@openinc/parse-server-opendash 4.1.1 → 4.1.2

package/dist/featuremap.json

@@ -4,7 +4,7 @@
     "OD3_AlarmWebhook": "MONITORING",
     "OD3_Assets": "CORE",
     "OD3_Attachment": "CORE",
-    "OD3_BDE_Article": "BDE",
+    "OD3_BDE_Article": "CORE",
     "OD3_BDE_Form": "BDE",
     "OD3_BDE_List": "BDE",
     "OD3_BDE_ListEntry": "BDE",
@@ -14,6 +14,7 @@
     "OD3_BDE_WorkOrder": "BDE",
     "OD3_BDE_WorkTime": "BDE",
     "OD3_Changelog": "CORE",
+    "OD3_Chat_Message": "CORE",
     "OD3_Company": "CORE",
     "OD3_Config": "CORE",
     "OD3_Contact": "CORE",
@@ -47,6 +48,11 @@
     "OD3_Knowledge_Video": "KNOWLEDGE",
     "OD3_Language": "CORE",
     "OD3_Log": "CORE",
+    "OD3_MES_Article": "MONITORING",
+    "OD3_MES_Order": "MONITORING",
+    "OD3_MES_OrderPlan": "MONITORING",
+    "OD3_MIAAS_MDSEndpoint": "MIAAS",
+    "OD3_ML_DataSelection": "MASCHINELEARNING",
     "OD3_MailTemplate": "MONITORING",
     "OD3_Mail_Groups": "MONITORING",
     "OD3_Maintenance_Downtime": "MAINTENANCE",
@@ -80,13 +86,9 @@
     "OD3_Maintenance_Ticket_QR_Code": "MAINTENANCE",
     "OD3_Maintenance_Ticket_Source": "MAINTENANCE",
     "OD3_Maintenance_Ticket_Title": "MAINTENANCE",
-    "OD3_MES_Article": "MONITORING",
-    "OD3_MES_Order": "MONITORING",
-    "OD3_MES_OrderPlan": "MONITORING",
     "OD3_Meta_Config": "CORE",
+    "OD3_Meta_Context": "CORE",
     "OD3_Meta_Entry": "CORE",
-    "OD3_MIAAS_MDSEndpoint": "MIAAS",
-    "OD3_ML_DataSelection": "MASCHINELEARNING",
     "OD3_Monitoring_DataHierachies": "MONITORING",
     "OD3_Monitoring_Jobs": "MONITORING",
     "OD3_Monitoring_ParseTableSensor": "MONITORING",
@@ -100,13 +102,26 @@
     "OD3_OWPlcItem": "MONITORING",
     "OD3_Permission": "CORE",
     "OD3_Push": "CORE",
-    "OD3_RAG_Data": "unknown",
-    "OD3_RAG_Interview": "unknown",
-    "OD3_RAG_Meta": "unknown",
-    "OD3_RAG_Prompts": "unknown",
-    "OD3_RAG_Questions": "unknown",
-    "OD3_RAG_Request": "unknown",
+    "OD3_RAG_Data": "RAG",
+    "OD3_RAG_Interview": "RAG",
+    "OD3_RAG_Meta": "RAG",
+    "OD3_RAG_Prompts": "RAG",
+    "OD3_RAG_Questions": "RAG",
+    "OD3_RAG_Request": "RAG",
     "OD3_Report": "CORE",
+    "OD3_Service_Equipment": "SERVICE",
+    "OD3_Service_FormConfig": "SERVICE",
+    "OD3_Service_MeterReading": "SERVICE",
+    "OD3_Service_MigrationMap": "SERVICE",
+    "OD3_Service_Project": "SERVICE",
+    "OD3_Service_Schedule": "SERVICE",
+    "OD3_Service_Schedule_Execution": "SERVICE",
+    "OD3_Service_Schedule_Template": "SERVICE",
+    "OD3_Service_Status": "SERVICE",
+    "OD3_Service_Tag": "SERVICE",
+    "OD3_Service_Ticket": "SERVICE",
+    "OD3_Service_TicketCounter": "SERVICE",
+    "OD3_Service_TriggerState": "SERVICE",
     "OD3_Share": "CORE",
     "OD3_Source": "CORE",
     "OD3_SourceMeta": "CORE",

