@nocobase/plugin-multi-portal 2.2.0-alpha.11 → 2.2.0-alpha.12

package/dist/server/plugin.js

@@ -41,6 +41,7 @@ __export(plugin_exports, {
 });
 module.exports = __toCommonJS(plugin_exports);
 var import_server = require("@nocobase/server");
+var import_database = require("@nocobase/database");
 var import_utils = require("@nocobase/utils");
 var import_child_process = require("child_process");
 var import_fs = __toESM(require("fs"));
@@ -51,6 +52,7 @@ var import_promises = require("stream/promises");
 var tar = __toESM(require("tar"));
 var import_zlib = require("zlib");
 var import_ensureDefaultRoleMultiPortalAccess = require("./ensureDefaultRoleMultiPortalAccess");
+var import_constants = require("../constants");
 const MULTI_PORTAL_RUNTIME_FIELDS = [
   "uid",
   "title",
@@ -79,8 +81,8 @@ const MAIN_APP_NAME = "main";
 const UNION_ROLE_KEY = "__union__";
 const MULTI_PORTAL_MANIFEST_NAMESPACE = "multi-portal";
 const MULTI_PORTAL_MANIFEST_SYNC_MESSAGE_TYPE = "multi-portal:app-manifest-changed";
-const DEFAULT_INIT_PORTAL_TYPE = "no-code";
-const DEFAULT_INIT_PORTAL_NAME = "admin";
+const DEFAULT_INIT_PORTAL_TYPE = "ai";
+const DEFAULT_INIT_PORTAL_NAME = "main";
 const DEFAULT_INIT_PORTAL_TEMPLATE = "@nocobase/portal-template-default";
 const PORTAL_CLIENT_PREFIX = "x";
 const PORTAL_DEPLOY_UPLOAD_LIMIT = 200 * 1024 * 1024;
@@ -91,8 +93,6 @@ const PORTAL_TEMPLATE_NPM_PACK_TIMEOUT_MS = 3e4;
 const DEFAULT_MULTI_PORTAL_UID = "__default_portal__";
 const MULTI_PORTAL_SLUG_PATTERN = /^[a-z0-9_-]+$/;
 const INIT_PORTAL_TYPES = ["no-code", "ai"];
-const DEFAULT_MULTI_PORTAL_UIDS = [DEFAULT_MULTI_PORTAL_UID];
-const DEFAULT_MULTI_PORTAL_UID_SET = new Set(DEFAULT_MULTI_PORTAL_UIDS);
 const MULTI_PORTAL_MANAGEMENT_ACTIONS = [
   "multiPortals:list",
   "multiPortals:get",
@@ -103,14 +103,22 @@ const MULTI_PORTAL_MANAGEMENT_ACTIONS = [
   "multiPortals:destroy",
   "multiPortals:deploy",
   "multiPortals:pullSource",
-  "multiPortals:pushSource"
+  "multiPortals:pushSource",
+  "desktopRoutes:list",
+  "desktopRoutes:get",
+  "desktopRoutes:create",
+  "desktopRoutes:update",
+  "desktopRoutes:move",
+  "desktopRoutes:destroy",
+  "desktopRoutes:updateOrCreate",
+  "registry:list",
+  "registry:get"
 ];
 const ROLE_MULTI_PORTAL_PERMISSION_ACTIONS = [
   "roles.multiPortals:*",
   "rolesMultiPortalDesktopRoutes:*",
   "rolesMultiPortalRoutePolicies:*"
 ];
-const EXPLICIT_DESKTOP_ROUTE_UI_LAYOUTS = Symbol("explicitDesktopRouteUiLayouts");
 const SKIP_CREATE_PORTAL_DIRECTORY = Symbol("skipCreatePortalDirectory");
 function getRecordField(record, field) {
   if (!record || typeof record !== "object") {
@@ -174,6 +182,38 @@ function getDefaultMultiPortalRecord() {
     uiLayoutUid: "admin-layout-model"
   };
 }
+function getFreshMultiPortalRecords() {
+  return [getDefaultMultiPortalRecord()];
+}
+function getFixedLayoutMultiPortalRecords() {
+  return [
+    {
+      uid: import_constants.DEFAULT_ADMIN_MULTI_PORTAL_UID,
+      title: "Desktop layout",
+      icon: "DesktopOutlined",
+      portalType: "no-code",
+      portalName: "admin",
+      routePath: "/admin",
+      authCheck: true,
+      enabled: true,
+      uiLayoutUid: "admin-layout-model"
+    },
+    {
+      uid: import_constants.DEFAULT_MOBILE_MULTI_PORTAL_UID,
+      title: "Mobile layout",
+      icon: "MobileOutlined",
+      portalType: "no-code",
+      portalName: "mobile",
+      routePath: "/mobile",
+      authCheck: true,
+      enabled: true,
+      uiLayoutUid: "mobile-layout-model"
+    }
+  ];
+}
+function getFixedLayoutMultiPortalRecord(uid) {
+  return getFixedLayoutMultiPortalRecords().find((portal) => portal.uid === uid);
+}
 function isValidPortalDeploySegment(value) {
   return /^[A-Za-z0-9_-]+$/.test(value);
 }
@@ -556,7 +596,8 @@ async function buildPortalStorageItem(portalDir, item) {
   const logPath = getPortalStorageLogPath(item);
   const buildEnv = getPortalStorageCommandEnv({
     NOCOBASE_API_URL: getPortalStorageApiUrl(item.appName),
-    NOCOBASE_PORTAL_BASE: getPortalDeployBasePath(item.appName, item.portalName)
+    NOCOBASE_PORTAL_BASE: getPortalDeployBasePath(item.appName, item.portalName),
+    COREPACK_ENABLE_PROJECT_SPEC: "0"
   });
   await appendPortalStorageLog(logPath, `Building portal ${item.appName}/${item.portalName}.`);
   await appendPortalStorageLog(
@@ -790,29 +831,6 @@ async function replacePortalSourceFromArchive(params) {
     await import_fs.default.promises.rm(tarPath, { force: true });
   }
 }
-function isDefaultMultiPortalUid(uid) {
-  return typeof uid === "string" && DEFAULT_MULTI_PORTAL_UID_SET.has(uid);
-}
-function getDefaultMultiPortalRecordForUid(uid) {
-  return isDefaultMultiPortalUid(uid) ? getDefaultMultiPortalRecord() : void 0;
-}
-function getDefaultMultiPortalUiLayoutUid(portal) {
-  return Object.prototype.hasOwnProperty.call(portal, "uiLayoutUid") ? portal.uiLayoutUid ?? null : null;
-}
-function withCustomMultiPortalFilter(filter = {}) {
-  const customFilter = { ...filter };
-  const uidFilter = customFilter.uid;
-  if (Array.isArray(uidFilter)) {
-    customFilter.uid = uidFilter.filter((uid) => !isDefaultMultiPortalUid(uid));
-    return customFilter;
-  }
-  if (isDefaultMultiPortalUid(uidFilter)) {
-    customFilter.uid = [];
-    return customFilter;
-  }
-  customFilter["uid.$notIn"] = DEFAULT_MULTI_PORTAL_UIDS;
-  return customFilter;
-}
 function uniqueDesktopRouteIds(routeIds) {
   const seen = /* @__PURE__ */ new Set();
   return routeIds.filter((routeId) => {
@@ -867,14 +885,25 @@ function getExplicitRequestedLayoutUid(layout) {
     return uid;
   }
 }
+function hasActionParam(params, key) {
+  return isRecordLike(params) && Object.prototype.hasOwnProperty.call(params, key);
+}
 function getRequestedMultiPortalUid(ctx) {
-  var _a, _b;
-  const portalUid = getExplicitRequestedLayoutUid((_a = ctx.action) == null ? void 0 : _a.params.portal);
-  const layoutUid = getExplicitRequestedLayoutUid((_b = ctx.action) == null ? void 0 : _b.params.layout);
-  if (portalUid && layoutUid) {
+  var _a, _b, _c;
+  const hasPortalScope = hasActionParam((_a = ctx.action) == null ? void 0 : _a.params, "portal");
+  const hasLayoutScope = hasActionParam((_b = ctx.action) == null ? void 0 : _b.params, "layout");
+  const portalUid = getExplicitRequestedLayoutUid((_c = ctx.action) == null ? void 0 : _c.params.portal);
+  if (hasPortalScope && hasLayoutScope) {
     ctx.throw(400, "layout and portal cannot be used together");
     return;
   }
+  if (!hasPortalScope) {
+    return;
+  }
+  if (!portalUid) {
+    ctx.throw(400, "Invalid portal scope");
+    return;
+  }
   return portalUid;
 }
 function getCurrentRoles(ctx) {
@@ -899,27 +928,88 @@ function getMultiPortalNameFromValues(ctx) {
     return portalName;
   }
 }
-function getMultiPortalWriteValues(ctx) {
+function getMultiPortalWriteRecords(ctx) {
   var _a;
   const values = (_a = ctx.action) == null ? void 0 : _a.params.values;
-  if (!values || typeof values !== "object" || Array.isArray(values)) {
-    return;
+  const records = Array.isArray(values) ? values : [values];
+  return records.filter(
+    (record) => !!record && typeof record === "object" && !Array.isArray(record)
+  );
+}
+async function getMultiPortalWriteTargets(ctx, fields) {
+  var _a, _b, _c, _d, _e;
+  const records = getMultiPortalWriteRecords(ctx);
+  if (!records.length || ((_a = ctx.action) == null ? void 0 : _a.actionName) === "create") {
+    return records.map((values2) => ({ values: values2 }));
+  }
+  const repository = ctx.db.getRepository("multiPortals");
+  const actionName = (_b = ctx.action) == null ? void 0 : _b.actionName;
+  const requestedFilterKeys = (_c = ctx.action) == null ? void 0 : _c.params.filterKeys;
+  if ((actionName === "firstOrCreate" || actionName === "updateOrCreate") && Array.isArray(requestedFilterKeys) && requestedFilterKeys.every((filterKey) => typeof filterKey === "string")) {
+    const targets = [];
+    for (const values2 of records) {
+      const existing2 = await repository.findOne({
+        filter: import_database.Repository.valuesToFilter(values2, requestedFilterKeys),
