RequestAccessOverrideInput, provider: IMetadataProvider, user: UserInfo): Promise<RequestAccessOverrideOutput>;
+export interface RecordAccessOverrideDecisionInput {
+    AccessOverrideID: string;
+    /** A Tasks decision outcome code: `Approved`, `ApprovedWithConditions` or `Rejected`. */
+    Outcome: string;
+    Notes?: string;
+}
+export interface AccessOverrideDecisionOutput {
+    Success: boolean;
+    Message?: string;
+    /** The override's status after the call. */
+    Status?: string;
+    /** Grants whose status changed because the override was approved. */
+    GrantsChanged?: number;
+}
+/** Approve or reject an access override from the app: record the Tasks decision, then apply it. */
+export declare function RecordAccessOverrideDecision(input: RecordAccessOverrideDecisionInput, provider: IMetadataProvider, user: UserInfo): Promise<AccessOverrideDecisionOutput>;
+/**
+ * Bring an override in line with its approval task's outcome. `user` is whoever decided the task.
+ *
+ *   Completed with an approving decision   → Approved, and the order's grants re-decided at once
+ *   Cancelled with a Rejected decision      → Rejected
+ *   closed any other way                    → Withdrawn
+ *   still open, or blocked                  → unchanged
+ *
+ * A second call after the first has applied it changes nothing.
+ */
+export declare function ApplyAccessOverrideDecision(taskID: string, provider: IMetadataProvider, user: UserInfo): Promise<AccessOverrideDecisionOutput>;
+//# sourceMappingURL=AccessOverride.d.ts.map

package/dist/AccessOverride.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessOverride.d.ts","sourceRoot":"","sources":["../src/AccessOverride.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAGH,iBAAiB,EAIjB,QAAQ,EACX,MAAM,sBAAsB,CAAC;AAe9B,OAAO,EACH,oBAAoB,EAGvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAKH,KAAK,kBAAkB,EAE1B,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAQhC,4GAA4G;AAC5G,eAAO,MAAM,8BAA8B,2BAA2B,CAAC;AAevE;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAW3H;AAID,MAAM,WAAW,0BAA0B;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,kBAAkB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,gBAAgB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACvC,KAAK,EAAE,0BAA0B,EACjC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,GACf,OAAO,CAAC,2BAA2B,CAAC,CAuFtC;AAID,MAAM,WAAW,iCAAiC;IAC9C,gBAAgB,EAAE,MAAM,CAAC;IACzB,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,4BAA4B;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,mGAAmG;AACnG,wBAAsB,4BAA4B,CAC9C,KAAK,EAAE,iCAAiC,EACxC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,GACf,OAAO,CAAC,4BAA4B,CAAC,CAsBvC;AAED;;;;;;;;;GASG;AACH,wBAAsB,2BAA2B,CAC7C,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,GACf,OAAO,CAAC,4BAA4B,CAAC,CA2CvC"}

package/dist/AccessOverride.js

@@ -0,0 +1,331 @@
+/**
+ * Approved exceptions to payment-gated access (bizapps-orders#268).
+ *
+ * An `EntitlementAccessOverride` lets one order's grants stand Active past the rule that would
+ * suspend them: `WaivePaymentHold` past the hold on a new purchase awaiting its first payment,
+ * `DeferCutoff` past the renewal cutoff. It is a row, with a reason, a last day and a Tasks approval,
+ * so an exception is on the record and the payment re-decision honours it instead of reversing it.
+ *
+ * THREE ENTRY POINTS:
+ *   · {@link RequestAccessOverride} — checks the requester's authorization for that override type,
+ *     writes the Requested row, and raises its approval task.
+ *   · {@link RecordAccessOverrideDecision} — the in-app decision. Records the Tasks decision, then
+ *     applies it.
+ *   · {@link ApplyAccessOverrideDecision} — reads the task's outcome and moves the override to
+ *     Approved, Rejected or Withdrawn. Idempotent: an override that is no longer Requested is left
+ *     alone. The in-app decision and the task type's hook Action (a decision made in the Tasks inbox)
+ *     both call it, so either path lands the same result, once.
+ *
+ * WHO MAY APPROVE is not settled (bizapps-orders#360). The approval task is raised unassigned, and a
+ * decision takes effect only through that task; who may record one is left to #360.
+ *
+ * FAILS CLOSED. Without the authorization rows in metadata nobody may request — an exception to a
+ * payment rule is not something to hand out because a sync has not run.
