@nu-art/permissions-backend 0.400.5

package/PermissionKey_BE.d.ts

@@ -0,0 +1,13 @@
+import { TypedKeyValue } from '@nu-art/ts-common';
+import { AppConfigKey_BE } from '@nu-art/thunderstorm-backend';
+import { DB_PermissionKeyData } from '@nu-art/permissions-shared';
+type Resolver = () => Promise<DB_PermissionKeyData>;
+export declare class PermissionKey_BE<K extends string> extends AppConfigKey_BE<TypedKeyValue<K, DB_PermissionKeyData>> {
+    static _resolver: Resolver;
+    static buildData: (data: DB_PermissionKeyData) => Promise<DB_PermissionKeyData>;
+    constructor(key: K, initialDataResolver?: Resolver);
+    set(value: DB_PermissionKeyData): Promise<void>;
+}
+export declare const defaultValueResolverV2: (domainId: string, accessLevelName: string) => Promise<DB_PermissionKeyData>;
+export declare const defaultValueResolver: (domainNamespace: string, accessLevelValue: number) => Promise<DB_PermissionKeyData>;
+export {};

package/PermissionKey_BE.js

@@ -0,0 +1,48 @@
+import { filterInstances } from '@nu-art/ts-common';
+import { ModuleBE_PermissionAccessLevelDB, ModuleBE_PermissionDomainDB } from './_entity.js';
+import { AppConfigKey_BE, ModuleBE_AppConfigDB } from '@nu-art/thunderstorm-backend';
+import { Const_PermissionKeyType } from '@nu-art/permissions-shared';
+export class PermissionKey_BE extends AppConfigKey_BE {
+    static _resolver = async () => {
+        return { type: Const_PermissionKeyType, accessLevelIds: [], _accessLevels: {} };
+    };
+    static buildData = async (data) => {
+        ModuleBE_AppConfigDB.logVerbose('**************** Building Data ****************');
+        const accessLevels = filterInstances(await ModuleBE_PermissionAccessLevelDB.query.all(data.accessLevelIds));
+        const _data = {
+            type: 'permission-key',
+            accessLevelIds: data.accessLevelIds,
+            _accessLevels: accessLevels.reduce((acc, level) => {
+                acc[level.domainId] = level.value;
+                return acc;
+            }, {})
+        };
+        ModuleBE_AppConfigDB.logVerbose('**************** Data ****************');
+        ModuleBE_AppConfigDB.logVerbose(_data);
+        return _data;
+    };
+    constructor(key, initialDataResolver) {
+        super(key, initialDataResolver ?? PermissionKey_BE._resolver, PermissionKey_BE.buildData);
+    }
+    async set(value) {
+        const dbValue = await PermissionKey_BE.buildData(value);
+        await super.set(dbValue);
+    }
+}
+export const defaultValueResolverV2 = async (domainId, accessLevelName) => {
+    const accessLevel = await ModuleBE_PermissionAccessLevelDB.query.uniqueCustom({ where: { domainId, name: accessLevelName } });
+    return {
+        type: Const_PermissionKeyType,
+        accessLevelIds: [accessLevel._id],
+        _accessLevels: { [accessLevel._id]: accessLevel.value }
+    };
+};
+export const defaultValueResolver = async (domainNamespace, accessLevelValue) => {
+    const domain = await ModuleBE_PermissionDomainDB.query.uniqueCustom({ where: { namespace: domainNamespace } });
+    const accessLevel = await ModuleBE_PermissionAccessLevelDB.query.uniqueCustom({ where: { domainId: domain._id, value: accessLevelValue } });
+    return {
+        type: Const_PermissionKeyType,
+        accessLevelIds: [accessLevel._id],
+        _accessLevels: { [accessLevel._id]: accessLevel.value }
+    };
+};