+        fields
+      });
+      targets.push({ existing: existing2, values: values2 });
+    }
+    return targets;
+  }
+  if (records.length > 1) {
+    const targets = [];
+    for (const values2 of records) {
+      const uid2 = values2.uid;
+      const existing2 = typeof uid2 === "string" && uid2 ? await repository.findOne({
+        filterByTk: uid2,
+        fields
+      }) : null;
+      targets.push({ existing: existing2, values: values2 });
+    }
+    return targets;
+  }
+  const values = records[0];
+  const filterByTk = (_d = ctx.action) == null ? void 0 : _d.params.filterByTk;
+  if (filterByTk !== void 0 && filterByTk !== null) {
+    const existingRecords = await repository.find({
+      filterByTk,
+      fields
+    });
+    return existingRecords.length ? existingRecords.map((existing2) => ({ existing: existing2, values })) : [{ values }];
+  }
+  const filter = (_e = ctx.action) == null ? void 0 : _e.params.filter;
+  if (isRecordLike(filter) && !Array.isArray(filter)) {
+    const existingRecords = await repository.find({
+      filter,
+      fields
+    });
+    return existingRecords.length ? existingRecords.map((existing2) => ({ existing: existing2, values })) : [{ values }];
   }
-  return values;
+  const uid = values.uid;
+  const existing = typeof uid === "string" && uid ? await repository.findOne({
+    filterByTk: uid,
+    fields
+  }) : null;
+  return [{ existing, values }];
 }
 function isTruthyActionBoolean(value) {
   return value === true || value === 1 || value === "1" || value === "true";
 }
 async function captureSkipCreatePortalDirectory(ctx, next) {
-  const values = getMultiPortalWriteValues(ctx);
-  if (!values || !Object.prototype.hasOwnProperty.call(values, "skipCreatePortalDirectory")) {
+  const records = getMultiPortalWriteRecords(ctx);
+  const recordsWithOption = records.filter(
+    (record) => Object.prototype.hasOwnProperty.call(record, "skipCreatePortalDirectory")
+  );
+  if (!recordsWithOption.length) {
     await next();
     return;
   }
-  ctx[SKIP_CREATE_PORTAL_DIRECTORY] = isTruthyActionBoolean(
-    values.skipCreatePortalDirectory
+  ctx[SKIP_CREATE_PORTAL_DIRECTORY] = recordsWithOption.some(
+    (record) => isTruthyActionBoolean(record.skipCreatePortalDirectory)
   );
-  delete values.skipCreatePortalDirectory;
+  for (const record of recordsWithOption) {
+    delete record.skipCreatePortalDirectory;
+  }
   await next();
 }
 function shouldSkipCreatePortalDirectory(options) {
@@ -927,156 +1017,180 @@ function shouldSkipCreatePortalDirectory(options) {
   return ((_a = options == null ? void 0 : options.context) == null ? void 0 : _a[SKIP_CREATE_PORTAL_DIRECTORY]) === true;
 }
 async function normalizeMultiPortalSlugValues(ctx, next) {
-  const values = getMultiPortalWriteValues(ctx);
-  const portalName = values == null ? void 0 : values.portalName;
-  if (portalName === void 0 || portalName === null) {
-    await next();
-    return;
-  }
-  if (typeof portalName !== "string") {
-    await next();
-    return;
+  for (const values of getMultiPortalWriteRecords(ctx)) {
+    const portalName = values.portalName;
+    if (portalName === void 0 || portalName === null || typeof portalName !== "string") {
+      continue;
+    }
+    const slug = portalName.trim();
+    if (!slug) {
+      continue;
+    }
+    if (!MULTI_PORTAL_SLUG_PATTERN.test(slug)) {
+      ctx.throw(400, "Portal name can only contain lowercase letters, numbers, hyphens, and underscores");
+      return;
+    }
+    values.portalName = slug;
+    values.routePath = `/${slug}`;
   }
-  const slug = portalName.trim();
-  if (!slug) {
-    await next();
-    return;
+  await next();
+}
+function isUniqueConstraintViolation(error) {
+  return error instanceof import_database.UniqueConstraintError || isRecordLike(error) && error.name === "SequelizeUniqueConstraintError";
+}
+async function createDefaultMultiPortalBestEffort(db, portal) {
+  const repository = db.getRepository("multiPortals");
+  const [uidConflict, portalNameConflict] = await Promise.all([
+    repository.findOne({
+      filterByTk: portal.uid,
+      fields: ["uid"]
+    }),
+    repository.findOne({
+      filter: { portalName: portal.portalName },
+      fields: ["uid"]
+    })
+  ]);
+  if (uidConflict || portalNameConflict) {
+    return false;
   }
-  if (!MULTI_PORTAL_SLUG_PATTERN.test(slug)) {
-    ctx.throw(400, "Portal name can only contain lowercase letters, numbers, hyphens, and underscores");
-    return;
+  try {
+    await repository.create({ values: portal });
+    return true;
+  } catch (error) {
+    if (isUniqueConstraintViolation(error)) {
+      return false;
+    }
+    throw error;
   }
-  values.portalName = slug;
-  values.routePath = `/${slug}`;
-  await next();
 }
-async function ensureDefaultMultiPortals(db, options) {
+async function repairFixedLayoutMultiPortalRecords(db) {
   const repository = db.getRepository("multiPortals");
-  const defaultPortal = getDefaultMultiPortalRecord();
-  const existing = await repository.findOne({
-    filterByTk: defaultPortal.uid,
-    fields: ["uid", "title", "icon", "portalType", "portalName", "routePath", "authCheck", "uiLayoutUid"],
-    transaction: options == null ? void 0 : options.transaction
-  });
-  if (!existing) {
-    await repository.create({
-      values: defaultPortal,
-      transaction: options == null ? void 0 : options.transaction
+  for (const portal of getFixedLayoutMultiPortalRecords()) {
+    const existing = await repository.findOne({
+      filterByTk: portal.uid,
+      fields: ["uid", "portalType", "portalName", "routePath", "uiLayoutUid"]
     });
-    return;
-  }
-  const protectedValues = {
-    uid: defaultPortal.uid,
-    portalType: defaultPortal.portalType ?? null,
-    portalName: defaultPortal.portalName,
-    routePath: defaultPortal.routePath,
-    authCheck: defaultPortal.authCheck,
-    uiLayoutUid: getDefaultMultiPortalUiLayoutUid(defaultPortal)
-  };
-  const shouldRepair = Object.entries(protectedValues).some(([field, value]) => existing.get(field) !== value);
-  if (shouldRepair) {
+    if ((existing == null ? void 0 : existing.get("portalName")) !== portal.portalName || existing.get("routePath") !== portal.routePath || existing.get("uiLayoutUid") !== portal.uiLayoutUid || existing.get("portalType") === portal.portalType) {
+      continue;
+    }
     await repository.update({
-      filterByTk: defaultPortal.uid,
-      values: protectedValues,
-      transaction: options == null ? void 0 : options.transaction
+      filterByTk: portal.uid,
+      values: {
+        portalType: portal.portalType
+      }
     });
   }
 }
-async function protectDefaultMultiPortalUpdate(ctx, next) {
-  var _a, _b, _c;
-  const defaultPortal = getDefaultMultiPortalRecordForUid((_a = ctx.action) == null ? void 0 : _a.params.filterByTk);
-  if (!defaultPortal) {
-    await next();
-    return;
-  }
-  const params = (_b = ctx.action) == null ? void 0 : _b.params;
-  const rawValues = isRecordLike(params == null ? void 0 : params.values) ? params.values : {};
-  const values = {
-    uid: defaultPortal.uid,
-    portalType: defaultPortal.portalType ?? null,
-    portalName: defaultPortal.portalName,
-    routePath: defaultPortal.routePath,
-    authCheck: defaultPortal.authCheck,
-    uiLayoutUid: getDefaultMultiPortalUiLayoutUid(defaultPortal)
-  };
-  if (Object.prototype.hasOwnProperty.call(rawValues, "title")) {
-    values.title = rawValues.title;
+async function seedFreshMultiPortals(db) {
+  for (const portal of getFreshMultiPortalRecords()) {
+    await createDefaultMultiPortalBestEffort(db, portal);
   }
-  if (Object.prototype.hasOwnProperty.call(rawValues, "icon")) {
-    values.icon = rawValues.icon;
+}
+async function seedHistoricalMultiPortals(db) {
+  if (getInitPortalType() === "ai") {
+    await createDefaultMultiPortalBestEffort(db, getDefaultMultiPortalRecord());
   }
-  if (Object.prototype.hasOwnProperty.call(rawValues, "enabled")) {
-    values.enabled = rawValues.enabled;
+  for (const portal of getFixedLayoutMultiPortalRecords()) {
