@nu-art/permissions-backend 0.401.8 → 0.500.0

package/modules/ModuleBE_Permissions.js

@@ -1,15 +1,51 @@
-import { _keys, arrayToMap, Dispatcher, filterInstances, flatArray, Module, MUSTNeverHappenException, reduceToMap, RuntimeModules, } from '@nu-art/ts-common';
-import { addRoutes, createQueryServerApi, MemKey_ServerApi, ModuleBE_AppConfigDB, Storm } from '@nu-art/thunderstorm-backend';
-import { ApiDef_Permissions, DefaultAccessLevel_Admin, DefaultAccessLevel_NoAccess, DefaultAccessLevel_Read, DefaultAccessLevel_Write, defaultLevelsRouteLookupWords, DuplicateDefaultAccessLevels, } from '@nu-art/permissions-shared';
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+import { _keys, arrayToMap, Dispatcher, filterInstances, flatArray, md5, Module, MUSTNeverHappenException, reduceToMap, } from '@nu-art/ts-common';
+import { ApiHandler, MemKey_ServerApi } from '@nu-art/http-server';
+import { RuntimeBE_Modules } from '@nu-art/db-api-backend';
+import { ApiDef_Permissions, DefaultAccessLevel_Admin, DefaultAccessLevel_Delete, DefaultAccessLevel_NoAccess, DefaultAccessLevel_Read, DefaultAccessLevel_Write, defaultLevelsRouteLookupWords, DuplicateDefaultAccessLevels, toPermissionDomainId, toPermissionGroupId, toPermissionProjectId, trimStartingForwardSlash, } from '@nu-art/permissions-shared';
 import { MemKey_AccountId, ModuleBE_SessionDB } from '@nu-art/user-account-backend';
+import { getRegisteredFunctionPermissions } from '../core/function-permission-registry.js';
 import { Domain_AccountManagement, Domain_Developer, Domain_PermissionsAssign, Domain_PermissionsDefine, PermissionsPackage_Developer, PermissionsPackage_Permissions } from '../permissions.js';
 import { ModuleBE_PermissionsAssert } from './ModuleBE_PermissionsAssert.js';
+import { getCreatePermissionKeyDefaults, getEnvConfigRef } from '../permissions-wire.js';
 import { ModuleBE_PermissionAccessLevelDB, ModuleBE_PermissionAPIDB, ModuleBE_PermissionDomainDB, ModuleBE_PermissionGroupDB, ModuleBE_PermissionProjectDB, ModuleBE_PermissionUserDB } from '../_entity.js';
-import { trimStartingForwardSlash } from '@nu-art/thunderstorm-shared/route-tools';
 const dispatcher_collectPermissionsProjects = new Dispatcher('__collectPermissionsProjects');
 const GroupId_SuperAdmin = '8b54efda69b385a566735cca7be031d5';
 export const PermissionGroup_Permissions_SuperAdmin = {
-    _id: GroupId_SuperAdmin,
+    _id: toPermissionGroupId(GroupId_SuperAdmin),
     name: 'Super Admin',
     uiLabel: 'Super Admin',
     accessLevels: {
@@ -20,7 +56,7 @@ export const PermissionGroup_Permissions_SuperAdmin = {
     }
 };
 export const PermissionGroup_Permissions_Viewer = {
-    _id: '8c38d3bd2d76bbc37b5281f481c0bc1b',
+    _id: toPermissionGroupId('8c38d3bd2d76bbc37b5281f481c0bc1b'),
     name: 'Permissions Viewer',
     uiLabel: 'Permissions Viewer',
     accessLevels: {
@@ -30,7 +66,7 @@ export const PermissionGroup_Permissions_Viewer = {
     }
 };
 export const PermissionGroup_Permissions_Editor = {
-    _id: '1524909cae174d0052b76a469b339218',
+    _id: toPermissionGroupId('1524909cae174d0052b76a469b339218'),
     name: 'Permissions Editor',
     uiLabel: 'Permissions Editor',
     accessLevels: {
@@ -40,7 +76,7 @@ export const PermissionGroup_Permissions_Editor = {
     }
 };
 export const PermissionGroup_Account_Manager = {
-    _id: '6bb5feb12d0712ecee77f7f44188ec79',
+    _id: toPermissionGroupId('6bb5feb12d0712ecee77f7f44188ec79'),
     name: 'Accounts Manager',
     uiLabel: 'Accounts Manager',
     accessLevels: {
@@ -48,7 +84,7 @@ export const PermissionGroup_Account_Manager = {
     }
 };
 export const PermissionGroup_Account_Admin = {
-    _id: '761a84bdde3f9be3fde9c50402a60401',
+    _id: toPermissionGroupId('761a84bdde3f9be3fde9c50402a60401'),
     name: 'Accounts Admin',
     uiLabel: 'Accounts Admin',
     accessLevels: {
@@ -56,7 +92,7 @@ export const PermissionGroup_Account_Admin = {