package/_entity/permission-access-level/ModuleBE_PermissionAccessLevelDB.d.ts

@@ -0,0 +1,18 @@
+import { DBApiConfigV3, ModuleBE_BaseDB } from '@nu-art/thunderstorm-backend';
+import { Clause_Where } from '@nu-art/firebase-shared';
+import { FirestoreTransaction } from '@nu-art/firebase-backend';
+import { Transaction } from 'firebase-admin/firestore';
+import { CollectionActionType, PostWriteProcessingData } from '@nu-art/firebase-backend/firestore-v3/FirestoreCollectionV3';
+import { DB_PermissionAccessLevel, DBProto_PermissionAccessLevel } from '@nu-art/permissions-shared';
+type Config = DBApiConfigV3<DBProto_PermissionAccessLevel> & {};
+export declare class ModuleBE_PermissionAccessLevelDB_Class extends ModuleBE_BaseDB<DBProto_PermissionAccessLevel, Config> {
+    constructor();
+    protected internalFilter(item: DB_PermissionAccessLevel): Clause_Where<DB_PermissionAccessLevel>[];
+    protected preWriteProcessing(dbInstance: DB_PermissionAccessLevel, originalDbInstance: DBProto_PermissionAccessLevel['dbType'], transaction?: Transaction): Promise<void>;
+    protected postWriteProcessing(data: PostWriteProcessingData<DBProto_PermissionAccessLevel>, actionType: CollectionActionType, transaction?: Transaction): Promise<void>;
+    protected assertDeletion(transaction: FirestoreTransaction, dbInstance: DB_PermissionAccessLevel): Promise<void>;
+    private upgrade_100_101;
+}
+export declare const ModuleBE_PermissionAccessLevelDB: ModuleBE_PermissionAccessLevelDB_Class;
+export declare function checkDuplicateLevelsDomain(levels: DB_PermissionAccessLevel[]): void;
+export {};

package/_entity/permission-access-level/ModuleBE_PermissionAccessLevelDB.js

@@ -0,0 +1,55 @@
+import { ModuleBE_BaseDB, } from '@nu-art/thunderstorm-backend';
+import { ApiException, batchActionParallel, dbObjectToId, filterDuplicates } from '@nu-art/ts-common';
+import { MemKey_AccountId } from '@nu-art/user-account-backend';
+import { ModuleBE_PermissionAPIDB } from '../permission-api/index.js';
+import { ModuleBE_PermissionDomainDB } from '../permission-domain/index.js';
+import { ModuleBE_PermissionGroupDB } from '../permission-group/index.js';
+import { DBDef_PermissionAccessLevel } from '@nu-art/permissions-shared';
+export class ModuleBE_PermissionAccessLevelDB_Class extends ModuleBE_BaseDB {
+    constructor() {
+        super(DBDef_PermissionAccessLevel);
+        this.registerVersionUpgradeProcessor('1.0.0', this.upgrade_100_101);
+    }
+    internalFilter(item) {
+        const { domainId, name, value } = item;
+        return [{ domainId, name }, { domainId, value }];
+    }
+    async preWriteProcessing(dbInstance, originalDbInstance, transaction) {
+        await ModuleBE_PermissionDomainDB.query.uniqueAssert(dbInstance.domainId);
+        dbInstance._auditorId = MemKey_AccountId.get();
+    }
+    async postWriteProcessing(data, actionType, transaction) {
+        const deleted = data.deleted ? (Array.isArray(data.deleted) ? data.deleted : [data.deleted]) : [];
+        const updated = data.updated ? (Array.isArray(data.updated) ? data.updated : [data.updated]) : [];
+        //Collect all apis that hold an access level id in the levels that have changed
+        const deletedIds = deleted.map(dbObjectToId);
+        const levelIds = [...deletedIds, ...updated.map(dbObjectToId)];
+        const _connectedApis = await batchActionParallel(levelIds, 10, async (ids) => await ModuleBE_PermissionAPIDB.query.custom({ where: { accessLevelIds: { $aca: ids } } }));
+        const connectedApis = filterDuplicates(_connectedApis, api => api._id);
+        deletedIds.forEach(id => {
+            //For each deleted level remove it from any api that held it
+            connectedApis.forEach(api => {
+                api.accessLevelIds = api.accessLevelIds?.filter(i => i !== id);
+            });
+        });
+        //Send all apis to upsert so their _accessLevels update
+        await ModuleBE_PermissionAPIDB.set.all(connectedApis);
+        return super.postWriteProcessing(data, actionType, transaction);
+    }
+    async assertDeletion(transaction, dbInstance) {
+        const groups = await ModuleBE_PermissionGroupDB.query.custom({ where: { accessLevelIds: { $ac: dbInstance._id } } });
+        const apis = await ModuleBE_PermissionAPIDB.query.custom({ where: { accessLevelIds: { $ac: dbInstance._id } } });
+        if (groups.length || apis.length)
+            throw new ApiException(403, 'You trying delete access level that associated with users/groups/apis, you need delete the associations first');
+    }
+    upgrade_100_101 = async (items) => {
+        items.forEach(accessLevel => accessLevel.uiLabel = accessLevel.name);
+    };
+}
+export const ModuleBE_PermissionAccessLevelDB = new ModuleBE_PermissionAccessLevelDB_Class();
+export function checkDuplicateLevelsDomain(levels) {
+    const domainIds = levels.map(level => level.domainId);
+    const filteredDomainIds = filterDuplicates(domainIds);
+    if (filteredDomainIds.length !== domainIds.length)
+        throw new ApiException(422, 'You trying test-add-data duplicate accessLevel with the same domain');
+}