+    await createDefaultMultiPortalBestEffort(db, portal);
   }
-  (_c = ctx.action) == null ? void 0 : _c.mergeParams(
-    {
-      values
-    },
-    {
-      values: "overwrite"
-    }
-  );
-  await next();
+  await repairFixedLayoutMultiPortalRecords(db);
 }
 async function preventUiLayoutRouteNameConflict(ctx, next) {
-  var _a;
-  if (isDefaultMultiPortalUid((_a = ctx.action) == null ? void 0 : _a.params.filterByTk)) {
-    await next();
-    return;
-  }
-  const portalName = getMultiPortalNameFromValues(ctx);
-  if (!portalName) {
-    await next();
-    return;
+  const targets = await getMultiPortalWriteTargets(ctx, ["uid", "portalName", "uiLayoutUid"]);
+  for (const { existing, values } of targets) {
+    const existingUid = trimString(existing == null ? void 0 : existing.get("uid"));
+    const uid = trimString(values.uid ?? existingUid);
+    const portalName = trimString(values.portalName ?? (existing == null ? void 0 : existing.get("portalName")));
+    const uiLayoutUid = trimString(values.uiLayoutUid ?? (existing == null ? void 0 : existing.get("uiLayoutUid")));
+    const fixedPortal = getFixedLayoutMultiPortalRecord(existingUid) || getFixedLayoutMultiPortalRecord(uid);
+    const canonicalPortal = (fixedPortal == null ? void 0 : fixedPortal.uid) === uid && (!existingUid || fixedPortal.uid === existingUid) && fixedPortal.portalName === portalName && fixedPortal.uiLayoutUid === uiLayoutUid;
+    if (fixedPortal && !canonicalPortal) {
+      ctx.throw(400, "Reserved Portal UID must match its canonical route and UI layout");
+      return;
+    }
+    if (!portalName) {
+      continue;
+    }
+    if (portalName === "admin" || portalName === "mobile") {
+      continue;
+    }
+    const existingInitPortal = (existing == null ? void 0 : existing.get("uid")) === DEFAULT_MULTI_PORTAL_UID && existing.get("portalName") === portalName;
+    const uiLayout = await ctx.db.getRepository("uiLayouts").findOne({
+      filter: {
+        routeName: portalName
+      },
+      fields: ["uid"]
+    });
+    if (uiLayout && !existingInitPortal) {
+      ctx.throw(400, "Portal route name conflicts with an existing UI layout");
+      return;
+    }
   }
-  const uiLayout = await ctx.db.getRepository("uiLayouts").findOne({
-    filter: {
-      routeName: portalName
-    },
-    fields: ["uid"]
-  });
-  if (uiLayout) {
-    ctx.throw(400, "Portal route name conflicts with an existing UI layout");
-    return;
+  await next();
+}
+async function preventMultiPortalBackingLayoutChange(ctx, next) {
+  const targets = await getMultiPortalWriteTargets(ctx, ["uiLayoutUid"]);
+  for (const { existing, values } of targets) {
+    if (!Object.prototype.hasOwnProperty.call(values, "uiLayoutUid")) {
+      continue;
+    }
+    if (existing && existing.get("uiLayoutUid") !== values.uiLayoutUid) {
+      ctx.throw(400, "Portal backing UI layout cannot be changed");
+      return;
+    }
   }
   await next();
 }
-async function findRequestedMultiPortal(ctx) {
-  var _a;
+async function findRequestedMultiPortal(ctx, transaction) {
   const portalUid = getRequestedMultiPortalUid(ctx);
   if (portalUid === void 0) {
     return {
       requested: false
     };
   }
-  const isExplicitPortalRequest = getExplicitRequestedLayoutUid((_a = ctx.action) == null ? void 0 : _a.params.portal) !== void 0;
-  if (!isExplicitPortalRequest) {
-    const uiLayout = await ctx.db.getRepository("uiLayouts").findOne({
-      filter: {
-        uid: portalUid
-      },
-      fields: ["uid"]
-    });
-    if (uiLayout) {
-      return {
-        requested: false
-      };
-    }
-  }
   const portal = await ctx.db.getRepository("multiPortals").findOne({
     filter: {
       uid: portalUid
     },
-    fields: ["uid", "uiLayoutUid", "enabled"]
+    fields: ["uid", "portalType", "uiLayoutUid", "enabled"],
+    ...transaction ? { lock: transaction.LOCK.UPDATE } : {},
+    transaction
   });
-  if ((portal == null ? void 0 : portal.get("enabled")) === true) {
-    return {
-      portal,
-      requested: true
-    };
+  if (!portal || portal.get("enabled") !== true) {
+    return { requested: true };
+  }
+  if (portal.get("portalType") !== "no-code") {
+    ctx.throw(400, `Portal '${portalUid}' does not support desktop routes`);
+  }
+  const uiLayoutUid = portal.get("uiLayoutUid");
+  if (typeof uiLayoutUid !== "string" || !uiLayoutUid) {
+    ctx.throw(400, `Portal '${portalUid}' has no backing UI layout`);
   }
+  const uiLayout = await ctx.db.getRepository("uiLayouts").findOne({
+    filter: {
+      uid: uiLayoutUid,
+      enabled: true
+    },
+    fields: ["uid"],
+    ...transaction ? { lock: transaction.LOCK.UPDATE } : {},
+    transaction
+  });
+  if (!uiLayout) {
+    ctx.throw(400, `Portal '${portalUid}' has no enabled backing UI layout`);
+  }
+  const usesLayoutPermissions = (0, import_constants.isDefaultLayoutMultiPortalUid)(portalUid);
   return {
-    requested: !!isExplicitPortalRequest || !!portal
+    portal,
+    requested: true,
+    scope: {
+      portalUid,
+      uiLayoutUid,
+      relation: usesLayoutPermissions ? "uiLayouts" : "multiPortals",
+      uid: usesLayoutPermissions ? uiLayoutUid : portalUid,
+      filter: usesLayoutPermissions ? {
+        "uiLayouts.uid": uiLayoutUid
+      } : getDesktopRoutePortalFilter(portalUid)
+    }
   };
 }
 function getDesktopRoutePortalFilter(multiPortalUid) {
@@ -1087,49 +1201,90 @@ function getDesktopRoutePortalFilter(multiPortalUid) {
 function isDesktopRouteCreateValue(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
-function hasDesktopRouteField(value, field) {
-  return !!value && Object.prototype.hasOwnProperty.call(value, field);
+function withDesktopRouteEffectiveOwner(value, scope) {
+  if (Array.isArray(value)) {
+    return value.map((item) => withDesktopRouteEffectiveOwner(item, scope));
+  }
+  if (!isDesktopRouteCreateValue(value)) {
+    return value;
+  }
+  const { uiLayouts: _uiLayouts, multiPortals: _multiPortals, children, ...route } = value;
+  return {
+    ...route,
+    ...scope.relation === "uiLayouts" ? { uiLayouts: [scope.uid] } : { multiPortals: [scope.uid] },
+    ...Array.isArray(children) ? { children: withDesktopRouteEffectiveOwner(children, scope) } : {}
+  };
 }
-function pickExplicitDesktopRouteUiLayouts(value) {
+function collectExplicitDesktopRouteParentIds(value) {
   if (Array.isArray(value)) {
-    return value.map((item) => pickExplicitDesktopRouteUiLayouts(item));
+    return uniqueDesktopRouteIds(value.flatMap((item) => collectExplicitDesktopRouteParentIds(item)));
   }
   if (!isDesktopRouteCreateValue(value)) {
-    return;
+    return [];
   }
-  const route = {};
-  if (hasDesktopRouteField(value, "uiLayouts")) {
-    route.uiLayouts = value.uiLayouts;
+  const parentIds = [];
+  if (typeof value.parentId === "string" || typeof value.parentId === "number") {
+    parentIds.push(value.parentId);
   }
   if (Array.isArray(value.children)) {
-    route.children = value.children.map((child) => pickExplicitDesktopRouteUiLayouts(child));
+    parentIds.push(...value.children.flatMap((child) => collectExplicitDesktopRouteParentIds(child)));
   }
-  return route;
+  return uniqueDesktopRouteIds(parentIds);
 }
-function withDesktopRouteMultiPortal(value, multiPortalUid, explicitValue = value) {
-  if (Array.isArray(value)) {
-    const explicitValues = Array.isArray(explicitValue) ? explicitValue : [];
-    return value.map((item, index) => withDesktopRouteMultiPortal(item, multiPortalUid, explicitValues[index]));
+async function assertDesktopRouteParentsBelongToScope(ctx, scope, values = ((_a) => (_a = ctx.action) == null ? void 0 : _a.params.values)(), transaction) {
+  const parentIds = collectExplicitDesktopRouteParentIds(values);
+  if (!parentIds.length) {
+    return;
   }
-  if (!isDesktopRouteCreateValue(value)) {
-    return value;
+  const parents = await ctx.db.getRepository("desktopRoutes").find({
+    fields: ["id"],
+    filter: {
+      id: parentIds,
+      ...scope.filter
+    },
+    ...transaction ? { lock: transaction.LOCK.UPDATE } : {},