+ *
+ * CONNECTS TO:
+ *   RULE:     ./EntitlementBehavior.ts (ApplyAccessOverrides, AccessOverrideCanApply)
+ *   ENFORCE:  ./PaymentGatedAccess.ts (ReconcilePaymentGatedGrants, the nightly expiry)
+ *   TASKS:    @mj-biz-apps/tasks-core TaskOrchestrationService (CreateApprovalRequest, RecordDecision)
+ *   CALLERS:  RequestAccessOverrideOperation, RecordAccessOverrideDecisionOperation,
+ *             packages/Server/src/custom/apply-access-override-decision.action.ts
+ */
+import { AuthorizationEvaluator, LogError, RunView, } from '@memberjunction/core';
+import { IsApprovalOutcome, IsTaskDecisionOutcomeCode, TaskOrchestrationService, } from '@mj-biz-apps/tasks-core';
+import { LoadGeneratedEntities as LoadTasksEntities, } from '@mj-biz-apps/tasks-entities';
+import { ACCESS_OVERRIDE_AUTH, } from '@mj-biz-apps/orders-entities';
+import { ACCESS_OVERRIDE_LIFTS, AccessOverrideCanApply, PAYMENT_GATED_TIMINGS, ResolveAccessOverrideOutcome, } from './EntitlementBehavior.js';
+import { ORDER_HEADER_ENTITY, ORDER_LINE_ENTITY } from './entity-names.js';
+import { ACCESS_OVERRIDE_ENTITY, BusinessDay, ReconcilePaymentGatedGrants } from './PaymentGatedAccess.js';
+import { RequireDate, RequireUUID } from './sql-guards.js';
+export { ACCESS_OVERRIDE_AUTH };
+// The Tasks entity subclasses must be registered before a task is created: without them the
+// ClassFactory hands back a plain BaseEntity, the field setters do nothing, and the save fails on
+// "Name cannot be null". A host running the Tasks app registers them itself; a process that only
+// loads Orders (an integration run, a job) would not.
+LoadTasksEntities();
+/** The TaskType the approval is raised under. Its hook Actions apply a decision made in the Tasks inbox. */
+export const ACCESS_OVERRIDE_TASK_TYPE_CODE = 'ORDERS_ACCESS_OVERRIDE';
+const ENTITLEMENT_GRANT_ENTITY = 'MJ_BizApps_Orders: Entitlement Grants';
+const TASKS_ENTITY = 'MJ_BizApps_Tasks: Tasks';
+const TASK_TYPES_ENTITY = 'MJ_BizApps_Tasks: Task Types';
+const TASK_LINKS_ENTITY = 'MJ_BizApps_Tasks: Task Links';
+const TASK_DECISIONS_ENTITY = 'MJ_BizApps_Tasks: Task Decisions';
+const TASK_DECISION_OUTCOMES_ENTITY = 'MJ_BizApps_Tasks: Task Decision Outcomes';
+const REASON_MAX = 1000;
+const OVERRIDE_TYPES = Object.keys(ACCESS_OVERRIDE_LIFTS);
+const gatedTimings = PAYMENT_GATED_TIMINGS.map((t) => `'${t}'`).join(',');
+// ─── authorization ─────────────────────────────────────────────────────────────
+/**
+ * Whether `user` may request an override of this type, through its own authorization or the parent.
+ * Throws when the authorization rows are not in metadata: see FAILS CLOSED above.
+ */
+export function UserMayRequestAccessOverride(type, user, provider) {
+    const name = ACCESS_OVERRIDE_AUTH[type];
+    const auths = provider.Authorizations ?? [];
+    const auth = auths.find((a) => a.Name === name);
+    if (!auth) {
+        throw new Error(`Authorization '${name}' is not in metadata. Access overrides are refused until the ` +
+            `${ACCESS_OVERRIDE_AUTH.Parent} authorizations are installed and granted to roles.`);
+    }
+    return new AuthorizationEvaluator().UserCanExecuteWithAncestors(auth, user, auths);
+}
+/**
+ * Record a request for an access override and raise its approval task. Nothing about access changes
+ * until the request is approved.
+ *
+ * Logical refusals come back as `Success: false` with the reason; only faults throw.