     }
 };
 export const PermissionGroup_Account_Viewer = {
-    _id: '7343853a980149ec94f967ac7ff4ccc3',
+    _id: toPermissionGroupId('7343853a980149ec94f967ac7ff4ccc3'),
     name: 'Accounts Viewer',
     uiLabel: 'Accounts Viewer',
     accessLevels: {
@@ -80,278 +116,343 @@ export const PermissionGroups_Permissions = [
     // },
 ];
 export const PermissionProject_Permissions = {
-    _id: 'f60db83936835e0be33e89caa365f0c3',
+    _id: toPermissionProjectId('f60db83936835e0be33e89caa365f0c3'),
     name: 'Permissions',
     packages: [PermissionsPackage_Permissions, PermissionsPackage_Developer],
     groups: PermissionGroups_Permissions
 };
-class ModuleBE_Permissions_Class extends Module {
-    init() {
-        super.init();
-        addRoutes([
-            createQueryServerApi(ApiDef_Permissions.v1.toggleStrictMode, this.toggleStrictMode),
-            createQueryServerApi(ApiDef_Permissions.v1.createProject, this.__performProjectSetup().processor),
-            // createBodyServerApi(ApiDef_Permissions.v1.connectDomainToRoutes, this.connectDomainToRoutes)
-        ]);
-    }
-    // __collectPermissionsProjects() {
-    // 	return PermissionProject_Permissions;
-    // }
-    async __collectSessionData(data) {
-        const permissionUser = await ModuleBE_PermissionUserDB.query.uniqueAssert(data.accountId);
-        const userGroups = filterInstances(await ModuleBE_PermissionGroupDB.query.all(permissionUser.groups.map(g => g.groupId)));
-        const permissionMap = await this.getUserPermissionMap(userGroups);
-        return {
-            key: 'permissions', value: {
-                domainToValueMap: permissionMap,
-                roles: userGroups.map(group => ({ key: group.label, uiLabel: group.uiLabel })),
-            }
-        };
-    }
-    getUserPermissionMap = async (userGroups) => {
-        const permissionMap = {};
-        const levelMaps = filterInstances(userGroups.map(i => i._levelsMap));
-        levelMaps.forEach(levelMap => {
-            _keys(levelMap).forEach(domainId => {
-                if (!permissionMap[domainId])
-                    permissionMap[domainId] = 0;
-                if (levelMap[domainId] > permissionMap[domainId])
-                    permissionMap[domainId] = levelMap[domainId];
+let ModuleBE_Permissions_Class = (() => {
+    let _classSuper = Module;
+    let _instanceExtraInitializers = [];
+    let _toggleStrictMode_decorators;
+    let _createProject_decorators;
+    return class ModuleBE_Permissions_Class extends _classSuper {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _toggleStrictMode_decorators = [ApiHandler(ApiDef_Permissions.toggleStrictMode)];
+            _createProject_decorators = [ApiHandler(ApiDef_Permissions.createProject)];
+            __esDecorate(this, null, _toggleStrictMode_decorators, { kind: "method", name: "toggleStrictMode", static: false, private: false, access: { has: obj => "toggleStrictMode" in obj, get: obj => obj.toggleStrictMode }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _createProject_decorators, { kind: "method", name: "createProject", static: false, private: false, access: { has: obj => "createProject" in obj, get: obj => obj.createProject }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        init() {
+            super.init();
+        }
+        async toggleStrictMode(_params) {
+            const envConfigRef = getEnvConfigRef(ModuleBE_PermissionsAssert);
+            if (!envConfigRef)
+                return;
+            MemKey_ServerApi.get().addPostCallAction(async () => {
+                const currentConfig = await envConfigRef.get({});
+                currentConfig.strictMode = !currentConfig.strictMode;
+                await envConfigRef.set(currentConfig);
             });
-        });
-        //All domains that are not defined for the user, are NoAccess by default.