package/dist/features/config/helper/customOptions.js

@@ -233,6 +233,15 @@ exports.customoptions = {
         default: "false",
         description: "Enable Parse Classes and Cloud Code for the Documentation plugin.",
     },
+    FEATURE_SERVICE: {
+        env: "OPENINC_PARSE_FEATURE_SERVICE",
+        type: "boolean",
+        required: false,
+        secret: false,
+        public: true,
+        default: "false",
+        description: "Enable Parse Classes and Cloud Code for the open.SERVICE v2 plugin.",
+    },
     FORCE_SCHEMA: {
         env: "OPENINC_PARSE_FORCE_SCHEMA",
         type: "boolean",

package/dist/features/config/helper/isFeatureEnabled.d.ts

@@ -1,2 +1,2 @@
-export type Feature = "CORE" | "MONITORING" | "BDE" | "GTFS" | "KNOWLEDGE" | "MAINTENANCE" | "DOCUMENTATION" | "MIAAS";
+export type Feature = "CORE" | "MONITORING" | "BDE" | "GTFS" | "KNOWLEDGE" | "MAINTENANCE" | "DOCUMENTATION" | "MIAAS" | "SERVICE";
 export declare function isFeatureEnabled(feature: Feature): boolean;

package/dist/features/config/helper/isFeatureEnabled.js

@@ -21,6 +21,8 @@ function isFeatureEnabled(feature) {
             return config.getBoolean("FEATURE_DOCUMENTATION");
         case "MIAAS":
             return config.getBoolean("FEATURE_MIAAS");
+        case "SERVICE":
+            return config.getBoolean("FEATURE_SERVICE");
         default:
             return false;
     }

package/dist/features/meta/index.d.ts

@@ -0,0 +1 @@
+export { registerMetaContext } from "./services/registerMetaContext.js";

package/dist/features/meta/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerMetaContext = void 0;
+var registerMetaContext_js_1 = require("./services/registerMetaContext.js");
+Object.defineProperty(exports, "registerMetaContext", { enumerable: true, get: function () { return registerMetaContext_js_1.registerMetaContext; } });

package/dist/features/meta/services/registerMetaContext.d.ts

@@ -0,0 +1,29 @@
+import { Meta_Config, Tenant } from "../../../types/index.js";
+/**
+ * Record that a meta context exists, and what is known about it.
+ *
+ * Nothing declares a context: it comes into being the moment something writes a
+ * `Meta_Config` or a `Meta_Entry` carrying it. Every writer therefore registers
+ * itself here without knowing this directory exists — including a sync job, a
+ * backend script, or a client instance nobody in this repo controls, none of
+ * which a code-side list could ever enumerate.
+ *
+ * Crucially this also covers contexts that will **never** have a config: an
+ * entry saved from a `customConfig` form has no `origin` and no `Meta_Config`
+ * behind it (see `useSaveEntry`), which makes it invisible to any listing
+ * derived from the config class. Here it is a first-class row with
+ * `hasConfig: false`.
+ *
+ * Writes are conditional — a row is only saved when something actually changed
+ * — so the entry hook is a read on the hot path and a write only on the rare
+ * occasion that a context, a class, or a stale timestamp is new.
+ */
+export declare function registerMetaContext(params: {
+    context: string;
+    tenant?: Tenant;
+    /** Set when the caller is a `Meta_Config` save. */
+    config?: Meta_Config;
+    /** `entryClassName` of the entry being saved, when the caller is an entry. */
+    entryClassName?: string;
+    now?: Date;
+}): Promise<void>;