+ */
+export async function RequestAccessOverride(input, provider, user) {
+    RequireUUID(input.OrderHeaderID, 'OrderHeaderID');
+    if (!OVERRIDE_TYPES.includes(input.OverrideType)) {
+        return { Success: false, Message: `OverrideType must be one of ${OVERRIDE_TYPES.join(', ')}; got '${input.OverrideType}'.` };
+    }
+    if (!UserMayRequestAccessOverride(input.OverrideType, user, provider)) {
+        return { Success: false, Message: `Requesting a ${input.OverrideType} override requires the ${ACCESS_OVERRIDE_AUTH[input.OverrideType]} authorization.` };
+    }
+    const reason = (input.Reason ?? '').trim();
+    if (!reason)
+        return { Success: false, Message: 'An access override must state a reason.' };
+    if (reason.length > REASON_MAX)
+        return { Success: false, Message: `Reason is limited to ${REASON_MAX} characters.` };
+    if (!input.EffectiveThrough)
+        return { Success: false, Message: 'An access override must state the last day it holds (EffectiveThrough).' };
+    const through = RequireDate(input.EffectiveThrough, 'EffectiveThrough');
+    const order = await provider.GetEntityObject(ORDER_HEADER_ENTITY, user);
+    if (!(await order.Load(input.OrderHeaderID))) {
+        return { Success: false, Message: `No order found with ID '${input.OrderHeaderID}'.` };
+    }
+    const today = await BusinessDay(provider, user);
+    if (through < today)
+        return { Success: false, Message: `EffectiveThrough ${through} is before today (${today}).` };
+    if (!AccessOverrideCanApply(input.OverrideType, await gatedGrantsOnOrder(input.OrderHeaderID, provider, user))) {
+        const what = input.OverrideType === 'DeferCutoff' ? 'an OnFirstPayment renewal' : 'a grant held for payment';
+        return { Success: false, Message: `Order ${order.OrderNumber} has no ${what}, so a ${input.OverrideType} override would change nothing.` };
+    }
+    const open = await findOpenOverride(input.OrderHeaderID, input.OverrideType, provider, user);
+    if (open) {
+        return {
+            Success: false,
+            AccessOverrideID: open.ID,
+            Message: `This order already has a ${open.Status} ${input.OverrideType} override; it must close before another is requested.`,
+        };
+    }
+    const taskTypeID = await resolveTaskTypeID(provider, user);
+    const db = provider;
+    await db.BeginTransaction();
+    try {
+        const override = await provider.GetEntityObject(ACCESS_OVERRIDE_ENTITY, user);
+        override.NewRecord();
+        override.OrderHeaderID = input.OrderHeaderID;
+        override.OverrideType = input.OverrideType;
+        override.Reason = reason;
+        override.EffectiveThrough = new Date(`${through}T00:00:00Z`);
+        override.Status = 'Requested';
+        override.RequestedByUserID = user.ID;
+        if (!(await override.Save())) {
+            throw new Error(`Failed to save the access override: ${override.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+        }
+        const overrideEntity = provider.EntityByName(ACCESS_OVERRIDE_ENTITY);
+        if (!overrideEntity)
+            throw new Error(`Entity metadata for '${ACCESS_OVERRIDE_ENTITY}' is missing.`);
+        const label = input.OverrideType === 'WaivePaymentHold' ? 'waive the payment hold' : 'defer the renewal cutoff';
+        // Unassigned: who approves is bizapps-orders#360.
+        await new TaskOrchestrationService().CreateApprovalRequest({
+            Name: `Approve access override on order ${order.OrderNumber}: ${label} through ${through}`,
+            TypeID: taskTypeID,
+            Description: `Requested by ${user.Name ?? user.Email}. Reason: ${reason}`,
+            Priority: 'High',
+            LinkEntityID: overrideEntity.ID,
+            LinkRecordID: override.ID,
+        }, user);
+        // CreateApprovalRequest logs rather than throws on a failed link; without the link the
+        // decision could never be traced back here, so its absence is a fault.
+        const taskID = await findLinkedTaskID(overrideEntity.ID, override.ID, provider, user);
+        if (!taskID)
+            throw new Error('The approval task was created but its link to the access override did not persist.');
+        override.ApprovalTaskID = taskID;
+        override.ApprovalTaskRaisedAt = new Date();
+        if (!(await override.Save())) {
+            throw new Error(`Failed to stamp the approval task on the access override: ${override.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+        }
+        await db.CommitTransaction();
+        return {
+            Success: true,
+            AccessOverrideID: override.ID,
+            ApprovalTaskID: taskID,
+            Message: 'Access override requested; it takes effect once its approval task is approved.',
+        };
+    }
+    catch (err) {
+        await rollback(db, 'access override request');
+        throw err;
+    }
+}
+/** Approve or reject an access override from the app: record the Tasks decision, then apply it. */
+export async function RecordAccessOverrideDecision(input, provider, user) {
+    RequireUUID(input.AccessOverrideID, 'AccessOverrideID');
+    if (!IsTaskDecisionOutcomeCode(input.Outcome)) {
+        return { Success: false, Message: `'${input.Outcome}' is not a decision outcome.` };
+    }
+    const outcome = input.Outcome;
+    const override = await provider.GetEntityObject(ACCESS_OVERRIDE_ENTITY, user);
+    if (!(await override.Load(input.AccessOverrideID))) {
+        return { Success: false, Message: `No access override found with ID '${input.AccessOverrideID}'.` };
+    }
+    if (override.Status !== 'Requested') {
+        return { Success: false, Status: override.Status, Message: `The access override is already ${override.Status}.` };
+    }
+    if (!override.ApprovalTaskID) {
+        return { Success: false, Status: override.Status, Message: 'The access override has no approval task to decide.' };
+    }
+    await new TaskOrchestrationService().RecordDecision({ TaskID: override.ApprovalTaskID, OutcomeCode: outcome, Notes: input.Notes }, user);
+    return ApplyAccessOverrideDecision(override.ApprovalTaskID, provider, user);
+}
+/**
+ * Bring an override in line with its approval task's outcome. `user` is whoever decided the task.