-        const allDomains = await ModuleBE_PermissionDomainDB.query.where({});
-        allDomains.forEach(domain => {
-            if (!permissionMap[domain._id])
-                permissionMap[domain._id] = DefaultAccessLevel_NoAccess.value; //"fill in the gaps" - All domains that are not defined for the user, are NoAccess by default.
-        });
-        return permissionMap;
-    };
-    toggleStrictMode = async () => {
-        MemKey_ServerApi.get().addPostCallAction(async () => {
-            const envConfigRef = Storm.getInstance().getEnvConfigRef(ModuleBE_PermissionsAssert);
-            const currentConfig = await envConfigRef.get({});
-            currentConfig.strictMode = !currentConfig.strictMode;
-            await envConfigRef.set(currentConfig);
-        });
-    };
-    __performProjectSetup() {
-        return {
-            priority: 0,
-            processor: async () => {
-                const projects = dispatcher_collectPermissionsProjects.dispatchModule();
-                projects.reduce((issues, project) => {
-                    return project.packages.reduce((issues, _package) => {
-                        return issues;
-                    }, issues);
-                }, []);
-                // Create All Projects
-                await this.createPermissionProjects(projects);
-                // Create all AppConfigs
-                await this.createPermissionsKeys(projects);
-                //Assign Super Admin if necessary
-                await this.assignSuperAdmin();
-            }
-        };
-    }
-    ;
-    async createPermissionProjects(projects) {
-        const map_nameToDBProject = await this.createProjects(projects);
-        const map_nameToDbDomain = await this.createDomains(projects, map_nameToDBProject);
-        const domainNameToLevelNameToDBAccessLevel = await this.createAccessLevels(projects, map_nameToDbDomain);
-        await this.createGroups(projects, map_nameToDbDomain, domainNameToLevelNameToDBAccessLevel);
-        await this.createApis(projects, domainNameToLevelNameToDBAccessLevel);
-    }
-    /**
-     * Creates All the DB_PermissionProject
-     *
-     * @param projects - predefined permissions projects
-     */
-    async createProjects(projects) {
-        this.logInfoBold('Creating Projects');
-        const _auditorId = MemKey_AccountId.get();
-        const preDBProjects = await ModuleBE_PermissionProjectDB.set.all(projects.map(project => ({
-            _id: project._id,
-            name: project.name,
-            _auditorId
-        })));
-        const projectsMap_nameToDBProject = reduceToMap(preDBProjects, project => project.name, project => project);
-        this.logInfoBold(`Created ${preDBProjects.length} Projects`);
-        return projectsMap_nameToDBProject;
-    }
-    /**
-     * Creates All the DB_PermissionDomains
-     *
-     * @param projects - predefined permissions projects
-     * @param map_nameToDBProject
-     */
-    async createDomains(projects, map_nameToDBProject) {
-        this.logInfoBold('Creating Domains');
-        const _auditorId = MemKey_AccountId.get();
-        const domainsToUpsert = flatArray(projects.map(project => project.packages.map(_package => _package.domains.map(domain => ({
-            _id: domain._id,
-            namespace: domain.namespace,
-            projectId: map_nameToDBProject[project.name]._id,
-            _auditorId
-        })))));
-        const dbDomain = await ModuleBE_PermissionDomainDB.set.all(domainsToUpsert);
-        const domainsMap_nameToDbDomain = reduceToMap(dbDomain, domain => domain.namespace, domain => domain);
-        this.logInfoBold(`Created ${dbDomain.length} Domains`);
-        return domainsMap_nameToDbDomain;
-    }
-    /**
-     * Creates All the DB_PermissionAccessLevel
-     *
-     * @param projects - predefined permissions projects
-     * @param map_nameToDbDomain
-     */
-    async createAccessLevels(projects, map_nameToDbDomain) {
-        this.logInfoBold('Creating Access Levels');
-        const _auditorId = MemKey_AccountId.get();
-        const levelsToUpsert = flatArray(projects.map(project => project.packages.map(_package => _package.domains.map(domain => {
-            let levels = domain.levels;
-            if (!levels)
-                levels = DuplicateDefaultAccessLevels(domain._id);
-            return levels.map(level => {
-                return {
-                    _id: level._id,
-                    domainId: map_nameToDbDomain[domain.namespace]._id,
-                    value: level.value,
-                    name: level.name,
-                    uiLabel: level.name,
-                    _auditorId
-                };
+        }
+        async createProject(_params) {
+            await this.__performProjectSetup().processor();
+        }
+        // __collectPermissionsProjects() {
+        // 	return PermissionProject_Permissions;
+        // }