package/_entity/permission-access-level/index.d.ts

@@ -0,0 +1,2 @@
+export * from './ModuleBE_PermissionAccessLevelDB.js';
+export * from './module-pack.js';

package/_entity/permission-access-level/index.js

@@ -0,0 +1,2 @@
+export * from './ModuleBE_PermissionAccessLevelDB.js';
+export * from './module-pack.js';

package/_entity/permission-access-level/module-pack.d.ts

@@ -0,0 +1 @@
+export declare const ModulePackBE_PermissionAccessLevel: (import("./ModuleBE_PermissionAccessLevelDB.js").ModuleBE_PermissionAccessLevelDB_Class | import("@nu-art/thunderstorm-backend").ModuleBE_BaseApi_Class<import("@nu-art/permissions-shared").DBProto_PermissionAccessLevel>)[];

package/_entity/permission-access-level/module-pack.js

@@ -0,0 +1,3 @@
+import { createApisForDBModuleV3 } from '@nu-art/thunderstorm-backend';
+import { ModuleBE_PermissionAccessLevelDB } from './ModuleBE_PermissionAccessLevelDB.js';
+export const ModulePackBE_PermissionAccessLevel = [ModuleBE_PermissionAccessLevelDB, createApisForDBModuleV3(ModuleBE_PermissionAccessLevelDB)];

package/_entity/permission-api/ModuleBE_PermissionAPIDB.d.ts

@@ -0,0 +1,12 @@
+import { DBApiConfigV3, ModuleBE_BaseDB, ServerApi } from '@nu-art/thunderstorm-backend';
+import { DB_PermissionAPI, DBProto_PermissionAPI } from '@nu-art/permissions-shared';
+import { Transaction } from 'firebase-admin/firestore';
+type Config = DBApiConfigV3<DBProto_PermissionAPI> & {};
+export declare class ModuleBE_PermissionAPIDB_Class extends ModuleBE_BaseDB<DBProto_PermissionAPI, Config> {
+    constructor();
+    protected preWriteProcessing(instance: DB_PermissionAPI, originalDbInstance: DBProto_PermissionAPI['dbType'], t?: Transaction): Promise<void>;
+    registerApis(projectId: string, routes: string[]): Promise<DB_PermissionAPI[]>;
+    apiUpsert(): ServerApi<any> | undefined;
+}
+export declare const ModuleBE_PermissionAPIDB: ModuleBE_PermissionAPIDB_Class;
+export {};