+    transaction
+  });
+  if (new Set(normalizeDesktopRouteTargetIds(parents)).size !== new Set(parentIds.map(String)).size) {
+    ctx.throw(400, "Parent route does not belong to the requested portal scope");
   }
-  const explicitRoute = isDesktopRouteCreateValue(explicitValue) ? explicitValue : void 0;
-  const existingMultiPortals = Array.isArray(value.multiPortals) ? value.multiPortals.filter((uid) => typeof uid === "string" && !!uid) : [];
-  const { uiLayouts: _uiLayouts, children: _children, ...route } = value;
-  return {
-    ...route,
-    ...hasDesktopRouteField(explicitRoute, "uiLayouts") ? { uiLayouts: explicitRoute == null ? void 0 : explicitRoute.uiLayouts } : {},
-    multiPortals: Array.from(/* @__PURE__ */ new Set([...existingMultiPortals, multiPortalUid])),
-    ...Array.isArray(value.children) ? { children: withDesktopRouteMultiPortal(value.children, multiPortalUid, explicitRoute == null ? void 0 : explicitRoute.children) } : {}
-  };
 }
-async function captureExplicitDesktopRouteUiLayouts(ctx, next) {
-  var _a;
-  ctx[EXPLICIT_DESKTOP_ROUTE_UI_LAYOUTS] = pickExplicitDesktopRouteUiLayouts(
-    (_a = ctx.action) == null ? void 0 : _a.params.values
-  );
-  await next();
+function getDesktopRouteUpdateOrCreateFilters(ctx, values = ((_b) => (_b = ctx.action) == null ? void 0 : _b.params.values)(), requestedFilterKeys = ((_c) => (_c = ctx.action) == null ? void 0 : _c.params.filterKeys)()) {
+  const filterKeys = Array.isArray(requestedFilterKeys) ? requestedFilterKeys.filter((key) => typeof key === "string" && !!key) : [];
+  if (!filterKeys.length) {
+    return [];
+  }
+  const records = Array.isArray(values) ? values : [values];
+  return records.flatMap((value) => {
+    if (!isDesktopRouteCreateValue(value) || filterKeys.some((key) => !Object.prototype.hasOwnProperty.call(value, key))) {
+      return [];
+    }
+    return [Object.fromEntries(filterKeys.map((key) => [key, value[key]]))];
+  });
+}
+async function assertDesktopRouteUpsertMatchesBelongToScope(ctx, scope, values = ((_d) => (_d = ctx.action) == null ? void 0 : _d.params.values)(), filterKeys = ((_e) => (_e = ctx.action) == null ? void 0 : _e.params.filterKeys)(), transaction) {
+  for (const filter of getDesktopRouteUpdateOrCreateFilters(ctx, values, filterKeys)) {
+    const allMatches = await ctx.db.getRepository("desktopRoutes").find({
+      fields: ["id"],
+      filter,
+      ...transaction ? { lock: transaction.LOCK.UPDATE } : {},
+      transaction
+    });
+    const scopedMatches = await ctx.db.getRepository("desktopRoutes").find({
+      fields: ["id"],
+      filter: {
+        ...filter,
+        ...scope.filter
+      },
+      ...transaction ? { lock: transaction.LOCK.UPDATE } : {},
+      transaction
+    });
+    const allMatchIds = normalizeDesktopRouteTargetIds(allMatches);
+    const scopedMatchIds = normalizeDesktopRouteTargetIds(scopedMatches);
+    if (allMatchIds.join(",") !== scopedMatchIds.join(",")) {
+      ctx.throw(400, "Desktop route does not belong to the requested portal scope");
+    }
+  }
 }
 async function canAccessMultiPortal(ctx, multiPortalUid) {
   const currentRoles = getCurrentRoles(ctx);
@@ -1379,25 +1534,17 @@ async function prepareAccessibleDesktopRoutesForMultiPortal(ctx) {
   if (!portalRequest.requested) {
     return;
   }
-  const portal = portalRequest.portal;
-  if (!portal) {
-    return null;
-  }
-  const portalUid = portal.get("uid");
-  const uiLayoutUid = portal.get("uiLayoutUid");
-  if (typeof portalUid !== "string" || !portalUid || typeof uiLayoutUid !== "string" || !uiLayoutUid) {
+  const scope = portalRequest.scope;
+  if (!scope) {
     return null;
   }
-  if (!await canAccessMultiPortal(ctx, portalUid)) {
+  if (scope.relation === "multiPortals" && !await canAccessMultiPortal(ctx, scope.portalUid)) {
     return null;
   }
   if ((_a = ctx.action) == null ? void 0 : _a.params) {
-    ctx.action.params.layout = uiLayoutUid;
+    ctx.action.params.layout = scope.uiLayoutUid;
   }
-  return {
-    portalUid,
-    uiLayoutUid
-  };
+  return scope;
 }
 async function addMultiPortalListAccessibleGuard(ctx, next) {
   const portalContext = await prepareAccessibleDesktopRoutesForMultiPortal(ctx);
@@ -1406,10 +1553,13 @@ async function addMultiPortalListAccessibleGuard(ctx, next) {
     return;
   }
   await next();
-  if (portalContext) {
+  if ((portalContext == null ? void 0 : portalContext.relation) === "multiPortals") {
     await replaceListAccessibleRoutesWithPortalScopedRoutes(ctx, portalContext);
     return;
   }
+  if ((portalContext == null ? void 0 : portalContext.relation) === "uiLayouts") {
+    return;
+  }
   await removeMultiPortalOwnedRoutesFromListResponse(ctx);
 }
 async function addMultiPortalGetAccessibleGuard(ctx, next) {
@@ -1420,26 +1570,36 @@ async function addMultiPortalGetAccessibleGuard(ctx, next) {
     return;
   }
   await next();
-  if (portalContext) {
+  if ((portalContext == null ? void 0 : portalContext.relation) === "multiPortals") {
     await replaceGetAccessibleRouteWithPortalScopedRoute(ctx, portalContext);
     return;
   }
+  if ((portalContext == null ? void 0 : portalContext.relation) === "uiLayouts") {
+    return;
+  }
   await removeMultiPortalOwnedRouteFromGetResponse(ctx);
 }
 async function mapMultiPortalLayoutToUiLayoutForRolePermissionTargets(ctx, next) {
+  var _a;
   const portalRequest = await findRequestedMultiPortal(ctx);
   if (portalRequest.requested && !portalRequest.portal) {
     ctx.status = 200;
     ctx.body = [];
     return;
   }
-  const portal = portalRequest.portal;
-  const portalUid = portal == null ? void 0 : portal.get("uid");
-  if (typeof portalUid === "string" && portalUid) {
+  const scope = portalRequest.scope;
+  if ((scope == null ? void 0 : scope.relation) === "uiLayouts") {
+    if ((_a = ctx.action) == null ? void 0 : _a.params) {
+      ctx.action.params.layout = scope.uiLayoutUid;
+    }
+    await next();
+    return;
+  }
+  if ((scope == null ? void 0 : scope.relation) === "multiPortals") {
     const routes = await ctx.db.getRepository("desktopRoutes").find({
       tree: true,
       sort: "sort",
-      filter: getDesktopRoutePortalFilter(portalUid),
+      filter: scope.filter,
       fields: [...DESKTOP_ROUTE_ROLE_PERMISSION_TARGET_FIELDS]
     });
     ctx.status = 200;
@@ -1450,38 +1610,585 @@ async function mapMultiPortalLayoutToUiLayoutForRolePermissionTargets(ctx, next)
   await removeMultiPortalOwnedRoutesFromListResponse(ctx);
 }
 async function addDesktopRouteCreateMultiPortal(ctx, next) {
-  var _a, _b;
+  var _a, _b, _c;
   const portalRequest = await findRequestedMultiPortal(ctx);
   if (portalRequest.requested && !portalRequest.portal) {
     ctx.throw(400, "Invalid portal scope");
     return;
   }
-  const portal = portalRequest.portal;
-  const portalUid = portal == null ? void 0 : portal.get("uid");
-  if (typeof portalUid === "string" && portalUid) {
-    const explicitValues = ctx[EXPLICIT_DESKTOP_ROUTE_UI_LAYOUTS];
-    (_b = ctx.action) == null ? void 0 : _b.mergeParams(
+  const scope = portalRequest.scope;
+  if (scope) {
+    await assertDesktopRouteParentsBelongToScope(ctx, scope);
+    if (((_a = ctx.action) == null ? void 0 : _a.actionName) === "updateOrCreate") {
+      await assertDesktopRouteUpsertMatchesBelongToScope(ctx, scope);
+    }
+    (_c = ctx.action) == null ? void 0 : _c.mergeParams(
       {
-        values: withDesktopRouteMultiPortal((_a = ctx.action) == null ? void 0 : _a.params.values, portalUid, explicitValues)
+        values: withDesktopRouteEffectiveOwner((_b = ctx.action) == null ? void 0 : _b.params.values, scope)
       },
       {
         values: "overwrite"
       }
     );
     await next();
-    const desktopRouteIds = collectDesktopRouteIds(ctx.body);
-    await removeLayoutRoutePermissionsFromPortalOnlyRoutes(ctx, desktopRouteIds);
-    await grantDefaultRouteAccessToNewMultiPortalRoutes(ctx, portalUid, desktopRouteIds);
     return;
   }
   await next();
 }
+async function addDesktopRouteEffectiveScopeFilter(ctx, next) {
+  var _a;