+        async __collectSessionData(data) {
+            const permissionUserId = data.accountId;
+            const permissionUser = await ModuleBE_PermissionUserDB.query.uniqueAssert(permissionUserId);
+            const userGroups = filterInstances(await ModuleBE_PermissionGroupDB.query.all(permissionUser.groups.map(g => g.groupId)));
+            const permissionMap = await this.getUserPermissionMap(userGroups);
+            return {
+                key: 'permissions', value: {
+                    domainToValueMap: permissionMap,
+                    roles: userGroups.map(group => ({ key: group.label, uiLabel: group.uiLabel })),
+                }
+            };
+        }
+        getUserPermissionMap = (__runInitializers(this, _instanceExtraInitializers), async (userGroups) => {
+            const permissionMap = {};
+            const levelMaps = filterInstances(userGroups.map(i => i._levelsMap));
+            levelMaps.forEach(levelMap => {
+                _keys(levelMap).forEach(domainId => {
+                    if (!permissionMap[domainId])
+                        permissionMap[domainId] = 0;
+                    if (levelMap[domainId] > permissionMap[domainId])
+                        permissionMap[domainId] = levelMap[domainId];
+                });
             });
-        }))));
-        const dbLevels = await ModuleBE_PermissionAccessLevelDB.set.all(levelsToUpsert);
-        const domainNameToLevelNameToDBAccessLevel = reduceToMap(dbLevels, level => level.domainId, (level, index, map) => {
-            const domainLevels = map[level.domainId] || (map[level.domainId] = {});
-            domainLevels[level.name] = level;
-            return domainLevels;
+            //All domains that are not defined for the user, are NoAccess by default.
+            const allDomains = await ModuleBE_PermissionDomainDB.query.where({});
+            allDomains.forEach(domain => {
+                if (!permissionMap[domain._id])
+                    permissionMap[domain._id] = DefaultAccessLevel_NoAccess.value; //"fill in the gaps" - All domains that are not defined for the user, are NoAccess by default.
+            });
+            return permissionMap;
         });
-        this.logInfoBold(`Created ${dbLevels.length} Access Levels`);
-        return domainNameToLevelNameToDBAccessLevel;
-    }
-    /**
-     * Creates All the DB_PermissionGroup
-     *
-     * @param projects - predefined permissions projects
-     * @param map_nameToDbDomain
-     * @param domainNameToLevelNameToDBAccessLevel
-     */
-    async createGroups(projects, map_nameToDbDomain, domainNameToLevelNameToDBAccessLevel) {
-        this.logInfoBold('Creating Groups');
-        const _auditorId = MemKey_AccountId.get();
-        const groupsToUpsert = flatArray(projects.map(project => {
-            const groupsDef = flatArray([...project.packages.map(p => p.groups || []), ...project.groups || []]);
-            return (groupsDef).map(group => {
-                return {
-                    projectId: project._id,
-                    _id: group._id,
-                    _auditorId,
-                    label: group.name,
-                    uiLabel: group.name,
-                    accessLevelIds: _keys(group.accessLevels)
-                        .map(key => {
-                        const domainsMapNameToDbDomainElement = map_nameToDbDomain[key];
-                        if (!domainsMapNameToDbDomainElement)
-                            throw new MUSTNeverHappenException(`bah for key ${key}`);
-                        return domainNameToLevelNameToDBAccessLevel[domainsMapNameToDbDomainElement._id][group.accessLevels[key]]._id;
-                    })
-                };
+        __performProjectSetup() {
+            return {
+                priority: 100,
+                processor: async () => {
+                    const projects = dispatcher_collectPermissionsProjects.dispatchModule();
+                    projects.reduce((issues, project) => {
+                        return project.packages.reduce((issues, _package) => {
+                            return issues;
+                        }, issues);
+                    }, []);
+                    // Create All Projects
+                    await this.createPermissionProjects(projects);
+                    // Create domains/levels from function-permission registry (decorator-collected)
+                    if (projects.length > 0)
+                        await this.createDomainsAndLevelsFromFunctionPermissionRegistry(projects[0]._id);
+                    // Create all AppConfigs
+                    await this.createPermissionsKeys(projects);
+                    //Assign Super Admin if necessary
+                    await this.assignSuperAdmin();
+                }
+            };
+        }
+        /**
+         * Creates domains and access levels from the function-permission registry (populated by @RequirePermission decorators).