package/dist/features/meta/services/registerMetaContext.js

@@ -0,0 +1,208 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerMetaContext = registerMetaContext;
+const node_1 = __importDefault(require("parse/node"));
+const index_js_1 = require("../../../types/index.js");
+/**
+ * How stale `lastSeenAt` has to be before an entry save refreshes it. Entries
+ * are written constantly; without this the directory would take a write on
+ * every single one, for a timestamp nobody reads to the minute.
+ */
+const LAST_SEEN_MAX_AGE_MS = 15 * 60 * 1000;
+/** Parse the stringified context array a row carries; tolerate junk. */
+function parseSegments(context) {
+    try {
+        const parsed = JSON.parse(context);
+        return Array.isArray(parsed) && parsed.every((s) => typeof s === "string")
+            ? parsed
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Every row for a (context, tenant) pair, oldest first. */
+async function findRows(context, tenant) {
+    const query = new node_1.default.Query(index_js_1.Meta_Context)
+        .equalTo("context", context)
+        .ascending("createdAt");
+    if (tenant) {
+        query.equalTo("tenant", tenant);
+    }
+    else {
+        query.doesNotExist("tenant");
+    }
+    return await query.find({ useMasterKey: true });
+}
+/**
+ * Collapse rows that a concurrent first-write produced for the same
+ * (context, tenant).
+ *
+ * The upsert below is find-then-insert, and the project's schema tool cannot
+ * declare a unique index (it has no `indexes` support at all), so two entries
+ * for a brand-new context saved at the same moment — a bulk sync, a migration
+ * pass writing in parallel — can both find nothing and both insert. This
+ * converges them afterwards, which a unique index could not do for rows that
+ * already exist.
+ *
+ * The oldest row wins and absorbs what the others learned, so nothing observed
+ * is lost. Only runs right after an insert, so the hot path never pays for it.
+ */
+async function dedupe(context, tenant) {
+    const rows = await findRows(context, tenant);
+    if (rows.length < 2)
+        return rows[0];
+    const [keep, ...extras] = rows;
+    const known = new Set(keep.classNames ?? []);
+    let changed = false;
+    for (const extra of extras) {
+        for (const className of extra.classNames ?? []) {
+            if (!known.has(className)) {
+                known.add(className);
+                keep.addUnique("classNames", className);
+                changed = true;
+            }
+        }
+        if (!keep.hasConfig && extra.hasConfig) {
+            keep.hasConfig = true;
+            keep.config = extra.config;
+            keep.label = extra.label;
+            keep.description = extra.description;
+            changed = true;
+        }
+        const extraFirst = extra.firstSeenAt?.getTime() ?? Infinity;
+        if (extraFirst < (keep.firstSeenAt?.getTime() ?? Infinity)) {
+            keep.firstSeenAt = extra.firstSeenAt;
+            changed = true;
+        }
+        const extraLast = extra.lastSeenAt?.getTime() ?? 0;
+        if (extraLast > (keep.lastSeenAt?.getTime() ?? 0)) {
+            keep.lastSeenAt = extra.lastSeenAt;
+            changed = true;
+        }
+    }
+    if (changed) {
+        await keep.save(null, { useMasterKey: true });
+    }
+    await node_1.default.Object.destroyAll(extras, { useMasterKey: true });
+    console.log(`[@openinc/parse-server-opendash][Meta_Context] Merged ${extras.length} duplicate row(s) for ${context}`);
+    return keep;
+}
+/**
+ * Directory rows are written from hooks, i.e. with the master key, which skips
+ * `defaultAclHandler` — so the ACL it would have applied is applied here.
+ */
+function applyAcl(row, tenant) {
+    const acl = new node_1.default.ACL();
+    acl.setRoleReadAccess("od-admin", true);
+    acl.setRoleWriteAccess("od-admin", true);
+    if (tenant) {
+        acl.setRoleReadAccess(`od-tenant-user-${tenant.id}`, true);
+        acl.setRoleReadAccess(`od-tenant-admin-${tenant.id}`, true);
+        acl.setRoleWriteAccess(`od-tenant-admin-${tenant.id}`, true);
+    }
+    row.setACL(acl);
+}
+/**