package/_entity/permission-api/ModuleBE_PermissionAPIDB.js

@@ -0,0 +1,62 @@
+import { ModuleBE_BaseDB, } from '@nu-art/thunderstorm-backend';
+import { DBDef_PermissionAPI } from '@nu-art/permissions-shared';
+import { dbObjectToId, filterInstances } from '@nu-art/ts-common';
+import { ModuleBE_PermissionAccessLevelDB } from '../permission-access-level/index.js';
+import { MemKey_AccountId } from '@nu-art/user-account-backend';
+import { ModuleBE_PermissionProjectDB } from '../permission-project/index.js';
+import { HttpCodes } from '@nu-art/ts-common/core/exceptions/http-codes';
+import { trimStartingForwardSlash } from '@nu-art/thunderstorm-shared/route-tools';
+export class ModuleBE_PermissionAPIDB_Class extends ModuleBE_BaseDB {
+    constructor() {
+        super(DBDef_PermissionAPI);
+        this.registerVersionUpgradeProcessor('1.0.0', async (instances) => {
+        }); // adjustment made in pre-write requires us to do this in order to upgrade the data
+    }
+    async preWriteProcessing(instance, originalDbInstance, t) {
+        await ModuleBE_PermissionProjectDB.query.uniqueAssert(instance.projectId);
+        // clean '/' from api path start
+        instance.path = trimStartingForwardSlash(instance.path);
+        // set who created this
+        instance._auditorId = MemKey_AccountId.get();
+        const accessLevelIds = new Set();
+        const duplicateAccessLevelIds = new Set();
+        //Check for duplicated Unique IDs
+        instance.accessLevelIds?.forEach(id => {
+            const duplicate = accessLevelIds.has(id);
+            accessLevelIds.add(id);
+            if (duplicate)
+                duplicateAccessLevelIds.add(id);
+        });
+        if (duplicateAccessLevelIds.size)
+            throw HttpCodes._4XX.BAD_REQUEST('Could not update permission api', `Trying to create API with duplicate access levels: ${duplicateAccessLevelIds}`);
+        // Verify all AccessLevels actually exist, and assign _accessLevels
+        if (instance.accessLevelIds?.length) {
+            const dbAccessLevels = filterInstances(await ModuleBE_PermissionAccessLevelDB.query.all(instance.accessLevelIds));
+            if (dbAccessLevels.length !== instance.accessLevelIds.length) {
+                const dbAccessLevelIds = dbAccessLevels.map(dbObjectToId);
+                throw HttpCodes._4XX.NOT_FOUND('Could not update permission api', `Asked to assign an api non existing accessLevels: ${instance.accessLevelIds.filter(id => !dbAccessLevelIds.includes(id))}`);
+            }
+            dbAccessLevels.forEach(accessLevel => {
+                if (!instance._accessLevels)
+                    instance._accessLevels = {};
+                instance._accessLevels[accessLevel.domainId] = accessLevel.value;
+            });
+        }
+        else {
+            instance._accessLevels = {};
+        }
+    }
+    registerApis(projectId, routes) {
+        return this.runTransaction(async (transaction) => {
+            const existingProjectApis = await this.query.custom({ where: { projectId: projectId } }, transaction);
+            const apisToAdd = routes
+                .filter(path => !existingProjectApis.find(api => api.path === path))
+                .map(path => ({ path, projectId: projectId, _auditorId: MemKey_AccountId.get() }));
+            return this.set.all(apisToAdd, transaction);
+        });
+    }
+    apiUpsert() {
+        return;
+    }
+}
+export const ModuleBE_PermissionAPIDB = new ModuleBE_PermissionAPIDB_Class();

package/_entity/permission-api/index.d.ts

@@ -0,0 +1,2 @@
+export * from './ModuleBE_PermissionAPIDB.js';
+export * from './module-pack.js';

package/_entity/permission-api/index.js

@@ -0,0 +1,2 @@
+export * from './ModuleBE_PermissionAPIDB.js';
+export * from './module-pack.js';

package/_entity/permission-api/module-pack.d.ts

@@ -0,0 +1 @@
+export declare const ModulePackBE_PermissionAPI: (import("./ModuleBE_PermissionAPIDB.js").ModuleBE_PermissionAPIDB_Class | import("@nu-art/thunderstorm-backend").ModuleBE_BaseApi_Class<import("@nu-art/permissions-shared").DBProto_PermissionAPI>)[];

package/_entity/permission-api/module-pack.js

@@ -0,0 +1,3 @@
+import { createApisForDBModuleV3 } from '@nu-art/thunderstorm-backend';
+import { ModuleBE_PermissionAPIDB } from './ModuleBE_PermissionAPIDB.js';
+export const ModulePackBE_PermissionAPI = [ModuleBE_PermissionAPIDB, createApisForDBModuleV3(ModuleBE_PermissionAPIDB)];

package/_entity/permission-domain/ModuleBE_PermissionDomainDB.d.ts

@@ -0,0 +1,15 @@
+import { DBApiConfigV3, ModuleBE_BaseDB } from '@nu-art/thunderstorm-backend';
+import { DB_PermissionDomain, DBProto_PermissionDomain } from '@nu-art/permissions-shared';
+import { Transaction } from 'firebase-admin/firestore';
+type Config = DBApiConfigV3<DBProto_PermissionDomain> & {};
+export declare class ModuleBE_PermissionDomainDB_Class extends ModuleBE_BaseDB<DBProto_PermissionDomain, Config> {
+    constructor();
+    protected assertDeletion(transaction: Transaction, dbInstance: DB_PermissionDomain): Promise<void>;
+    internalFilter(item: DB_PermissionDomain): {
+        namespace: string;
+        projectId: string;
+    }[];
+    protected preWriteProcessing(dbInstance: DB_PermissionDomain, originalDbInstance: DBProto_PermissionDomain['dbType'], t?: Transaction): Promise<void>;
+}
+export declare const ModuleBE_PermissionDomainDB: ModuleBE_PermissionDomainDB_Class;
+export {};