+ *
+ *   Completed with an approving decision   → Approved, and the order's grants re-decided at once
+ *   Cancelled with a Rejected decision      → Rejected
+ *   closed any other way                    → Withdrawn
+ *   still open, or blocked                  → unchanged
+ *
+ * A second call after the first has applied it changes nothing.
+ */
+export async function ApplyAccessOverrideDecision(taskID, provider, user) {
+    RequireUUID(taskID, 'TaskID');
+    const rv = new RunView(provider);
+    const found = await rv.RunView({ EntityName: ACCESS_OVERRIDE_ENTITY, ExtraFilter: `ApprovalTaskID = '${taskID}'`, ResultType: 'entity_object', BypassCache: true }, user);
+    if (!found.Success)
+        throw new Error(`Could not read access overrides: ${found.ErrorMessage}`);
+    const override = found.Results?.[0];
+    if (!override)
+        return { Success: false, Message: `Task ${taskID} is not an access override approval.` };
+    if (override.Status !== 'Requested')
+        return { Success: true, Status: override.Status, Message: `Already ${override.Status}.` };
+    const task = await provider.GetEntityObject(TASKS_ENTITY, user);
+    if (!(await task.Load(taskID)))
+        throw new Error(`Approval task ${taskID} not found.`);
+    const decision = await latestTerminalDecision(taskID, provider, user);
+    const outcome = ResolveAccessOverrideOutcome({ TaskStatus: task.Status, Decision: decision });
+    if (!outcome)
+        return { Success: true, Status: override.Status, Message: `The approval task is ${task.Status}; nothing to apply yet.` };
+    const applied = outcome === 'Approved' || outcome === 'Rejected';
+    const db = provider;
+    await db.BeginTransaction();
+    try {
+        override.Status = outcome;
+        override.DecidedAt = new Date();
+        override.DecisionNotes = applied
+            ? (decision?.Notes ?? null)
+            : `The approval task was ${task.Status} without a matching decision.`;
+        if (applied)
+            override.DecidedByUserID = user.ID;
+        if (!(await override.Save())) {
+            throw new Error(`Failed to record the decision on access override ${override.ID}: ${override.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+        }
+        const changes = outcome === 'Approved' ? await ReconcilePaymentGatedGrants([override.OrderHeaderID], provider, user) : [];
+        await db.CommitTransaction();
+        return {
+            Success: true,
+            Status: override.Status,
+            GrantsChanged: changes.length,
+            Message: `Access override ${override.Status}${changes.length ? `; ${changes.length} grant(s) changed` : ''}.`,
+        };
+    }
+    catch (err) {
+        await rollback(db, `access override decision on task ${taskID}`);
+        throw err;
+    }
+}
+// ─── helpers ───────────────────────────────────────────────────────────────────
+async function findOpenOverride(orderID, type, provider, user) {
+    const rv = new RunView(provider);
+    const res = await rv.RunView({
+        EntityName: ACCESS_OVERRIDE_ENTITY,
+        ExtraFilter: `OrderHeaderID = '${RequireUUID(orderID, 'OrderHeaderID')}' AND OverrideType = '${type}' ` +
+            `AND Status IN ('Requested','Approved')`,
+        Fields: ['ID', 'Status'],
+        ResultType: 'simple',
+        BypassCache: true,
+    }, user);
+    if (!res.Success)
+        throw new Error(`Could not read access overrides: ${res.ErrorMessage}`);
+    return res.Results?.[0] ?? null;
+}
+async function resolveTaskTypeID(provider, user) {
+    const rv = new RunView(provider);
+    const res = await rv.RunView({ EntityName: TASK_TYPES_ENTITY, ExtraFilter: `Code = '${ACCESS_OVERRIDE_TASK_TYPE_CODE}'`, MaxRows: 1, ResultType: 'simple', BypassCache: true }, user);
+    const type = res.Results?.[0];
+    if (!res.Success || !type) {
+        throw new Error(`TaskType '${ACCESS_OVERRIDE_TASK_TYPE_CODE}' not found; the Orders task-type metadata has not been installed.`);
+    }
+    return type.ID;
+}
+async function findLinkedTaskID(entityID, recordID, provider, user) {
+    const rv = new RunView(provider);
+    const res = await rv.RunView({
+        EntityName: TASK_LINKS_ENTITY,
+        ExtraFilter: `EntityID = '${RequireUUID(entityID, 'EntityID')}' AND RecordID = '${RequireUUID(recordID, 'RecordID')}'`,
+        OrderBy: '__mj_CreatedAt DESC',
+        ResultType: 'simple',
+        BypassCache: true,
+    }, user);
+    return res.Results?.[0]?.TaskID ?? null;
+}
+/** The most recent terminal decision on the task, and whether its outcome approves. */
+async function latestTerminalDecision(taskID, provider, user) {
+    const rv = new RunView(provider);
+    const outcomes = await rv.RunView({ EntityName: TASK_DECISION_OUTCOMES_ENTITY, ExtraFilter: 'IsTerminal = 1', ResultType: 'simple', BypassCache: true }, user);