+ * Apply what this caller knows to a row. Split out so it can be replayed onto
+ * the survivor of a dedupe — see `registerMetaContext`.
+ */
+function applyFields(row, params) {
+    const { config, entryClassName, now } = params;
+    let changed = false;
+    if (config) {
+        // The config is the authority on label/description; mirror it so the
+        // explorer can list contexts from this class alone.
+        const configLabel = config.config?.label;
+        const configDescription = config.config?.description;
+        if (row.hasConfig !== true) {
+            row.hasConfig = true;
+            changed = true;
+        }
+        if (row.config?.id !== config.id) {
+            row.config = config;
+            changed = true;
+        }
+        if (row.label !== configLabel) {
+            row.label = configLabel;
+            changed = true;
+        }
+        if (row.description !== configDescription) {
+            row.description = configDescription;
+            changed = true;
+        }
+    }
+    else if (row.hasConfig === undefined) {
+        row.hasConfig = false;
+        changed = true;
+    }
+    if (entryClassName && !(row.classNames ?? []).includes(entryClassName)) {
+        // `addUnique`, not an array assignment: concurrent writers each hold a
+        // stale copy of `classNames`, so assigning the whole array makes the last
+        // save win and silently drop what the others added. This becomes an atomic
+        // $addToSet on the server instead.
+        row.addUnique("classNames", entryClassName);
+        changed = true;
+    }
+    const lastSeen = row.lastSeenAt?.getTime() ?? 0;
+    if (now.getTime() - lastSeen > LAST_SEEN_MAX_AGE_MS) {
+        row.lastSeenAt = now;
+        changed = true;
+    }
+    return changed;
+}
+/**
+ * Record that a meta context exists, and what is known about it.
+ *
+ * Nothing declares a context: it comes into being the moment something writes a
+ * `Meta_Config` or a `Meta_Entry` carrying it. Every writer therefore registers
+ * itself here without knowing this directory exists — including a sync job, a
+ * backend script, or a client instance nobody in this repo controls, none of
+ * which a code-side list could ever enumerate.
+ *
+ * Crucially this also covers contexts that will **never** have a config: an
+ * entry saved from a `customConfig` form has no `origin` and no `Meta_Config`
+ * behind it (see `useSaveEntry`), which makes it invisible to any listing
+ * derived from the config class. Here it is a first-class row with
+ * `hasConfig: false`.
+ *
+ * Writes are conditional — a row is only saved when something actually changed
+ * — so the entry hook is a read on the hot path and a write only on the rare
+ * occasion that a context, a class, or a stale timestamp is new.
+ */
+async function registerMetaContext(params) {
+    const { context, tenant, config, entryClassName } = params;
+    if (!context)
+        return;
+    const now = params.now ?? new Date();
+    const existing = (await findRows(context, tenant))[0];
+    const row = existing ?? new index_js_1.Meta_Context();
+    let changed = !existing;
+    if (!existing) {
+        row.context = context;
+        row.segments = parseSegments(context);
+        row.firstSeenAt = now;
+        if (tenant)
+            row.tenant = tenant;
+    }
+    changed = applyFields(row, { config, entryClassName, now }) || changed;
+    if (!changed)
+        return;
+    applyAcl(row, tenant);
+    await row.save(null, { useMasterKey: true });
+    if (existing)
+        return;
+    // A concurrent writer may have inserted the same row in the meantime. If the
+    // merge kept theirs and destroyed ours, replay our contribution onto the
+    // survivor: dedupe reads the losing rows before destroying them, so an update
+    // that landed after that read would otherwise die with the row.
+    const survivor = await dedupe(context, tenant);
+    if (survivor && survivor.id !== row.id) {
+        if (applyFields(survivor, { config, entryClassName, now })) {
+            await survivor.save(null, { useMasterKey: true });
+        }
+    }
+}