package/_entity/permission-domain/ModuleBE_PermissionDomainDB.js

@@ -0,0 +1,25 @@
+import { ModuleBE_BaseDB, } from '@nu-art/thunderstorm-backend';
+import { DBDef_PermissionDomain } from '@nu-art/permissions-shared';
+import { ApiException } from '@nu-art/ts-common';
+import { MemKey_AccountId } from '@nu-art/user-account-backend';
+import { ModuleBE_PermissionAccessLevelDB } from '../permission-access-level/index.js';
+import { ModuleBE_PermissionProjectDB } from '../permission-project/index.js';
+export class ModuleBE_PermissionDomainDB_Class extends ModuleBE_BaseDB {
+    constructor() {
+        super(DBDef_PermissionDomain);
+    }
+    async assertDeletion(transaction, dbInstance) {
+        const accessLevels = await ModuleBE_PermissionAccessLevelDB.query.custom({ where: { domainId: dbInstance._id } });
+        if (accessLevels.length) {
+            throw new ApiException(403, 'You trying delete domain that associated with accessLevels, you need delete the accessLevels first');
+        }
+    }
+    internalFilter(item) {
+        return [{ namespace: item.namespace, projectId: item.projectId }];
+    }
+    async preWriteProcessing(dbInstance, originalDbInstance, t) {
+        await ModuleBE_PermissionProjectDB.query.uniqueAssert(dbInstance.projectId, t);
+        dbInstance._auditorId = MemKey_AccountId.get();
+    }
+}
+export const ModuleBE_PermissionDomainDB = new ModuleBE_PermissionDomainDB_Class();

package/_entity/permission-domain/index.d.ts

@@ -0,0 +1,2 @@
+export * from './ModuleBE_PermissionDomainDB.js';
+export * from './module-pack.js';

package/_entity/permission-domain/index.js

@@ -0,0 +1,2 @@
+export * from './ModuleBE_PermissionDomainDB.js';
+export * from './module-pack.js';

package/_entity/permission-domain/module-pack.d.ts

@@ -0,0 +1 @@
+export declare const ModulePackBE_PermissionDomain: (import("./ModuleBE_PermissionDomainDB.js").ModuleBE_PermissionDomainDB_Class | import("@nu-art/thunderstorm-backend").ModuleBE_BaseApi_Class<import("@nu-art/permissions-shared").DBProto_PermissionDomain>)[];

package/_entity/permission-domain/module-pack.js

@@ -0,0 +1,3 @@
+import { createApisForDBModuleV3 } from '@nu-art/thunderstorm-backend';
+import { ModuleBE_PermissionDomainDB } from './ModuleBE_PermissionDomainDB.js';
+export const ModulePackBE_PermissionDomain = [ModuleBE_PermissionDomainDB, createApisForDBModuleV3(ModuleBE_PermissionDomainDB)];

package/_entity/permission-group/ModuleBE_PermissionGroupDB.d.ts

@@ -0,0 +1,14 @@
+import { DBApiConfigV3, ModuleBE_BaseDB } from '@nu-art/thunderstorm-backend';
+import { DB_PermissionGroup, DBProto_PermissionGroup } from '@nu-art/permissions-shared';
+import { Transaction } from 'firebase-admin/firestore';
+import { CollectionActionType, PostWriteProcessingData } from '@nu-art/firebase-backend/firestore-v3/FirestoreCollectionV3';
+type Config = DBApiConfigV3<DBProto_PermissionGroup> & {};
+export declare class ModuleBE_PermissionGroupDB_Class extends ModuleBE_BaseDB<DBProto_PermissionGroup, Config> {
+    constructor();
+    protected preWriteProcessing(instance: DB_PermissionGroup, originalDbInstance: DBProto_PermissionGroup['dbType'], t?: Transaction): Promise<void>;
+    protected postWriteProcessing(data: PostWriteProcessingData<DBProto_PermissionGroup>, actionType: CollectionActionType): Promise<void>;
+    private clearUnused;
+    private upgrade_100_101;
+}
+export declare const ModuleBE_PermissionGroupDB: ModuleBE_PermissionGroupDB_Class;
+export {};