+    if (!outcomes.Success)
+        throw new Error(`Could not read task decision outcomes: ${outcomes.ErrorMessage}`);
+    const codeByID = new Map((outcomes.Results ?? []).map((o) => [o.ID.toLowerCase(), o.Code]));
+    const decisions = await rv.RunView({ EntityName: TASK_DECISIONS_ENTITY, ExtraFilter: `TaskID = '${taskID}'`, OrderBy: 'DecidedAt DESC', ResultType: 'simple', BypassCache: true }, user);
+    if (!decisions.Success)
+        throw new Error(`Could not read task decisions: ${decisions.ErrorMessage}`);
+    for (const d of decisions.Results ?? []) {
+        const code = codeByID.get(d.OutcomeID.toLowerCase());
+        if (IsTaskDecisionOutcomeCode(code))
+            return { IsApproval: IsApprovalOutcome(code), Notes: d.DecisionNotes ?? null };
+    }
+    return null;
+}
+/** The payment-gated grants in force or suspended on this order, with whether each is on a renewal line. */
+async function gatedGrantsOnOrder(orderID, provider, user) {
+    const rv = new RunView(provider);
+    const lines = await rv.RunView({
+        EntityName: ORDER_LINE_ENTITY,
+        ExtraFilter: `OrderHeaderID = '${RequireUUID(orderID, 'OrderHeaderID')}'`,
+        Fields: ['ID', 'RenewsSubscriptionID'],
+        ResultType: 'simple',
+        BypassCache: true,
+    }, user);
+    if (!lines.Success)
+        throw new Error(`Could not read the lines of order ${orderID}: ${lines.ErrorMessage}`);
+    const lineRows = lines.Results ?? [];
+    if (!lineRows.length)
+        return [];
+    const renewal = new Map(lineRows.map((l) => [l.ID.toLowerCase(), !!l.RenewsSubscriptionID]));
+    const grants = await rv.RunView({
+        EntityName: ENTITLEMENT_GRANT_ENTITY,
+        ExtraFilter: `OrderLineID IN (${lineRows.map((l) => `'${RequireUUID(l.ID, 'OrderLineID')}'`).join(',')}) ` +
+            `AND GrantTimingApplied IN (${gatedTimings}) AND Status IN ('Active','Suspended')`,
+        Fields: ['OrderLineID', 'GrantTimingApplied'],
+        ResultType: 'simple',
+        BypassCache: true,
+    }, user);
+    if (!grants.Success)
+        throw new Error(`Could not read the grants on order ${orderID}: ${grants.ErrorMessage}`);
+    return (grants.Results ?? []).map((g) => ({
+        Timing: g.GrantTimingApplied,
+        IsRenewal: renewal.get(g.OrderLineID.toLowerCase()) ?? false,
+    }));
+}
+async function rollback(db, what) {
+    try {
+        await db.RollbackTransaction();
+    }
+    catch (err) {
+        LogError(`Rollback failed after ${what} error: ${err}`);
+    }
+}
+//# sourceMappingURL=AccessOverride.js.map

package/dist/AccessOverride.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessOverride.js","sourceRoot":"","sources":["../src/AccessOverride.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EACH,sBAAsB,EAItB,QAAQ,EACR,OAAO,GAEV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACH,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,GAE3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACH,qBAAqB,IAAI,iBAAiB,GAM7C,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACH,oBAAoB,GAGvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,GAG/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAC3G,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE3D,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC,4FAA4F;AAC5F,kGAAkG;AAClG,iGAAiG;AACjG,sDAAsD;AACtD,iBAAiB,EAAE,CAAC;AAEpB,4GAA4G;AAC5G,MAAM,CAAC,MAAM,8BAA8B,GAAG,wBAAwB,CAAC;AAEvE,MAAM,wBAAwB,GAAG,uCAAuC,CAAC;AACzE,MAAM,YAAY,GAAG,yBAAyB,CAAC;AAC/C,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;AACzD,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;AACzD,MAAM,qBAAqB,GAAG,kCAAkC,CAAC;AACjE,MAAM,6BAA6B,GAAG,0CAA0C,CAAC;AACjF,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAyB,CAAC;AAClF,MAAM,YAAY,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE1E,kFAAkF;AAElF;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAwB,EAAE,IAAc,EAAE,QAA2B;IAC9G,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CACX,kBAAkB,IAAI,+DAA+D;YACjF,GAAG,oBAAoB,CAAC,MAAM,qDAAqD,CAC1F,CAAC;IACN,CAAC;IACD,OAAO,IAAI,sBAAsB,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AACvF,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACvC,KAAiC,EACjC,QAA2B,EAC3B,IAAc;IAEd,WAAW,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAClD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,+BAA+B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;IACjI,CAAC;IACD,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,KAAK,CAAC,YAAY,0BAA0B,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC;IAC9J,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IAC3F,IAAI,MAAM,CAAC,MAAM,GAAG,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,UAAU,cAAc,EAAE,CAAC;IACrH,IAAI,CAAC,KAAK,CAAC,gBAAgB;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