package/dist/features/permissions/types/Permissions.d.ts

@@ -18,9 +18,32 @@ export declare namespace Permissions {
         knowledge = "maintenance:can-access-knowledge",
         kanban_view = "maintenance:can-update-kanban-view"
     }
+    enum SERVICE {
+        ticket_read = "service:can-read-ticket",
+        ticket_create = "service:can-create-ticket",
+        ticket_edit = "service:can-edit-ticket",
+        ticket_delete = "service:can-delete-ticket",
+        ticket_assign = "service:can-assign-ticket",
+        schedule_read = "service:can-read-schedule",
+        schedule_create = "service:can-create-schedule",
+        schedule_edit = "service:can-edit-schedule",
+        schedule_delete = "service:can-delete-schedule",
+        execution_perform = "service:can-perform-execution",
+        template_manage = "service:can-manage-template",
+        masterdata_manage = "service:can-manage-masterdata",
+        formconfig_manage = "service:can-manage-formconfig",
+        analytics_view = "service:can-view-analytics"
+    }
     enum CORE {
         adminoverview = "opendash:can-access-admin-overview",
-        mailadmin = "parse-admin:can-access-mail-admin"
+        mailadmin = "parse-admin:can-access-mail-admin",
+        rmqadmin = "parse-admin:can-access-rmq-admin",
+        metaadmin = "meta:can-see-admin",
+        chatadmin = "chat:can-see-admin",
+        changelog = "changelog:can-see-app"
+    }
+    enum GTFS {
+        global = "gtfs:can-access-global"
     }
     enum DOCUMENTATION {
         see_app = "documentation:can-see-app"

package/dist/features/permissions/types/Permissions.js

@@ -28,12 +28,46 @@ var Permissions;
         // Update
         MAINTENANCE["kanban_view"] = "maintenance:can-update-kanban-view";
     })(MAINTENANCE = Permissions.MAINTENANCE || (Permissions.MAINTENANCE = {}));
+    let SERVICE;
+    (function (SERVICE) {
+        // Tickets
+        SERVICE["ticket_read"] = "service:can-read-ticket";
+        SERVICE["ticket_create"] = "service:can-create-ticket";
+        SERVICE["ticket_edit"] = "service:can-edit-ticket";
+        SERVICE["ticket_delete"] = "service:can-delete-ticket";
+        SERVICE["ticket_assign"] = "service:can-assign-ticket";
+        // Schedules (Wartungspläne)
+        SERVICE["schedule_read"] = "service:can-read-schedule";
+        SERVICE["schedule_create"] = "service:can-create-schedule";
+        SERVICE["schedule_edit"] = "service:can-edit-schedule";
+        SERVICE["schedule_delete"] = "service:can-delete-schedule";
+        // Executions (Durchführungen)
+        SERVICE["execution_perform"] = "service:can-perform-execution";
+        // Catalog / master data / form config
+        SERVICE["template_manage"] = "service:can-manage-template";
+        SERVICE["masterdata_manage"] = "service:can-manage-masterdata";
+        SERVICE["formconfig_manage"] = "service:can-manage-formconfig";
+        // Analytics / monitoring
+        SERVICE["analytics_view"] = "service:can-view-analytics";
+    })(SERVICE = Permissions.SERVICE || (Permissions.SERVICE = {}));
     let CORE;
     (function (CORE) {
         // Access
         CORE["adminoverview"] = "opendash:can-access-admin-overview";
         CORE["mailadmin"] = "parse-admin:can-access-mail-admin";
+        CORE["rmqadmin"] = "parse-admin:can-access-rmq-admin";
+        // Admin areas of the CORE-owned plugins. The owning classes are mapped to
+        // CORE in featuremap.json (OD3_Meta_*, OD3_Chat_Message, OD3_Changelog),
+        // so their permissions register under the same feature.
+        CORE["metaadmin"] = "meta:can-see-admin";
+        CORE["chatadmin"] = "chat:can-see-admin";
+        CORE["changelog"] = "changelog:can-see-app";
     })(CORE = Permissions.CORE || (Permissions.CORE = {}));
+    let GTFS;
+    (function (GTFS) {
+        // Access
+        GTFS["global"] = "gtfs:can-access-global";
+    })(GTFS = Permissions.GTFS || (Permissions.GTFS = {}));
     let DOCUMENTATION;
     (function (DOCUMENTATION) {
         // Access