package/_entity/permission-group/ModuleBE_PermissionGroupDB.js

@@ -0,0 +1,62 @@
+import { ModuleBE_ActionProcessor, ModuleBE_BaseDB, } from '@nu-art/thunderstorm-backend';
+import { DBDef_PermissionGroup } from '@nu-art/permissions-shared';
+import { _keys, ApiException, batchActionParallel, dbObjectToId, filterDuplicates, filterInstances, reduceToMap } from '@nu-art/ts-common';
+import { ModuleBE_PermissionAccessLevelDB } from '../permission-access-level/index.js';
+import { MemKey_AccountId, SlackReporter } from '@nu-art/user-account-backend';
+import { ModuleBE_PermissionUserDB } from '../permission-user/index.js';
+import { _EmptyQuery } from '@nu-art/firebase-shared';
+export class ModuleBE_PermissionGroupDB_Class extends ModuleBE_BaseDB {
+    constructor() {
+        super(DBDef_PermissionGroup);
+        ModuleBE_ActionProcessor.registerAction({
+            key: 'clear-unused-permission-groups',
+            group: 'Permissions',
+            description: 'Clears all permission groups that aren\'t in use',
+            processor: this.clearUnused
+        }, this);
+        this.registerVersionUpgradeProcessor('1.0.0', this.upgrade_100_101);
+    }
+    async preWriteProcessing(instance, originalDbInstance, t) {
+        instance._auditorId = MemKey_AccountId.get();
+        const dbLevels = filterInstances(await ModuleBE_PermissionAccessLevelDB.query.all(instance.accessLevelIds, t));
+        if (dbLevels.length < instance.accessLevelIds.length) {
+            const dbAccessLevelIds = dbLevels.map(dbObjectToId);
+            throw new ApiException(404, `Asked to assign a group non existing accessLevels: ${instance.accessLevelIds.filter(id => !dbAccessLevelIds.includes(id))}`);
+        }
+        // Find if there is more than one access level with the same domainId.
+        const duplicationMap = dbLevels.reduce((map, level) => {
+            if (map[level.domainId] === undefined)
+                map[level.domainId] = 0;
+            else
+                map[level.domainId]++;
+            return map;
+        }, {});
+        // Get all domainIds that appear more than once in this group
+        const duplicateDomainIds = filterInstances(_keys(duplicationMap)
+            .map(domainId => duplicationMap[domainId] > 1 ? domainId : undefined));
+        if (duplicateDomainIds.length > 0)
+            throw new ApiException(400, `Can't add a group with more than one access level per domain: ${duplicateDomainIds}, group: ${instance.label}`);
+        instance._levelsMap = reduceToMap(dbLevels, dbLevel => dbLevel.domainId, dbLevel => dbLevel.value);
+    }
+    async postWriteProcessing(data, actionType) {
+        const deleted = data.deleted ? (Array.isArray(data.deleted) ? data.deleted : [data.deleted]) : [];
+        const updated = data.updated ? (Array.isArray(data.updated) ? data.updated : [data.updated]) : [];
+        const groupIds = filterDuplicates([...deleted, ...updated].map(dbObjectToId));
+        const users = await batchActionParallel(groupIds, 10, async (ids) => await ModuleBE_PermissionUserDB.query.custom({ where: { __groupIds: { $aca: ids } } }));
+        await ModuleBE_PermissionUserDB.invalidateSession(users.map(dbObjectToId));
+    }
+    clearUnused = async () => {
+        let report = 'Report for refactor action *Clean Unused Permission Groups*:\n\n';
+        const allPermissionUsers = await ModuleBE_PermissionUserDB.query.custom(_EmptyQuery);
+        const allGroups = await this.query.custom(_EmptyQuery);
+        const usedGroupIds = allPermissionUsers.map(user => user.__groupIds ?? []).flat();
+        const unusedGroups = allGroups.filter(group => !usedGroupIds.includes(group._id));
+        report += `Cleared ${unusedGroups.length} groups: ${unusedGroups.map(group => group.label).join(',\n')}`;
+        await this.delete.allItems(unusedGroups);
+        await new SlackReporter(report).sendReportToChannel();
+    };
+    upgrade_100_101 = async (items) => {
+        items.forEach(group => group.uiLabel = group.label);
+    };
+}
+export const ModuleBE_PermissionGroupDB = new ModuleBE_PermissionGroupDB_Class();

package/_entity/permission-group/index.d.ts

@@ -0,0 +1,2 @@
+export * from './ModuleBE_PermissionGroupDB.js';
+export * from './module-pack.js';