yEAAyE,EAAE,CAAC;IAC3I,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAExE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAmC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IAC1G,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,2BAA2B,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,OAAO,GAAG,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,OAAO,qBAAqB,KAAK,IAAI,EAAE,CAAC;IAEnH,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,kBAAkB,CAAC,KAAK,CAAC,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,KAAK,aAAa,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,0BAA0B,CAAC;QAC7G,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,KAAK,CAAC,WAAW,WAAW,IAAI,UAAU,KAAK,CAAC,YAAY,iCAAiC,EAAE,CAAC;IAC/I,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7F,IAAI,IAAI,EAAE,CAAC;QACP,OAAO;YACH,OAAO,EAAE,KAAK;YACd,gBAAgB,EAAE,IAAI,CAAC,EAAE;YACzB,OAAO,EAAE,4BAA4B,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,YAAY,uDAAuD;SAChI,CAAC;IACN,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,EAAE,GAAG,QAA2C,CAAC;IACvD,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;IAC5B,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAiD,sBAAsB,EAAE,IAAI,CAAC,CAAC;QAC9H,QAAQ,CAAC,SAAS,EAAE,CAAC;QACrB,QAAQ,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QAC7C,QAAQ,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QAC3C,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;QACzB,QAAQ,CAAC,gBAAgB,GAAG,IAAI,IAAI,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC;QAC7D,QAAQ,CAAC,MAAM,GAAG,WAAW,CAAC;QAC9B,QAAQ,CAAC,iBAAiB,GAAG,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;QACxH,CAAC;QAED,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC;QACrE,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,sBAAsB,eAAe,CAAC,CAAC;QACpG,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,KAAK,kBAAkB,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,0BAA0B,CAAC;QAChH,kDAAkD;QAClD,MAAM,IAAI,wBAAwB,EAAE,CAAC,qBAAqB,CACtD;YACI,IAAI,EAAE,oCAAoC,KAAK,CAAC,WAAW,KAAK,KAAK,YAAY,OAAO,EAAE;YAC1F,MAAM,EAAE,UAAU;YAClB,WAAW,EAAE,gBAAgB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,aAAa,MAAM,EAAE;YACzE,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,cAAc,CAAC,EAAE;YAC/B,YAAY,EAAE,QAAQ,CAAC,EAAE;SAC5B,EACD,IAAI,CACP,CAAC;QACF,uFAAuF;QACvF,uEAAuE;QACvE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;QAEnH,QAAQ,CAAC,cAAc,GAAG,MAAM,CAAC;QACjC,QAAQ,CAAC,oBAAoB,GAAG,IAAI,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,6DAA6D,QAAQ,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;QAC9I,CAAC;QACD,MAAM,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC7B,OAAO;YACH,OAAO,EAAE,IAAI;YACb,gBAAgB,EAAE,QAAQ,CAAC,EAAE;YAC7B,cAAc,EAAE,MAAM;YACtB,OAAO,EAAE,gFAAgF;SAC5F,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,QAAQ,CAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAC9C,MAAM,GAAG,CAAC;IACd,CAAC;AACL,CAAC;AAoBD,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAC9C,KAAwC,EACxC,QAA2B,EAC3B,IAAc;IAEd,WAAW,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IACxD,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,KAAK,CAAC,OAAO,8BAA8B,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,OAAO,GAA4B,KAAK,CAAC,OAAO,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAiD,sBAAsB,EAAE,IAAI,CAAC,CAAC;IAC9H,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,qCAAqC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;IACxG,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,kCAAkC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;IACtH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC3B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACvH,CAAC;IAED,MAAM,IAAI,wBAAwB,EAAE,CAAC,cAAc,CAC/C,EAAE,MAAM,EAAE,QAAQ,CAAC,cAAc,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAC7E,IAAI,CACP,CAAC;IACF,OAAO,2BAA2B,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC7C,MAAc,EACd,QAA2B,EAC3B,IAAc;IAEd,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAuC,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAC1B,EAAE,UAAU,EAAE,sBAAsB,EAAE,WAAW,EAAE,qBAAqB,MAAM,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,EACnI,IAAI,CACP,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,MAAM,sCAAsC,EAAE,CAAC;IACxG,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;IAE/H,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,CAA2B,YAAY,EAAE,IAAI,CAAC,CAAC;IAC1F,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,aAAa,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,4BAA4B,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,wBAAwB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC;IACvI,MAAM,OAAO,GAAG,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,UAAU,CAAC;IAEjE,MAAM,EAAE,GAAG,QAA2C,CAAC;IACvD,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;IAC5B