@openinc/parse-server-opendash 4.0.20 → 4.0.22

package/dist/functions/openinc-openservice-save-ticket-data.js

@@ -30,6 +30,42 @@ function getUsername(user) {
 async function init(name) {
     node_1.default.Cloud.define(name, handleRequest, { requireUser: false });
 }
+async function userCanWriteTicket(ticketId, user) {
+    if (!user?.id)
+        return false;
+    const ticket = await new node_1.default.Query(index_js_2.Maintenance_Ticket).get(ticketId, {
+        useMasterKey: true,
+    });
+    const acl = ticket.getACL();
+    // Without object-level ACL, class-level permissions apply.
+    if (!acl)
+        return true;
+    if (acl.getPublicWriteAccess() || acl.getWriteAccess(user.id))
+        return true;
+    const directRoles = await new node_1.default.Query(node_1.default.Role)
+        .equalTo("users", user)
+        .find({ useMasterKey: true });
+    const rolesToCheck = [...directRoles];
+    const visitedRoleIds = new Set(directRoles.map((role) => role.id).filter((id) => !!id));
+    // Traverse parent roles so ACL checks also honor nested role relations.
+    for (let i = 0; i < rolesToCheck.length; i += 1) {
+        const role = rolesToCheck[i];
+        const roleName = role.get("name");
+        if (roleName && acl.getRoleWriteAccess(roleName)) {
+            return true;
+        }
+        const parentRoles = await new node_1.default.Query(node_1.default.Role)
+            .equalTo("roles", role)
+            .find({ useMasterKey: true });
+        for (const parentRole of parentRoles) {
+            if (!parentRole.id || visitedRoleIds.has(parentRole.id))
+                continue;
+            visitedRoleIds.add(parentRole.id);
+            rolesToCheck.push(parentRole);
+        }
+    }
+    return false;
+}
 async function handleRequest(request) {
     const result = {
         success: true,
@@ -56,7 +92,9 @@ async function handleRequest(request) {
             result.ticket = ticket;
             return result;
         }
-        const ticket = await saveTicketData(request.params, user);
+        const shouldUseMasterKeyForUpdate = !!request.params.existingTicketId &&
+            (await userCanWriteTicket(request.params.existingTicketId, user));
+        const ticket = await saveTicketData(request.params, user, shouldUseMasterKeyForUpdate ? { useMasterKey: true } : undefined);
         result.success = true;
         result.ticket = ticket;
         return result;

package/dist/types/Maintenance_Ticket.d.ts

@@ -12,6 +12,7 @@ export interface Maintenance_TicketAttributes {
     assignedroles: Parse.Relation<Maintenance_Ticket, _Role>;
     assignedusers: Parse.Relation<Maintenance_Ticket, _User>;
     description?: string | undefined;
+    displayAt?: Date | undefined;
     enabled: boolean;
     latestPriorityValue?: number | undefined;
     meta?: TicketMeta | undefined;
@@ -27,6 +28,8 @@ export declare class Maintenance_Ticket extends Parse.Object<Maintenance_TicketA
     get assignedusers(): Parse.Relation<Maintenance_Ticket, _User>;
     get description(): string | undefined;
     set description(value: string | undefined);
+    get displayAt(): Date | undefined;
+    set displayAt(value: Date | undefined);
     get enabled(): boolean;
     set enabled(value: boolean);
     get latestPriorityValue(): number | undefined;

package/dist/types/Maintenance_Ticket.js

@@ -22,6 +22,12 @@ class Maintenance_Ticket extends node_1.default.Object {
     set description(value) {
         super.set("description", value);
     }
+    get displayAt() {
+        return super.get("displayAt");
+    }
+    set displayAt(value) {
+        super.set("displayAt", value);
+    }
     get enabled() {
         return super.get("enabled");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openinc/parse-server-opendash",
-  "version": "4.0.20",
+  "version": "4.0.22",
   "description": "Parse Server Cloud Code for open.INC Stack.",
   "packageManager": "pnpm@10.33.0",
   "keywords": [

package/schema/Maintenance_Ticket.json

@@ -14,6 +14,10 @@
       "type": "String",
       "required": false
     },
+    "displayAt": {
+      "type": "Date",
+      "required": false
+    },
     "enabled": {
       "type": "Boolean",
       "required": false,