+         * New (scopeKey, value) pairs get domains/levels created; not assigned to anyone until explicitly assigned.
+         */
+        async createDomainsAndLevelsFromFunctionPermissionRegistry(projectId) {
+            const defs = getRegisteredFunctionPermissions();
+            if (defs.length === 0)
+                return;
+            this.logInfoBold('Creating domains/levels from function-permission registry');
+            const _auditorId = MemKey_AccountId.get();
+            const uniqueScopeKeys = [...new Set(defs.map(d => d.scopeKey))];
+            const domainIdByScopeKey = {};
+            for (const scopeKey of uniqueScopeKeys) {
+                const domainId = toPermissionDomainId(md5(`function-permission-domain/${scopeKey}`));
+                domainIdByScopeKey[scopeKey] = domainId;
+                await ModuleBE_PermissionDomainDB.set.all([{
+                        _id: domainId,
+                        namespace: scopeKey,
+                        projectId,
+                        _auditorId
+                    }]);
+            }
+            const levelValueByName = {
+                'No-Access': DefaultAccessLevel_NoAccess.value,
+                'Read': DefaultAccessLevel_Read.value,
+                'Write': DefaultAccessLevel_Write.value,
+                'Delete': DefaultAccessLevel_Delete.value,
+                'Admin': DefaultAccessLevel_Admin.value
+            };
+            for (const def of defs) {
+                const domainId = domainIdByScopeKey[def.scopeKey];
+                const levelValue = levelValueByName[def.value] ?? 100;
+                const levelId = md5(`${domainId}/${def.value}`);
+                await ModuleBE_PermissionAccessLevelDB.set.all([{
+                        _id: levelId,
+                        domainId,
+                        name: def.value,
+                        value: levelValue,
+                        uiLabel: def.value,
+                        _auditorId
+                    }]);
+                def.domainId = domainId;
+                def.levelId = levelId;
+                def.levelValue = levelValue;
+            }
+            this.logInfoBold(`Created ${uniqueScopeKeys.length} domains and ${defs.length} access levels from function-permission registry`);
+        }
+        ;
+        async createPermissionProjects(projects) {
+            const map_nameToDBProject = await this.createProjects(projects);
+            const map_nameToDbDomain = await this.createDomains(projects, map_nameToDBProject);
+            const domainNameToLevelNameToDBAccessLevel = await this.createAccessLevels(projects, map_nameToDbDomain);
+            await this.createGroups(projects, map_nameToDbDomain, domainNameToLevelNameToDBAccessLevel);
+            await this.createApis(projects, domainNameToLevelNameToDBAccessLevel);
+        }
+        /**
+         * Creates All the DB_PermissionProject
+         *
+         * @param projects - predefined permissions projects
+         */
+        async createProjects(projects) {
+            this.logInfoBold('Creating Projects');
+            const _auditorId = MemKey_AccountId.get();
+            const preDBProjects = await ModuleBE_PermissionProjectDB.set.all(projects.map(project => ({
+                _id: project._id,
+                name: project.name,
+                _auditorId
+            })));
+            const projectsMap_nameToDBProject = reduceToMap(preDBProjects, project => project.name, project => project);
+            this.logInfoBold(`Created ${preDBProjects.length} Projects`);
+            return projectsMap_nameToDBProject;
+        }
+        /**
+         * Creates All the DB_PermissionDomains
+         *
+         * @param projects - predefined permissions projects
+         * @param map_nameToDBProject
+         */
+        async createDomains(projects, map_nameToDBProject) {
+            this.logInfoBold('Creating Domains');
+            const _auditorId = MemKey_AccountId.get();
+            const domainsToUpsert = flatArray(projects.map(project => project.packages.map(_package => _package.domains.map(domain => ({
+                _id: domain._id,
+                namespace: domain.namespace,
+                projectId: map_nameToDBProject[project.name]._id,
+                _auditorId
+            })))));
+            const dbDomain = await ModuleBE_PermissionDomainDB.set.all(domainsToUpsert);
+            const domainsMap_nameToDbDomain = reduceToMap(dbDomain, domain => domain.namespace, domain => domain);