,IAAI,CAAC;QACD,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC;QAC1B,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAChC,QAAQ,CAAC,aAAa,GAAG,OAAO;YAC5B,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;YAC3B,CAAC,CAAC,yBAAyB,IAAI,CAAC,MAAM,+BAA+B,CAAC;QAC1E,IAAI,OAAO;YAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,oDAAoD,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;QACrJ,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,2BAA2B,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1H,MAAM,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC7B,OAAO;YACH,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,OAAO,EAAE,mBAAmB,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,mBAAmB,CAAC,CAAC,CAAC,EAAE,GAAG;SAChH,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,QAAQ,CAAC,EAAE,EAAE,oCAAoC,MAAM,EAAE,CAAC,CAAC;QACjE,MAAM,GAAG,CAAC;IACd,CAAC;AACL,CAAC;AAED,kFAAkF;AAElF,KAAK,UAAU,gBAAgB,CAC3B,OAAe,EACf,IAAwB,EACxB,QAA2B,EAC3B,IAAc;IAEd,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAuC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CACxB;QACI,UAAU,EAAE,sBAAsB;QAClC,WAAW,EACP,oBAAoB,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,yBAAyB,IAAI,IAAI;YAC1F,wCAAwC;QAC5C,MAAM,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxB,UAAU,EAAE,QAAQ;QACpB,WAAW,EAAE,IAAI;KACpB,EACD,IAAI,CACP,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1F,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAA2B,EAAE,IAAc;IACxE,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAuC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CACxB,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,WAAW,8BAA8B,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,EACjJ,IAAI,CACP,CAAC;IACF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,aAAa,8BAA8B,oEAAoE,CAAC,CAAC;IACrI,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,QAAgB,EAAE,QAA2B,EAAE,IAAc;IAC3G,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAuC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CACxB;QACI,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,eAAe,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,qBAAqB,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,GAAG;QACtH,OAAO,EAAE,qBAAqB;QAC9B,UAAU,EAAE,QAAQ;QACpB,WAAW,EAAE,IAAI;KACpB,EACD,IAAI,CACP,CAAC;IACF,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;AAC5C,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,sBAAsB,CACjC,MAAc,EACd,QAA2B,EAC3B,IAAc;IAEd,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAuC,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B,EAAE,UAAU,EAAE,6BAA6B,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,EACrH,IAAI,CACP,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1G,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE5F,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAC9B,EAAE,UAAU,EAAE,qBAAqB,EAAE,WAAW,EAAE,aAAa,MAAM,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,EAC9I,IAAI,CACP,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;IACpG,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QACrD,IAAI,yBAAyB,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;IACxH,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,kBAAkB,CAC7B,OAAe,EACf,QAA2B,EAC3B,IAAc;IAEd,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAuC,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAC1B;QACI,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,oBAAoB,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,GAAG;QACzE,MAAM,EAAE,CAAC,IAAI,EAAE,sBAAsB,CAAC;QACtC,UAAU,EAAE,QAAQ;QACpB,WAAW,EAAE,IAAI;KACpB,EACD,IAAI,CACP,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3G,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAE7F,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B;QACI,UAAU,EAAE,wBAAwB;QACpC,WAAW,EACP,mBAAmB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;YAC7F,8BAA8B,YAAY,wCAAwC;QACtF,MAAM,EAAE,CAAC,aAAa,EAAE,oBAAoB,CAAC;QAC7C,UAAU,EAAE,QAAQ;QACpB,WAAW,EAAE,IAAI;KACpB,EACD,IAAI,CACP,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9G,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,CAAC,kBAAkB;QAC5B,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK;KAC/D,CAAC,CAAC,CAAC;AACR,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,EAAwB,EAAE,IAAY;IAC1D,IAAI,CAAC;QACD,MAAM,EAAE,CAAC,mBAAmB,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,QAAQ,CAAC,yBAAyB,IAAI,WAAW,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACL,CAAC"}

package/dist/AccessOverrideOperations.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Orders.RequestAccessOverride and Orders.RecordAccessOverrideDecision (bizapps-orders#268).
+ *
+ * Thin: the rules, the authorization checks and the writes are in `AccessOverride.ts`. Logical
+ * refusals come back as `Success: false` with the reason; only faults throw.