package/dist/features/ruleset/applyRuleSet.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Backend port of the `@opendash/ui` ruleset evaluator
+ * (`libs/ui/src/features/ruleset/functions/applyRuleSet.ts`).
+ *
+ * The frontend authors condition trees with the RuleSet editor and stores them
+ * as JSON; notifications must be created server-side, so the same evaluation
+ * logic has to run here. This is a faithful, dependency-free copy of the pure
+ * evaluation core — keep the operator semantics in sync with the frontend.
+ */
+export type RuleOperator = "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "isEmpty" | "isNotEmpty" | "gt" | "gte" | "lt" | "lte" | "between" | "isTrue" | "isFalse" | "before" | "after";
+/** A single comparison against one field. */
+export interface Rule {
+    id: string;
+    kind: "rule";
+    field: string;
+    operator: RuleOperator;
+    value?: string | number | boolean;
+    /** Secondary value — only used for the "between" operator. */
+    value2?: number;
+}
+/** A logical group that chains rules and nested groups via AND / OR. */
+export interface RuleGroup {
+    id: string;
+    kind: "group";
+    conjunction: "AND" | "OR";
+    rules: Array<Rule | RuleGroup>;
+}
+export type RuleSetValue = RuleGroup;
+/** A saved ruleset-function entry as produced by the RuleSet editor. */
+export interface RuleSetFunctionEntry {
+    ruleset: RuleSetValue;
+    function: string;
+    params?: Record<string, unknown>;
+}
+/** Resolves the current value for a given field name. */
+export type GetValueFn = (fieldName: string) => unknown;
+/**
+ * Evaluates a `RuleSetValue` against live data. An empty rule group always
+ * returns `true` (matches the frontend semantics).
+ */
+export declare function applyRuleSet(ruleSet: RuleSetValue, getValue: GetValueFn): boolean;