+  const portalRequest = await findRequestedMultiPortal(ctx);
+  if (!portalRequest.requested) {
+    await next();
+    return;
+  }
+  if (!portalRequest.scope) {
+    ctx.throw(400, "Invalid portal scope");
+    return;
+  }
+  (_a = ctx.action) == null ? void 0 : _a.mergeParams({
+    filter: portalRequest.scope.filter
+  });
+  await next();
+}
+function withoutDesktopRouteOwnerFields(value) {
+  if (Array.isArray(value)) {
+    return value.map((item) => withoutDesktopRouteOwnerFields(item));
+  }
+  if (!isDesktopRouteCreateValue(value)) {
+    return value;
+  }
+  const { uiLayouts: _uiLayouts, multiPortals: _multiPortals, children, ...route } = value;
+  return {
+    ...route,
+    ...Array.isArray(children) ? { children: withoutDesktopRouteOwnerFields(children) } : {}
+  };
+}
+function normalizeDesktopRouteTargetIds(records) {
+  return records.map((record) => record.get("id")).filter((id) => typeof id === "string" || typeof id === "number").map(String).sort();
+}
+async function findDesktopRouteMutationTargets(ctx, scopeFilter, transaction, selector) {
+  var _a;
+  const params = selector ?? ((_a = ctx.action) == null ? void 0 : _a.params) ?? {};
+  const values = params.values;
+  const batchUpdateIds = Array.isArray(values) ? values.flatMap((value) => {
+    if (!isDesktopRouteCreateValue(value)) {
+      return [];
+    }
+    const routeId = value.id;
+    return typeof routeId === "string" || typeof routeId === "number" ? [routeId] : [];
+  }) : [];
+  const hasBatchUpdateTargets = batchUpdateIds.length > 0;
+  const filterByTk = hasBatchUpdateTargets ? batchUpdateIds : params.filterByTk;
+  const filter = !hasBatchUpdateTargets && isRecordLike(params.filter) ? params.filter : void 0;
+  if ((filterByTk === void 0 || filterByTk === null) && !filter) {
+    return [];
+  }
+  return ctx.db.getRepository("desktopRoutes").find({
+    fields: ["id"],
+    ...filterByTk !== void 0 && filterByTk !== null ? { filterByTk } : {},
+    filter: {
+      ...filter ?? {},
+      ...scopeFilter ?? {}
+    },
+    ...transaction ? { lock: transaction.LOCK.UPDATE } : {},
+    transaction
+  });
+}
+async function assertDesktopRouteMutationTargetsBelongToScope(ctx, scope, transaction, selector) {
+  const allTargets = await findDesktopRouteMutationTargets(ctx, void 0, transaction, selector);
+  const scopedTargets = await findDesktopRouteMutationTargets(ctx, scope.filter, transaction, selector);
+  const allTargetIds = normalizeDesktopRouteTargetIds(allTargets);
+  const scopedTargetIds = normalizeDesktopRouteTargetIds(scopedTargets);
+  if (!allTargetIds.length || allTargetIds.join(",") !== scopedTargetIds.join(",")) {
+    ctx.throw(400, "Desktop route does not belong to the requested portal scope");
+  }
+}
+async function guardDesktopRouteUpdateScope(ctx, next) {
+  var _a, _b;
+  const portalRequest = await findRequestedMultiPortal(ctx);
+  if (!portalRequest.requested) {
+    await next();
+    return;
+  }
+  const scope = portalRequest.scope;
+  if (!scope) {
+    ctx.throw(400, "Invalid portal scope");
+    return;
+  }
+  await assertDesktopRouteMutationTargetsBelongToScope(ctx, scope);
+  await assertDesktopRouteParentsBelongToScope(ctx, scope);
+  (_b = ctx.action) == null ? void 0 : _b.mergeParams(
+    {
+      values: withoutDesktopRouteOwnerFields((_a = ctx.action) == null ? void 0 : _a.params.values)
+    },
+    {
+      values: "overwrite"
+    }
+  );
+  await next();
+}
+function getDesktopRoutePortalContext(context) {
+  var _a;
+  if (!isRecordLike(context)) {
+    return;
+  }
+  const ctx = context;
+  if (((_a = ctx.action) == null ? void 0 : _a.resourceName) !== "desktopRoutes" || !hasActionParam(ctx.action.params, "portal")) {
+    return;
+  }
+  return ctx;
+}
+async function resolveRequiredDesktopRouteScope(ctx, transaction) {
+  const portalRequest = await findRequestedMultiPortal(ctx, transaction);
+  if (!portalRequest.scope) {
+    ctx.throw(400, "Invalid portal scope");
+  }
+  return portalRequest.scope;
+}
+function withDesktopRouteScopeFilter(filter, scope) {
+  return {
+    ...isRecordLike(filter) ? filter : {},
+    ...scope.filter
+  };
+}
+class MultiPortalDesktopRouteRepository extends import_database.Repository {
+  async withAuthoritativeScopeTransaction(existingTransaction, callback) {
+    if (existingTransaction) {
+      return callback(existingTransaction);
+    }
+    return this.database.sequelize.transaction(callback);
+  }
+  async create(options) {
+    const ctx = getDesktopRoutePortalContext(options.context);
+    if (!ctx) {
+      return super.create(options);
+    }
+    return this.withAuthoritativeScopeTransaction(options.transaction, async (transaction) => {
+      const scope = await resolveRequiredDesktopRouteScope(ctx, transaction);
+      const values = withDesktopRouteEffectiveOwner(options.values, scope);
+      await assertDesktopRouteParentsBelongToScope(ctx, scope, values, transaction);
+      return super.create({
+        ...options,
+        values,
+        transaction
+      });
+    });
+  }
+  async update(options) {
+    const ctx = getDesktopRoutePortalContext(options.context);
+    if (!ctx) {
+      return super.update(options);
+    }
+    return this.withAuthoritativeScopeTransaction(options.transaction, async (transaction) => {
+      const scope = await resolveRequiredDesktopRouteScope(ctx, transaction);
+      await assertDesktopRouteMutationTargetsBelongToScope(ctx, scope, transaction, options);
+      const values = withoutDesktopRouteOwnerFields(options.values);
+      await assertDesktopRouteParentsBelongToScope(ctx, scope, values, transaction);
+      return super.update({
+        ...options,
+        filter: withDesktopRouteScopeFilter(options.filter, scope),
+        values,
+        transaction
+      });
+    });
+  }
+  async updateOrCreate(options) {
+    const ctx = getDesktopRoutePortalContext(options.context);
+    if (!ctx) {
+      return super.updateOrCreate(options);
+    }
+    return this.withAuthoritativeScopeTransaction(options.transaction, async (transaction) => {
+      const scope = await resolveRequiredDesktopRouteScope(ctx, transaction);
+      const values = withDesktopRouteEffectiveOwner(options.values, scope);
+      await assertDesktopRouteParentsBelongToScope(ctx, scope, values, transaction);
+      await assertDesktopRouteUpsertMatchesBelongToScope(ctx, scope, values, options.filterKeys, transaction);
+      return super.updateOrCreate({
+        ...options,
+        values,
+        transaction
+      });
+    });
+  }
+}
+async function guardDesktopRouteMoveScope(ctx, next) {
+  var _a;
+  const portalRequest = await findRequestedMultiPortal(ctx);
+  if (!portalRequest.requested) {
+    await next();
+    return;
+  }
+  const params = ((_a = ctx.action) == null ? void 0 : _a.params) ?? {};
+  const sourceId = params.sourceId;
+  const targetId = params.targetId;
+  const hasTargetId = targetId !== void 0 && targetId !== null;
+  if (typeof sourceId !== "string" && typeof sourceId !== "number" || hasTargetId && typeof targetId !== "string" && typeof targetId !== "number" || params.sortField !== void 0 && params.sortField !== "sort") {
+    ctx.throw(400, "Invalid desktop route move scope");
+    return;
+  }
+  await ctx.db.sequelize.transaction(async (transaction) => {
+    const scope = await resolveRequiredDesktopRouteScope(ctx, transaction);
+    const routeIds = uniqueDesktopRouteIds(hasTargetId ? [sourceId, targetId] : [sourceId]);
+    const allRoutes = await ctx.db.getRepository("desktopRoutes").find({
+      fields: ["id", "parentId", "sort"],
+      filter: {
+        id: routeIds
+      },
+      lock: transaction.LOCK.UPDATE,
+      transaction
+    });
+    const scopedRoutes = await ctx.db.getRepository("desktopRoutes").find({
+      fields: ["id", "parentId", "sort"],
+      filter: {
+        id: routeIds,
+        ...scope.filter
+      },
+      lock: transaction.LOCK.UPDATE,
+      transaction
+    });
+    if (normalizeDesktopRouteTargetIds(allRoutes).join(",") !== normalizeDesktopRouteTargetIds(scopedRoutes).join(",") || scopedRoutes.length !== routeIds.length) {