+ */
+import { BaseRemotableOperation, IMetadataProvider, UserInfo } from '@memberjunction/core';
+import { type AccessOverrideDecisionOutput, type RecordAccessOverrideDecisionInput, type RequestAccessOverrideInput, type RequestAccessOverrideOutput } from './AccessOverride.js';
+export declare class RequestAccessOverrideOperation extends BaseRemotableOperation<RequestAccessOverrideInput, RequestAccessOverrideOutput> {
+    OperationKey: string;
+    protected InternalExecute(input: RequestAccessOverrideInput, provider: IMetadataProvider, user: UserInfo): Promise<RequestAccessOverrideOutput>;
+}
+export declare class RecordAccessOverrideDecisionOperation extends BaseRemotableOperation<RecordAccessOverrideDecisionInput, AccessOverrideDecisionOutput> {
+    OperationKey: string;
+    protected InternalExecute(input: RecordAccessOverrideDecisionInput, provider: IMetadataProvider, user: UserInfo): Promise<AccessOverrideDecisionOutput>;
+}
+/** Tree-shaking anchor — call from the server bootstrap so @RegisterClass is retained. */
+export declare function LoadAccessOverrideOperations(): void;
+//# sourceMappingURL=AccessOverrideOperations.d.ts.map

package/dist/AccessOverrideOperations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessOverrideOperations.d.ts","sourceRoot":"","sources":["../src/AccessOverrideOperations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAE3F,OAAO,EAGH,KAAK,4BAA4B,EACjC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EACnC,MAAM,qBAAqB,CAAC;AAE7B,qBACa,8BAA+B,SAAQ,sBAAsB,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IACxH,YAAY,SAAkC;cAErC,eAAe,CAAC,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,2BAA2B,CAAC;CAGxJ;AAED,qBACa,qCAAsC,SAAQ,sBAAsB,CAC7E,iCAAiC,EACjC,4BAA4B,CAC/B;IACU,YAAY,SAAyC;cAE5C,eAAe,CAC3B,KAAK,EAAE,iCAAiC,EACxC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,GACf,OAAO,CAAC,4BAA4B,CAAC;CAG3C;AAED,0FAA0F;AAC1F,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD"}

package/dist/AccessOverrideOperations.js

@@ -0,0 +1,46 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+/**
+ * Orders.RequestAccessOverride and Orders.RecordAccessOverrideDecision (bizapps-orders#268).
+ *
+ * Thin: the rules, the authorization checks and the writes are in `AccessOverride.ts`. Logical
+ * refusals come back as `Success: false` with the reason; only faults throw.
+ */
+import { BaseRemotableOperation } from '@memberjunction/core';
+import { RegisterClass } from '@memberjunction/global';
+import { RecordAccessOverrideDecision, RequestAccessOverride, } from './AccessOverride.js';
+let RequestAccessOverrideOperation = class RequestAccessOverrideOperation extends BaseRemotableOperation {
+    constructor() {
+        super(...arguments);
+        this.OperationKey = 'Orders.RequestAccessOverride';
+    }
+    async InternalExecute(input, provider, user) {
+        return RequestAccessOverride(input, provider, user);
+    }
+};
+RequestAccessOverrideOperation = __decorate([
+    RegisterClass(BaseRemotableOperation, 'Orders.RequestAccessOverride')
+], RequestAccessOverrideOperation);
+export { RequestAccessOverrideOperation };
+let RecordAccessOverrideDecisionOperation = class RecordAccessOverrideDecisionOperation extends BaseRemotableOperation {
+    constructor() {
+        super(...arguments);
+        this.OperationKey = 'Orders.RecordAccessOverrideDecision';
+    }
+    async InternalExecute(input, provider, user) {
+        return RecordAccessOverrideDecision(input, provider, user);
+    }
+};
+RecordAccessOverrideDecisionOperation = __decorate([
+    RegisterClass(BaseRemotableOperation, 'Orders.RecordAccessOverrideDecision')
+], RecordAccessOverrideDecisionOperation);
+export { RecordAccessOverrideDecisionOperation };
+/** Tree-shaking anchor — call from the server bootstrap so @RegisterClass is retained. */
+export function LoadAccessOverrideOperations() {
+    // intentionally empty
+}
+//# sourceMappingURL=AccessOverrideOperations.js.map

package/dist/AccessOverrideOperations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessOverrideOperations.js","sourceRoot":"","sources":["../src/AccessOverrideOperations.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;GAKG;AACH,OAAO,EAAE,sBAAsB,EAA+B,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EACH,4BAA4B,EAC5B,qBAAqB,GAKxB,MAAM,qBAAqB,CAAC;AAGtB,IAAM,8BAA8B,GAApC,MAAM,8BAA+B,SAAQ,sBAA+E;IAA5H;;QACI,iBAAY,GAAG,8BAA8B,CAAC;IAKzD,CAAC;IAHa,KAAK,CAAC,eAAe,CAAC,KAAiC,EAAE,QAA2B,EAAE,IAAc;QAC1G,OAAO,qBAAqB,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC;CACJ,CAAA;AANY,8BAA8B;IAD1C,aAAa,CAAC,sBAAsB,EAAE,8BAA8B,CAAC;GACzD,8BAA8B,CAM1C;;AAGM,IAAM,qCAAqC,GAA3C,MAAM,qCAAsC,SAAQ,sBAG1D;IAHM;;QAII,iBAAY,GAAG,qCAAqC,CAAC;IAShE,CAAC;IAPa,KAAK,CAAC,eAAe,CAC3B,KAAwC,EACxC,QAA2B,EAC3B,IAAc;QAEd,OAAO,4BAA4B,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/D,CAAC;CACJ,CAAA;AAbY,qCAAqC;IADjD,aAAa,CAAC,sBAAsB,EAAE,qCAAqC,CAAC;GAChE,qCAAqC,CAajD;;AAED,0FAA0F;AAC1F,MAAM,UAAU,4BAA4B;IACxC,sBAAsB;AAC1B,CAAC"}