+            this.logInfoBold(`Created ${dbDomain.length} Domains`);
+            return domainsMap_nameToDbDomain;
+        }
+        /**
+         * Creates All the DB_PermissionAccessLevel
+         *
+         * @param projects - predefined permissions projects
+         * @param map_nameToDbDomain
+         */
+        async createAccessLevels(projects, map_nameToDbDomain) {
+            this.logInfoBold('Creating Access Levels');
+            const _auditorId = MemKey_AccountId.get();
+            const levelsToUpsert = flatArray(projects.map(project => project.packages.map(_package => _package.domains.map(domain => {
+                let levels = domain.levels ?? DuplicateDefaultAccessLevels(domain._id);
+                return levels.map(level => {
+                    return {
+                        _id: level._id,
+                        domainId: map_nameToDbDomain[domain.namespace]._id,
+                        value: level.value,
+                        name: level.name,
+                        uiLabel: level.name,
+                        _auditorId
+                    };
+                });
+            }))));
+            const dbLevels = await ModuleBE_PermissionAccessLevelDB.set.all(levelsToUpsert);
+            const domainNameToLevelNameToDBAccessLevel = reduceToMap(dbLevels, level => level.domainId, (level, index, map) => {
+                const domainLevels = map[level.domainId] || (map[level.domainId] = {});
+                domainLevels[level.name] = level;
+                return domainLevels;
             });
-        }));
-        const dbGroups = await ModuleBE_PermissionGroupDB.set.all(groupsToUpsert);
-        this.logInfoBold(`Created ${dbGroups.length} Groups`);
-    }
-    /**
-     * Creates All the DB_PermissionApi
-     *
-     * @param projects - predefined permissions projects
-     * @param domainNameToLevelNameToDBAccessLevel
-     */
-    async createApis(projects, domainNameToLevelNameToDBAccessLevel) {
-        this.logInfoBold('Creating APIs');
-        const _auditorId = MemKey_AccountId.get();
-        const apisToUpsert = flatArray(projects.map(project => {
-            return project.packages.map(_package => _package.domains.map(domain => {
-                const apis = [];
-                apis.push(...(domain.customApis || []).map(api => ({
-                    projectId: project._id,
-                    path: trimStartingForwardSlash(api.path),
-                    _auditorId,
-                    accessLevelIds: [domainNameToLevelNameToDBAccessLevel[api.domainId ?? domain._id][api.accessLevel]._id]
-                })));
-                const apiModules = arrayToMap(RuntimeModules()
-                    .filter((module) => !!module.apiDef && !!module.dbModule?.dbDef?.dbKey), item => item.dbModule.dbDef.dbKey);
-                this.logDebug(_keys(apiModules));
-                // / I think there is a bug here... comment it and see what happens
-                const _apis = (domain.dbNames || []).map(dbName => {
-                    const apiModule = apiModules[dbName];
-                    if (!apiModule)
-                        throw new MUSTNeverHappenException(`Could not find api module with dbName: ${dbName}`);
-                    const _apiDefs = apiModule.apiDef;
-                    return _keys(_apiDefs).map(_apiDefKey => {
-                        const apiDefs = _apiDefs[_apiDefKey];
-                        return filterInstances(_keys(apiDefs).map(apiDefKey => {
-                            const apiDef = apiDefs[apiDefKey];
-                            const accessLevelNameToAssign = defaultLevelsRouteLookupWords[apiDef.path.substring(apiDef.path.lastIndexOf('/') + 1)];
+            this.logInfoBold(`Created ${dbLevels.length} Access Levels`);
+            return domainNameToLevelNameToDBAccessLevel;
+        }
+        /**
+         * Creates All the DB_PermissionGroup
+         *
+         * @param projects - predefined permissions projects
+         * @param map_nameToDbDomain
+         * @param domainNameToLevelNameToDBAccessLevel
+         */
+        async createGroups(projects, map_nameToDbDomain, domainNameToLevelNameToDBAccessLevel) {
+            this.logInfoBold('Creating Groups');
+            const _auditorId = MemKey_AccountId.get();
+            const groupsToUpsert = flatArray(projects.map(project => {
+                const groupsDef = flatArray([...project.packages.map(p => p.groups || []), ...project.groups || []]);