+      ctx.throw(400, "Move target does not belong to the requested portal scope");
+      return;
+    }
+    const routesById = new Map(
+      scopedRoutes.map((route) => [String(route.get("id")), route])
+    );
+    let source = routesById.get(String(sourceId));
+    const target = hasTargetId ? routesById.get(String(targetId)) : void 0;
+    if (!source || hasTargetId && !target) {
+      ctx.throw(400, "Move target does not belong to the requested portal scope");
+      return;
+    }
+    const targetScope = isRecordLike(params.targetScope) ? params.targetScope : void 0;
+    const requestedParentId = targetScope == null ? void 0 : targetScope.parentId;
+    const parentIds = uniqueDesktopRouteIds(
+      [source.get("parentId"), target == null ? void 0 : target.get("parentId"), requestedParentId].filter(
+        (id) => typeof id === "string" || typeof id === "number"
+      )
+    );
+    if (parentIds.length) {
+      const parents = await ctx.db.getRepository("desktopRoutes").find({
+        fields: ["id"],
+        filter: {
+          id: parentIds,
+          ...scope.filter
+        },
+        lock: transaction.LOCK.UPDATE,
+        transaction
+      });
+      if (normalizeDesktopRouteTargetIds(parents).join(",") !== parentIds.map(String).sort().join(",")) {
+        ctx.throw(400, "Move parent does not belong to the requested portal scope");
+        return;
+      }
+    }
+    const updateSource = async (values, silent) => {
+      const [updatedSource] = await ctx.db.getRepository("desktopRoutes").update({
+        filterByTk: sourceId,
+        values,
+        silent,
+        transaction
+      });
+      if (!updatedSource) {
+        ctx.throw(400, "Move source does not belong to the requested portal scope");
+      }
+      source = updatedSource;
+    };
+    if (target) {
+      const targetParentId = target.get("parentId");
+      if (source.get("parentId") !== targetParentId) {
+        await updateSource({ parentId: targetParentId }, false);
+      }
+      const sourceSort = source.get("sort");
+      let targetSort = target.get("sort");
+      if (typeof sourceSort !== "number" || typeof targetSort !== "number") {
+        ctx.throw(400, "Invalid desktop route sort value");
+        return;
+      }
+      if (params.method === "insertAfter") {
+        targetSort += 1;
+      }
+      const movesForward = targetSort > sourceSort;
+      const affectedRoutes = await ctx.db.getRepository("desktopRoutes").find({
+        fields: ["id"],
+        filter: {
+          ...scope.filter,
+          parentId: targetParentId ?? null,
+          sort: movesForward ? {
+            $gt: sourceSort,
+            $lte: targetSort
+          } : {
+            $lt: sourceSort,
+            $gte: targetSort
+          }
+        },
+        lock: transaction.LOCK.UPDATE,
+        transaction
+      });
+      const affectedRouteIds = affectedRoutes.map((route) => route.get("id"));
+      if (affectedRouteIds.length) {
+        await ctx.db.getCollection("desktopRoutes").model.increment("sort", {
+          where: {
+            id: {
+              [import_database.Op.in]: affectedRouteIds
+            }
+          },
+          by: movesForward ? -1 : 1,
+          silent: true,
+          transaction
+        });
+      }
+      await updateSource({ sort: targetSort }, true);
+    }
+    if (requestedParentId && source.get("parentId") !== requestedParentId) {
+      await updateSource({ parentId: requestedParentId }, false);
+      if (params.method === "prepend") {
+        await updateSource({ sort: 0 }, true);
+      }
+    }
+    if (params.sticky) {
+      await updateSource({ sort: 0 }, true);
+    }
+  });
+  ctx.body = "ok";
+}
+function normalizeDesktopRouteFilterByTk(filterByTk) {
+  const values = Array.isArray(filterByTk) ? filterByTk : [filterByTk];
+  return uniqueDesktopRouteIds(
+    values.filter((value) => typeof value === "string" || typeof value === "number")
+  );
+}
+async function getDesktopRouteDestroyOwnerScope(ctx, transaction) {
+  var _a, _b, _c, _d;
+  const hasPortalScope = hasActionParam((_a = ctx.action) == null ? void 0 : _a.params, "portal");
+  const hasLayoutScope = hasActionParam((_b = ctx.action) == null ? void 0 : _b.params, "layout");
+  const portalUid = getExplicitRequestedLayoutUid((_c = ctx.action) == null ? void 0 : _c.params.portal);
+  const layoutUid = getExplicitRequestedLayoutUid((_d = ctx.action) == null ? void 0 : _d.params.layout);
+  if (hasPortalScope && hasLayoutScope) {
+    ctx.throw(400, "layout and portal cannot be used together");
+    return;
+  }
+  if (hasPortalScope) {
+    if (!portalUid) {
+      ctx.throw(400, "Invalid portal scope");
+      return;
+    }
+    const portalRequest = await findRequestedMultiPortal(ctx, transaction);
+    if (!portalRequest.scope) {
+      ctx.throw(400, "Invalid portal scope");
+      return;
+    }
+    return portalRequest.scope;
+  }
+  if (!hasLayoutScope) {
+    return;
+  }
+  if (!layoutUid) {
+    ctx.throw(400, "Invalid layout scope");
+    return;
+  }
+  const layout = await ctx.db.getRepository("uiLayouts").findOne({
+    fields: ["uid"],
+    filter: {
+      uid: layoutUid
+    },
+    transaction
+  });
+  if (!layout) {
+    ctx.throw(400, "Invalid layout scope");
+    return;
+  }
+  return {
+    filter: {
+      "uiLayouts.uid": layoutUid
+    },
+    relation: "uiLayouts",
+    uid: layoutUid
+  };
+}
+async function findDesktopRouteDestroyRoots(ctx, transaction, scopeFilter) {
+  var _a, _b, _c;
+  const filterByTk = normalizeDesktopRouteFilterByTk((_a = ctx.action) == null ? void 0 : _a.params.filterByTk);
+  const actionFilter = isRecordLike((_b = ctx.action) == null ? void 0 : _b.params.filter) ? (_c = ctx.action) == null ? void 0 : _c.params.filter : void 0;
+  if (!filterByTk.length && !actionFilter) {
+    return [];
+  }
+  const records = await ctx.db.getRepository("desktopRoutes").find({
+    fields: ["id"],
+    filter: {
+      ...actionFilter ?? {},
+      ...scopeFilter ?? {},
+      ...filterByTk.length ? { id: filterByTk } : {}
+    },
+    lock: transaction.LOCK.UPDATE,
+    transaction
+  });
+  return collectDesktopRouteIds(records);
+}
+async function findDesktopRouteSubtreeIds(ctx, rootId, transaction) {
+  const rootRoutes = await ctx.db.getRepository("desktopRoutes").find({
+    fields: ["id"],
+    filter: {
+      id: rootId
+    },
+    lock: transaction.LOCK.UPDATE,
+    transaction
+  });
+  const routeIds = collectDesktopRouteIds(rootRoutes);
+  let parentIds = [...routeIds];
+  while (parentIds.length) {
+    const children = await ctx.db.getRepository("desktopRoutes").find({
+      fields: ["id"],
+      filter: {
+        parentId: parentIds
+      },
+      lock: transaction.LOCK.UPDATE,
+      sort: ["id"],
+      transaction
+    });
+    const childIds = collectDesktopRouteIds(children).filter((routeId) => !routeIds.includes(routeId));
+    routeIds.push(...childIds);
+    parentIds = childIds;
+  }
+  return routeIds;
+}
+function getDesktopRouteOwnerUids(route, relation) {
+  const owners = getRecordField(route, relation);
+  if (!Array.isArray(owners)) {
+    return [];
+  }
+  return owners.map((owner) => getRecordField(owner, "uid")).filter((uid) => typeof uid === "string" && !!uid);
+}
+function desktopRouteHasOwnerOutsideScope(route, scope) {
+  const multiPortalUids = getDesktopRouteOwnerUids(route, "multiPortals");
+  const uiLayoutUids = getDesktopRouteOwnerUids(route, "uiLayouts");
+  if (scope.relation === "multiPortals") {
+    return multiPortalUids.some((uid) => uid !== scope.uid) || uiLayoutUids.length > 0;
+  }
+  return uiLayoutUids.some((uid) => uid !== scope.uid) || multiPortalUids.length > 0;
+}
+async function detachDesktopRouteTreeOwner(ctx, routeIds, scope, transaction) {
+  if (scope.relation === "multiPortals") {
+    await ctx.db.getRepository("rolesMultiPortalDesktopRoutes").destroy({
+      filter: {
+        multiPortalUid: scope.uid,
+        desktopRouteId: routeIds
+      },