package/_entity/permission-group/index.js

@@ -0,0 +1,2 @@
+export * from './ModuleBE_PermissionGroupDB.js';
+export * from './module-pack.js';

package/_entity/permission-group/module-pack.d.ts

@@ -0,0 +1 @@
+export declare const ModulePackBE_PermissionGroup: (import("./ModuleBE_PermissionGroupDB.js").ModuleBE_PermissionGroupDB_Class | import("@nu-art/thunderstorm-backend").ModuleBE_BaseApi_Class<import("@nu-art/permissions-shared").DBProto_PermissionGroup>)[];

package/_entity/permission-group/module-pack.js

@@ -0,0 +1,3 @@
+import { createApisForDBModuleV3 } from '@nu-art/thunderstorm-backend';
+import { ModuleBE_PermissionGroupDB } from './ModuleBE_PermissionGroupDB.js';
+export const ModulePackBE_PermissionGroup = [ModuleBE_PermissionGroupDB, createApisForDBModuleV3(ModuleBE_PermissionGroupDB)];

package/_entity/permission-project/ModuleBE_PermissionProjectDB.d.ts

@@ -0,0 +1,10 @@
+import { DBApiConfigV3, ModuleBE_BaseDB } from '@nu-art/thunderstorm-backend';
+import { DB_PermissionProject, DBProto_PermissionProject } from '@nu-art/permissions-shared';
+import { Transaction } from 'firebase-admin/firestore';
+type Config = DBApiConfigV3<DBProto_PermissionProject> & {};
+export declare class ModuleBE_PermissionProjectDB_Class extends ModuleBE_BaseDB<DBProto_PermissionProject, Config> {
+    constructor();
+    protected preWriteProcessing(dbInstance: DB_PermissionProject, originalDbInstance: DBProto_PermissionProject['dbType'], t?: Transaction): Promise<void>;
+}
+export declare const ModuleBE_PermissionProjectDB: ModuleBE_PermissionProjectDB_Class;
+export {};

package/_entity/permission-project/ModuleBE_PermissionProjectDB.js

@@ -0,0 +1,12 @@
+import { ModuleBE_BaseDB, } from '@nu-art/thunderstorm-backend';
+import { DBDef_PermissionProject } from '@nu-art/permissions-shared';
+import { MemKey_AccountId } from '@nu-art/user-account-backend';
+export class ModuleBE_PermissionProjectDB_Class extends ModuleBE_BaseDB {
+    constructor() {
+        super(DBDef_PermissionProject);
+    }
+    async preWriteProcessing(dbInstance, originalDbInstance, t) {
+        dbInstance._auditorId = MemKey_AccountId.get();
+    }
+}
+export const ModuleBE_PermissionProjectDB = new ModuleBE_PermissionProjectDB_Class();

package/_entity/permission-project/index.d.ts

@@ -0,0 +1,2 @@
+export * from './ModuleBE_PermissionProjectDB.js';
+export * from './module-pack.js';

package/_entity/permission-project/index.js

@@ -0,0 +1,2 @@
+export * from './ModuleBE_PermissionProjectDB.js';
+export * from './module-pack.js';

package/_entity/permission-project/module-pack.d.ts

@@ -0,0 +1 @@
+export declare const ModulePackBE_PermissionProject: (import("./ModuleBE_PermissionProjectDB.js").ModuleBE_PermissionProjectDB_Class | import("@nu-art/thunderstorm-backend").ModuleBE_BaseApi_Class<import("@nu-art/permissions-shared").DBProto_PermissionProject>)[];

package/_entity/permission-project/module-pack.js

@@ -0,0 +1,3 @@
+import { createApisForDBModuleV3 } from '@nu-art/thunderstorm-backend';
+import { ModuleBE_PermissionProjectDB } from './ModuleBE_PermissionProjectDB.js';
+export const ModulePackBE_PermissionProject = [ModuleBE_PermissionProjectDB, createApisForDBModuleV3(ModuleBE_PermissionProjectDB)];

package/_entity/permission-user/ModuleBE_PermissionUserAPI.d.ts

@@ -0,0 +1,8 @@
+import { ModuleBE_BaseApi_Class } from '@nu-art/thunderstorm-backend';
+import { DBProto_PermissionUser } from '@nu-art/permissions-shared';
+declare class ModuleBE_PermissionUserAPI_Class extends ModuleBE_BaseApi_Class<DBProto_PermissionUser> {
+    constructor();
+    init(): void;
+}
+export declare const ModuleBE_PermissionUserAPI: ModuleBE_PermissionUserAPI_Class;
+export {};