+                return (groupsDef).map(group => {
+                    return {
+                        projectId: project._id,
+                        _id: group._id,
+                        _auditorId,
+                        label: group.name,
+                        uiLabel: group.name,
+                        accessLevelIds: _keys(group.accessLevels)
+                            .map(key => {
+                            const domainsMapNameToDbDomainElement = map_nameToDbDomain[key];
+                            if (!domainsMapNameToDbDomainElement)
+                                throw new MUSTNeverHappenException(`bah for key ${key}`);
+                            return domainNameToLevelNameToDBAccessLevel[domainsMapNameToDbDomainElement._id][group.accessLevels[key]]._id;
+                        })
+                    };
+                });
+            }));
+            const dbGroups = await ModuleBE_PermissionGroupDB.set.all(groupsToUpsert);
+            this.logInfoBold(`Created ${dbGroups.length} Groups`);
+        }
+        /**
+         * Creates All the DB_PermissionApi (path-based).
+         * @deprecated API collection deprecated; use function-based permissions and @RequirePermission. Domains/levels from function-permission registry instead.
+         * @param projects - predefined permissions projects
+         * @param domainNameToLevelNameToDBAccessLevel
+         */
+        async createApis(projects, domainNameToLevelNameToDBAccessLevel) {
+            this.logInfoBold('Creating APIs');
+            const _auditorId = MemKey_AccountId.get();
+            const apisToUpsert = flatArray(projects.map(project => {
+                return project.packages.map(_package => _package.domains.map(domain => {
+                    const apis = [];
+                    apis.push(...(domain.customApis || []).map(api => ({
+                        projectId: project._id,
+                        path: trimStartingForwardSlash(api.path),
+                        _auditorId,
+                        accessLevelIds: [domainNameToLevelNameToDBAccessLevel[api.domainId ?? domain._id][api.accessLevel]._id]
+                    })));
+                    const apiModules = RuntimeBE_Modules();
+                    const apiModulesMap = arrayToMap(apiModules, m => m.dbModule.dbDef.dbKey);
+                    this.logDebug(_keys(apiModulesMap));
+                    const crudEndpoints = ['query', 'queryUnique', 'upsert', 'upsertAll', 'deleteUnique', 'deleteQuery', 'deleteAll'];
+                    const _apis = (domain.dbNames || []).map(dbName => {
+                        const apiModule = apiModulesMap[dbName];
+                        if (!apiModule)
+                            throw new MUSTNeverHappenException(`Could not find api module with dbName: ${dbName}`);
+                        const def = apiModule.crudApiDef;
+                        return filterInstances(crudEndpoints.map(key => {
+                            const endpoint = def[key];
+                            if (!endpoint?.path)
+                                return undefined;
+                            const accessLevelNameToAssign = defaultLevelsRouteLookupWords[endpoint.path.substring(endpoint.path.lastIndexOf('/') + 1)];
                             const accessLevel = domainNameToLevelNameToDBAccessLevel[domain._id][accessLevelNameToAssign];
                             if (!accessLevel)
-                                return;
-                            const accessId = accessLevel._id;
+                                return undefined;
                             return {
                                 projectId: project._id,
-                                path: apiDef.path,
+                                path: endpoint.path,
                                 _auditorId,
-                                accessLevelIds: [accessId]
+                                accessLevelIds: [accessLevel._id]
                             };
                         }));
                     });
-                });
-                apis.push(...flatArray(_apis));
-                return apis;
+                    apis.push(...flatArray(_apis));
+                    return apis;
+                }));
             }));
-        }));
-        const dbApis = await ModuleBE_PermissionAPIDB.set.all(apisToUpsert);
-        this.logInfoBold(`Created ${dbApis.length} APIs`);
-    }
-    /**
-     * Creates permission keys associated with the given projects.