+      transaction
+    });
+  }
+  for (const routeId of routeIds) {
+    await ctx.db.getRepository(`desktopRoutes.${scope.relation}`, routeId).remove({
+      tk: scope.uid,
+      transaction
+    });
+  }
+}
+async function detachOwnerAndFindDestroyRoots(ctx, routeIds, scope, transaction) {
+  var _a;
+  const routes = await ctx.db.getRepository("desktopRoutes").find({
+    fields: ["id", "parentId"],
+    appends: ["multiPortals", "uiLayouts"],
+    filter: {
+      id: routeIds
+    },
+    lock: transaction.LOCK.UPDATE,
+    transaction
+  });
+  const routesById = new Map(routes.map((route) => [String(route.get("id")), route]));
+  const ownerlessRouteIds = new Set(
+    routes.filter((route) => !desktopRouteHasOwnerOutsideScope(route, scope)).map((route) => String(route.get("id")))
+  );
+  await detachDesktopRouteTreeOwner(ctx, routeIds, scope, transaction);
+  for (const route of routes) {
+    if (ownerlessRouteIds.has(String(route.get("id")))) {
+      continue;
+    }
+    let parentId = route.get("parentId");
+    const visitedParentIds = /* @__PURE__ */ new Set();
+    while (parentId !== null && parentId !== void 0 && ownerlessRouteIds.has(String(parentId))) {
+      const normalizedParentId = String(parentId);
+      if (visitedParentIds.has(normalizedParentId)) {
+        ctx.throw(400, "Invalid desktop route tree");
+        return [];
+      }
+      visitedParentIds.add(normalizedParentId);
+      parentId = ((_a = routesById.get(normalizedParentId)) == null ? void 0 : _a.get("parentId")) ?? null;
+    }
+    if (route.get("parentId") !== parentId) {
+      await ctx.db.getRepository("desktopRoutes").update({
+        filterByTk: route.get("id"),
+        values: {
+          parentId
+        },
+        transaction
+      });
+    }
+  }
+  return routes.filter((route) => {
+    if (!ownerlessRouteIds.has(String(route.get("id")))) {
+      return false;
+    }
+    const parentId = route.get("parentId");
+    return parentId === null || parentId === void 0 || !ownerlessRouteIds.has(String(parentId));
+  }).map((route) => route.get("id"));
+}
+async function destroyScopedDesktopRoutes(ctx, next) {
+  var _a, _b;
+  if (!hasActionParam((_a = ctx.action) == null ? void 0 : _a.params, "portal") && !hasActionParam((_b = ctx.action) == null ? void 0 : _b.params, "layout")) {
+    await next();
+    return;
+  }
+  const result = await ctx.db.sequelize.transaction(async (transaction) => {
+    const scope = await getDesktopRouteDestroyOwnerScope(ctx, transaction);
+    if (!scope) {
+      return true;
+    }
+    const allRootIds = (await findDesktopRouteDestroyRoots(ctx, transaction)).sort(
+      (left, right) => String(left).localeCompare(String(right))
+    );
+    const rootIds = (await findDesktopRouteDestroyRoots(ctx, transaction, scope.filter)).sort(
+      (left, right) => String(left).localeCompare(String(right))
+    );
+    if (allRootIds.map(String).join(",") !== rootIds.map(String).join(",")) {
+      ctx.throw(400, "Desktop route does not belong to the requested portal scope");
+      return true;
+    }
+    const routeTrees = [];
+    for (const rootId of rootIds) {
+      routeTrees.push({
+        rootId,
+        routeIds: await findDesktopRouteSubtreeIds(ctx, rootId, transaction)
+      });
+    }
+    const rootRouteTrees = routeTrees.filter(
+      (routeTree, index) => !routeTrees.some(
+        (candidate, candidateIndex) => candidateIndex !== index && candidate.routeIds.includes(routeTree.rootId)
+      )
+    );
+    const physicalDestroyRootIds = [];
+    for (const routeTree of rootRouteTrees) {
+      physicalDestroyRootIds.push(
+        ...await detachOwnerAndFindDestroyRoots(ctx, routeTree.routeIds, scope, transaction)
+      );
+    }
+    if (!physicalDestroyRootIds.length) {
+      return true;
+    }
+    return ctx.db.getRepository("desktopRoutes").destroy({
+      context: ctx,
+      filterByTk: physicalDestroyRootIds.length === 1 ? physicalDestroyRootIds[0] : physicalDestroyRootIds,
+      transaction
+    });
+  });
+  ctx.status = 200;
+  ctx.body = result;
+}
 async function listEnabledMultiPortals(ctx, next) {
   const records = await ctx.db.getRepository("multiPortals").find({
-    filter: withCustomMultiPortalFilter({
+    filter: {
       enabled: true,
       "uiLayout.enabled": true
-    }),
+    },
     fields: [...MULTI_PORTAL_RUNTIME_QUERY_FIELDS],
     appends: ["uiLayout"],
     sort: ["uid"]
@@ -1491,40 +2198,33 @@ async function listEnabledMultiPortals(ctx, next) {
 }
 async function listAccessibleMultiPortals(ctx, next) {
   const accessiblePortalUids = await listCurrentRoleAccessibleMultiPortalUids(ctx);
-  if (Array.isArray(accessiblePortalUids) && accessiblePortalUids.length === 0) {
-    ctx.body = [];
-    await next();
-    return;
-  }
-  const filter = {
-    enabled: true,
-    "uiLayout.enabled": true
-  };
-  if (Array.isArray(accessiblePortalUids)) {
-    filter.uid = accessiblePortalUids;
-  }
   const records = await ctx.db.getRepository("multiPortals").find({
-    filter: withCustomMultiPortalFilter(filter),
+    filter: {
+      enabled: true,
+      "uiLayout.enabled": true
+    },
     fields: [...MULTI_PORTAL_ACCESSIBLE_QUERY_FIELDS],
     appends: ["uiLayout"],
     sort: ["uid"]
   });
-  ctx.body = records.map((record) => pickMultiPortalAccessibleFields(record));
+  const accessiblePortalUidSet = Array.isArray(accessiblePortalUids) ? new Set(accessiblePortalUids) : void 0;
+  const accessibleRecords = records.filter(
+    (record) => (0, import_constants.isDefaultLayoutMultiPortalUid)(record.get("uid")) || !accessiblePortalUidSet || accessiblePortalUidSet.has(String(record.get("uid")))
+  );
+  ctx.body = accessibleRecords.map((record) => pickMultiPortalAccessibleFields(record));
   await next();
 }
-async function grantDefaultRouteAccessToNewMultiPortalRoutes(ctx, multiPortalUid, desktopRouteIds) {
+async function grantDefaultRouteAccessToNewMultiPortalRoutes(ctx, multiPortalUid, desktopRouteIds, transaction) {
   if (!desktopRouteIds.length) {
     return;
   }
-  if (!ctx.db.getCollection("rolesMultiPortalRoutePolicies") || !ctx.db.getCollection("rolesMultiPortalDesktopRoutes")) {
-    return;
-  }
   const routePolicies = await ctx.db.getRepository("rolesMultiPortalRoutePolicies").find({
     fields: ["roleName"],
     filter: {
       multiPortalUid,
       allowNewMenu: true
-    }
+    },
+    transaction
   });
   const roleNames = routePolicies.map((routePolicy) => routePolicy.get("roleName")).filter((roleName) => typeof roleName === "string" && !!roleName);
   if (!roleNames.length) {
@@ -1540,26 +2240,52 @@ async function grantDefaultRouteAccessToNewMultiPortalRoutes(ctx, multiPortalUid
           multiPortalUid,
           desktopRouteId
         },
-        context: ctx
+        context: ctx,
+        transaction
       });
     }
   }
 }
-async function removeLayoutRoutePermissionsFromPortalOnlyRoutes(ctx, desktopRouteIds) {
-  if (!desktopRouteIds.length || !ctx.db.getCollection("rolesDesktopRoutes")) {
-    return;
-  }
-  const portalOnlyRouteIds = await getPortalOnlyDesktopRouteIds(ctx, desktopRouteIds);
-  if (portalOnlyRouteIds.size === 0) {
+async function removeLayoutRoutePermissionsFromPortalRoutes(ctx, desktopRouteIds, transaction) {
+  if (!desktopRouteIds.length) {
     return;
   }
   await ctx.db.getRepository("rolesDesktopRoutes").destroy({
     filter: {
-      desktopRouteId: Array.from(portalOnlyRouteIds)
+      desktopRouteId: desktopRouteIds
     },
-    context: ctx
+    context: ctx,
+    transaction
   });
 }
+async function reconcileCreatedDesktopRoutePermissions(desktopRoute, options) {
+  const ctx = options == null ? void 0 : options.context;
+  if (!ctx) {
+    return;
+  }
+  const portalRequest = await findRequestedMultiPortal(ctx, options.transaction);
+  if (!portalRequest.requested) {
+    return;
+  }
+  const scope = portalRequest.scope;
+  if (!scope) {
+    ctx.throw(400, "Invalid portal scope");
+    return;
+  }
+  if (scope.relation !== "multiPortals") {
+    return;
+  }
+  const transaction = options.transaction;