package/_entity/permission-user/ModuleBE_PermissionUserAPI.js

@@ -0,0 +1,13 @@
+import { addRoutes, createBodyServerApi, ModuleBE_BaseApi_Class } from '@nu-art/thunderstorm-backend';
+import { ApiDef_PermissionUser } from '@nu-art/permissions-shared';
+import { ModuleBE_PermissionUserDB } from './ModuleBE_PermissionUserDB.js';
+class ModuleBE_PermissionUserAPI_Class extends ModuleBE_BaseApi_Class {
+    constructor() {
+        super(ModuleBE_PermissionUserDB);
+    }
+    init() {
+        super.init();
+        addRoutes([createBodyServerApi(ApiDef_PermissionUser._v1.assignPermissions, ModuleBE_PermissionUserDB.assignPermissions)]);
+    }
+}
+export const ModuleBE_PermissionUserAPI = new ModuleBE_PermissionUserAPI_Class();

package/_entity/permission-user/ModuleBE_PermissionUserDB.d.ts

@@ -0,0 +1,36 @@
+import { DBApiConfigV3, ModuleBE_BaseDB } from '@nu-art/thunderstorm-backend';
+import { DB_PermissionUser, DBProto_PermissionUser, Request_AssignPermissions, User_Group } from '@nu-art/permissions-shared';
+import { PerformProjectSetup } from '@nu-art/thunderstorm-backend/modules/action-processor/Action_SetupProject';
+import { DB_BaseObject, UniqueId } from '@nu-art/ts-common';
+import { OnNewUserRegistered, OnUserLogin } from '@nu-art/user-account-backend';
+import { Transaction } from 'firebase-admin/firestore';
+import { UI_Account } from '@nu-art/user-account-shared';
+import { CollectionActionType, PostWriteProcessingData } from '@nu-art/firebase-backend/firestore-v3/FirestoreCollectionV3';
+type Config = DBApiConfigV3<DBProto_PermissionUser> & {};
+export declare class ModuleBE_PermissionUserDB_Class extends ModuleBE_BaseDB<DBProto_PermissionUser, Config> implements OnNewUserRegistered, OnUserLogin, PerformProjectSetup {
+    private defaultPermissionGroups?;
+    constructor();
+    __performProjectSetup(): {
+        priority: number;
+        processor: () => Promise<void>;
+    };
+    __onUserLogin(account: UI_Account, transaction: Transaction): Promise<void>;
+    __onNewUserRegistered(account: UI_Account, transaction: Transaction): Promise<void>;
+    protected preWriteProcessing(instance: DB_PermissionUser, originalDbInstance: DBProto_PermissionUser['dbType'], t?: Transaction): Promise<void>;
+    protected postWriteProcessing(data: PostWriteProcessingData<DBProto_PermissionUser>, actionType: CollectionActionType): Promise<void>;
+    insertIfNotExist: (uiAccount: UI_Account & DB_BaseObject, transaction: Transaction) => Promise<DB_PermissionUser | (Omit<DB_PermissionUser, "_id" | "__metadata1" | "__hardDelete" | "__created" | "__updated" | "_v" | "_originDocId" | ("_auditorId" | "__groupIds")> & Partial<import("@nu-art/ts-common").SubsetObjectByKeys<DB_PermissionUser, "_id" | "__metadata1" | "__hardDelete" | "__created" | "__updated" | "_v" | "_originDocId" | ("_auditorId" | "__groupIds")>> & Partial<import("@nu-art/ts-common").DB_Object>)>;
+    assignPermissions(body: Request_AssignPermissions): Promise<void>;
+    setDefaultPermissionGroups: (groupsGetter: () => Promise<User_Group[]>) => void;
+    clearDefaultPermissionGroups: () => void;
+    /**
+     * The system requires to perform action, which in other cases can also be done by a human.
+     * This requires system features to identify as a bot user, or "Service Account"
+     *
+     * @param serviceAccounts - List of Accounts to create
+     * @private
+     */
+    private createSystemServiceAccount;
+    invalidateSession(accountIds: UniqueId[]): Promise<void>;
+}
+export declare const ModuleBE_PermissionUserDB: ModuleBE_PermissionUserDB_Class;
+export {};