-     *
-     * @param projects - An array of projects.
-     */
-    async createPermissionsKeys(projects) {
-        this.logInfoBold('Creating App Config');
-        // const permissionKeysToCreate: PermissionKey_BE<any>[] = filterInstances(flatArray(projects.map(project => project.packages.map(_package => _package.domains.map(domain => domain.permissionKeys)))));
-        try {
-            await ModuleBE_AppConfigDB.createDefaults(this);
-            this.logInfoBold('Created Permission Key defaults.');
+            const dbApis = await ModuleBE_PermissionAPIDB.set.all(apisToUpsert);
+            this.logInfoBold(`Created ${dbApis.length} APIs`);
         }
-        catch (e) {
-            this.logErrorBold('Failed creating Permission Key defaults.', e);
+        /**
+         * Creates permission keys associated with the given projects.
+         *
+         * @param projects - An array of projects.
+         */
+        async createPermissionsKeys(_projects) {
+            this.logInfoBold('Creating App Config');
+            const createDefaults = getCreatePermissionKeyDefaults();
+            if (createDefaults) {
+                try {
+                    await createDefaults(this);
+                    this.logInfoBold('Created Permission Key defaults.');
+                }
+                catch (e) {
+                    this.logErrorBold('Failed creating Permission Key defaults.', e);
+                }
+            }
+            this.logInfoBold('Created App Config');
         }
-        this.logInfoBold('Created App Config');
-    }
-    /**
-     * If no "Super Admin" user is defined in the system!
-     * The first user to press the create project button will become the "Super Admin" of the system
-     *
-     * If a "Super Admin" already exists in the system, a 403 will be thrown
-     */
-    assignSuperAdmin = async () => {
-        this.logInfoBold('Assigning SuperAdmin permissions');
-        const existingSuperAdmin = (await ModuleBE_PermissionUserDB.query.custom({
-            where: { __groupIds: { $ac: GroupId_SuperAdmin } },
-            limit: 1
-        }))[0];
-        if (existingSuperAdmin)
-            return;
-        const currentUser = await ModuleBE_PermissionUserDB.query.uniqueAssert(MemKey_AccountId.get());
-        (currentUser.groups || (currentUser.groups = [])).push({ groupId: GroupId_SuperAdmin });
-        await ModuleBE_PermissionUserDB.set.item(currentUser);
-        await ModuleBE_SessionDB._session.rotate.reissue.bySession();
-        this.logInfoBold('Assigned SuperAdmin permissions');
+        /**
+         * If no "Super Admin" user is defined in the system!
+         * The first user to press the create project button will become the "Super Admin" of the system
+         *
+         * If a "Super Admin" already exists in the system, a 403 will be thrown
+         */
+        assignSuperAdmin = async () => {
+            this.logInfoBold('Assigning SuperAdmin permissions');
+            const superAdminGroupId = toPermissionGroupId(GroupId_SuperAdmin);
+            const existingSuperAdmin = (await ModuleBE_PermissionUserDB.query.custom({
+                where: { __groupIds: { $ac: superAdminGroupId } },
+                limit: 1
+            }))[0];
+            if (existingSuperAdmin)
+                return;
+            const accountId = MemKey_AccountId.get();
+            const currentUser = await ModuleBE_PermissionUserDB.query.uniqueAssert(accountId);
+            (currentUser.groups || (currentUser.groups = [])).push({ groupId: superAdminGroupId });
+            await ModuleBE_PermissionUserDB.set.item(currentUser);
+            await ModuleBE_SessionDB._session.rotate.reissue.bySession();
+            this.logInfoBold('Assigned SuperAdmin permissions');
+        };
     };
-}
+})();
 export const ModuleBE_Permissions = new ModuleBE_Permissions_Class();