+  if (!transaction) {
+    throw new Error("Portal desktop route creation requires a transaction");
+  }
+  const desktopRouteId = desktopRoute.get("id");
+  if (typeof desktopRouteId !== "string" && typeof desktopRouteId !== "number") {
+    throw new Error("Created Portal desktop route has no identifier");
+  }
+  await removeLayoutRoutePermissionsFromPortalRoutes(ctx, [desktopRouteId], transaction);
+  await grantDefaultRouteAccessToNewMultiPortalRoutes(ctx, scope.portalUid, [desktopRouteId], transaction);
+}
 async function grantDefaultAccessToNewMultiPortal(db, multiPortal, options) {
   if (multiPortal.get("enabled") !== true) {
     return;
@@ -1568,7 +2294,7 @@ async function grantDefaultAccessToNewMultiPortal(db, multiPortal, options) {
   if (typeof multiPortalUid !== "string" || !multiPortalUid) {
     return;
   }
-  if (isDefaultMultiPortalUid(multiPortalUid)) {
+  if ((0, import_constants.isDefaultLayoutMultiPortalUid)(multiPortalUid)) {
     return;
   }
   if (!db.getCollection("roles") || !db.getCollection("rolesMultiPortals")) {
@@ -1602,7 +2328,7 @@ async function grantDefaultAccessToNewMultiPortal(db, multiPortal, options) {
       transaction: options == null ? void 0 : options.transaction
     });
   }
-  if (!db.getCollection("rolesMultiPortalRoutePolicies")) {
+  if (multiPortal.get("portalType") === "ai" || !db.getCollection("rolesMultiPortalRoutePolicies")) {
     return;
   }
   const routePolicyRepository = db.getRepository("rolesMultiPortalRoutePolicies");
@@ -1913,10 +2639,10 @@ class PluginMultiPortalServer extends import_server.Plugin {
   }
   async listAppPortalManifest(options) {
     const records = await this.db.getRepository("multiPortals").find({
-      filter: withCustomMultiPortalFilter({
+      filter: {
         enabled: true,
         "uiLayout.enabled": true
-      }),
+      },
       fields: [...MULTI_PORTAL_ACCESSIBLE_QUERY_FIELDS],
       appends: ["uiLayout"],
       sort: ["uid"],
@@ -1952,7 +2678,7 @@ class PluginMultiPortalServer extends import_server.Plugin {
     const portalType = getRecordField(multiPortal, "portalType");
     const routePath = getRecordField(multiPortal, "routePath");
     const enabled = getRecordField(multiPortal, "enabled");
-    if (typeof uid !== "string" || !uid || isDefaultMultiPortalUid(uid) || typeof title !== "string" || typeof routePath !== "string" || !routePath || enabled !== true) {
+    if (typeof uid !== "string" || !uid || typeof title !== "string" || typeof routePath !== "string" || !routePath || enabled !== true) {
       return null;
     }
     const uiLayoutUid = getRecordField(multiPortal, "uiLayoutUid");
@@ -2024,9 +2750,9 @@ class PluginMultiPortalServer extends import_server.Plugin {
       return;
     }
     const records = await this.db.getRepository("multiPortals").find({
-      filter: withCustomMultiPortalFilter({
+      filter: {
         uiLayoutUid
-      }),
+      },
       fields: [...MULTI_PORTAL_ACCESSIBLE_QUERY_FIELDS],
       transaction: options == null ? void 0 : options.transaction
     });
@@ -2085,6 +2811,9 @@ class PluginMultiPortalServer extends import_server.Plugin {
     }
   }
   async beforeLoad() {
+    this.app.db.registerRepositories({ MultiPortalDesktopRouteRepository });
+    this.app.resourceManager.registerPreActionHandler("desktopRoutes:list", addDesktopRouteEffectiveScopeFilter);
+    this.app.resourceManager.registerPreActionHandler("desktopRoutes:get", addDesktopRouteEffectiveScopeFilter);
     this.app.resourceManager.registerPreActionHandler(
       "desktopRoutes:listAccessible",
       addMultiPortalListAccessibleGuard
@@ -2097,22 +2826,23 @@ class PluginMultiPortalServer extends import_server.Plugin {
     this.app.resourceManager.registerPreActionHandler("multiPortals:create", captureSkipCreatePortalDirectory);
     this.app.resourceManager.registerPreActionHandler("multiPortals:create", normalizeMultiPortalSlugValues);
     this.app.resourceManager.registerPreActionHandler("multiPortals:create", preventUiLayoutRouteNameConflict);
-    this.app.resourceManager.registerPreActionHandler("multiPortals:update", protectDefaultMultiPortalUpdate);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:update", preventMultiPortalBackingLayoutChange);
     this.app.resourceManager.registerPreActionHandler("multiPortals:update", normalizeMultiPortalSlugValues);
     this.app.resourceManager.registerPreActionHandler("multiPortals:update", preventUiLayoutRouteNameConflict);
+    this.app.resourceManager.registerPreActionHandler(
+      "multiPortals:firstOrCreate",
+      preventMultiPortalBackingLayoutChange
+    );
     this.app.resourceManager.registerPreActionHandler("multiPortals:firstOrCreate", captureSkipCreatePortalDirectory);
     this.app.resourceManager.registerPreActionHandler("multiPortals:firstOrCreate", normalizeMultiPortalSlugValues);
     this.app.resourceManager.registerPreActionHandler("multiPortals:firstOrCreate", preventUiLayoutRouteNameConflict);
-    this.app.resourceManager.registerPreActionHandler("desktopRoutes:create", captureExplicitDesktopRouteUiLayouts, {
-      before: UI_LAYOUT_DESKTOP_ROUTE_WRITE_LAYOUT_HANDLER_TAG
-    });
     this.app.resourceManager.registerPreActionHandler(
-      "desktopRoutes:updateOrCreate",
-      captureExplicitDesktopRouteUiLayouts,
-      {
-        before: UI_LAYOUT_DESKTOP_ROUTE_WRITE_LAYOUT_HANDLER_TAG
-      }
+      "multiPortals:updateOrCreate",
+      preventMultiPortalBackingLayoutChange
     );
+    this.app.resourceManager.registerPreActionHandler("multiPortals:updateOrCreate", captureSkipCreatePortalDirectory);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:updateOrCreate", normalizeMultiPortalSlugValues);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:updateOrCreate", preventUiLayoutRouteNameConflict);
     this.app.resourceManager.registerPreActionHandler("desktopRoutes:create", addDesktopRouteCreateMultiPortal, {
       after: UI_LAYOUT_DESKTOP_ROUTE_WRITE_LAYOUT_HANDLER_TAG
     });
@@ -2123,6 +2853,9 @@ class PluginMultiPortalServer extends import_server.Plugin {
         after: UI_LAYOUT_DESKTOP_ROUTE_WRITE_LAYOUT_HANDLER_TAG
       }
     );
+    this.app.resourceManager.registerPreActionHandler("desktopRoutes:update", guardDesktopRouteUpdateScope);
+    this.app.resourceManager.registerPreActionHandler("desktopRoutes:move", guardDesktopRouteMoveScope);
+    this.app.resourceManager.registerPreActionHandler("desktopRoutes:destroy", destroyScopedDesktopRoutes);
   }
   async load() {
     this.app.acl.registerSnippet({
@@ -2163,6 +2896,7 @@ class PluginMultiPortalServer extends import_server.Plugin {
     this.app.db.on("roles.beforeCreate", (role) => {
       (0, import_ensureDefaultRoleMultiPortalAccess.applyDefaultRoleMultiPortalAccess)(role);
     });
+    this.app.db.on("desktopRoutes.afterCreate", reconcileCreatedDesktopRoutePermissions);
     this.app.db.on("multiPortals.afterCreate", async (multiPortal, options) => {
       await grantDefaultAccessToNewMultiPortal(this.app.db, multiPortal, options);
       await this.publishAppManifestItem(multiPortal, options);
@@ -2187,14 +2921,18 @@ class PluginMultiPortalServer extends import_server.Plugin {
     });
   }
   async install() {
-    await ensureDefaultMultiPortals(this.db);
-    await (0, import_ensureDefaultRoleMultiPortalAccess.ensureDefaultRoleMultiPortalAccess)(this.db);
+    const version = await this.app.version.get();
+    if (!version) {
+      await (0, import_ensureDefaultRoleMultiPortalAccess.ensureDefaultRoleMultiPortalAccess)(this.db);
+      await seedFreshMultiPortals(this.db);
+    } else {
+      await seedHistoricalMultiPortals(this.db);
+    }
     await this.reconcilePortalStorage();
     await this.reconcileAppManifest();
   }
   async afterEnable() {
-    await ensureDefaultMultiPortals(this.db);
-    await (0, import_ensureDefaultRoleMultiPortalAccess.ensureDefaultRoleMultiPortalAccess)(this.db);
+    await repairFixedLayoutMultiPortalRecords(this.db);
     await this.reconcilePortalStorage();
     await this.reconcileAppManifest();
   }