package/dist/features/ruleset/applyRuleSet.js

@@ -0,0 +1,81 @@
+"use strict";
+/**
+ * Backend port of the `@opendash/ui` ruleset evaluator
+ * (`libs/ui/src/features/ruleset/functions/applyRuleSet.ts`).
+ *
+ * The frontend authors condition trees with the RuleSet editor and stores them
+ * as JSON; notifications must be created server-side, so the same evaluation
+ * logic has to run here. This is a faithful, dependency-free copy of the pure
+ * evaluation core — keep the operator semantics in sync with the frontend.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyRuleSet = applyRuleSet;
+function evaluateRule(rule, getValue) {
+    const fieldValue = getValue(rule.field);
+    switch (rule.operator) {
+        case "equals":
+            // eslint-disable-next-line eqeqeq
+            return fieldValue == rule.value;
+        case "notEquals":
+            // eslint-disable-next-line eqeqeq
+            return fieldValue != rule.value;
+        case "contains":
+            return (typeof fieldValue === "string" &&
+                fieldValue.includes(String(rule.value ?? "")));
+        case "notContains":
+            return (typeof fieldValue === "string" &&
+                !fieldValue.includes(String(rule.value ?? "")));
+        case "startsWith":
+            return (typeof fieldValue === "string" &&
+                fieldValue.startsWith(String(rule.value ?? "")));
+        case "endsWith":
+            return (typeof fieldValue === "string" &&
+                fieldValue.endsWith(String(rule.value ?? "")));
+        case "isEmpty":
+            return (fieldValue === null || fieldValue === undefined || fieldValue === "");
+        case "isNotEmpty":
+            return (fieldValue !== null && fieldValue !== undefined && fieldValue !== "");
+        case "gt":
+            return Number(fieldValue) > Number(rule.value);
+        case "gte":
+            return Number(fieldValue) >= Number(rule.value);
+        case "lt":
+            return Number(fieldValue) < Number(rule.value);
+        case "lte":
+            return Number(fieldValue) <= Number(rule.value);
+        case "between":
+            return (Number(fieldValue) >= Number(rule.value) &&
+                Number(fieldValue) <= Number(rule.value2));
+        case "isTrue":
+            return fieldValue === true;
+        case "isFalse":
+            return fieldValue === false;
+        case "before":
+            return new Date(String(fieldValue)) < new Date(String(rule.value ?? ""));
+        case "after":
+            return new Date(String(fieldValue)) > new Date(String(rule.value ?? ""));
+        default:
+            return false;
+    }
+}
+function evaluateGroup(group, getValue) {
+    if (group.rules.length === 0)
+        return true;
+    if (group.conjunction === "AND") {
+        return group.rules.every((item) => item.kind === "rule"
+            ? evaluateRule(item, getValue)
+            : evaluateGroup(item, getValue));
+    }
+    return group.rules.some((item) => item.kind === "rule"
+        ? evaluateRule(item, getValue)
+        : evaluateGroup(item, getValue));
+}
+/**
+ * Evaluates a `RuleSetValue` against live data. An empty rule group always
+ * returns `true` (matches the frontend semantics).
+ */
+function applyRuleSet(ruleSet, getValue) {
+    if (!ruleSet || ruleSet.kind !== "group")
+        return false;
+    return evaluateGroup(ruleSet, getValue);
+}

package/dist/features/schema/helper/defaultHandler.js

@@ -9,6 +9,7 @@ const node_1 = __importDefault(require("parse/node"));
 const index_js_1 = require("../../permissions/index.js");
 const SchemaClass_js_1 = require("../classes/SchemaClass.js");
 const index_js_2 = require("../index.js");
+const migrationMode_js_1 = require("./migrationMode.js");
 /**
  * Handles the default beforeSave() logic for a Parse.Object.
  *
@@ -25,6 +26,13 @@ async function defaultHandler(request) {
         console.log(`[@openinc/parse-server-opendash] Skipping default beforeSave() handler of ${className} for masterkey`);
         return;
     }
+    // Maintenance-key writes report `master: false` (Parse sets `request.master` from
+    // `auth.isMaster` only), so without this they would fall through to the
+    // `!request.user` throw below. See helper/migrationMode.ts.
+    if ((0, migrationMode_js_1.isMigrationMode)()) {
+        console.log(`[@openinc/parse-server-opendash] Skipping default beforeSave() handler of ${className} for migration mode`);
+        return;
+    }
     if (!request.user) {
         throw new Error();
     }
@@ -74,6 +82,11 @@ async function defaultHandler(request) {
  */
 async function defaultAclHandler(request, options) {
     const className = request.object.className;
+    // In migration mode the writer supplies the ACL itself (it has to replicate the
+    // historical owner/tenant), so applying defaults here would overwrite it.
+    if ((0, migrationMode_js_1.isMigrationMode)()) {
+        return;
+    }
     const currentSchema = SchemaClass_js_1.SchemaClass.getInstance().getClassSchema(className);
     if (!currentSchema) {
         console.warn(`[@openinc/parse-server-opendash] Skipping default beforeSave() ACL handler, no schema found for ${className}`);

package/dist/features/schema/helper/migrationMode.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Migration mode — an explicit escape hatch for the openservice v1 → v2 data
+ * migration (see `plugins/openservice/MIGRATION_PLAN.md` in the opendash repo).
+ *
+ * Why this exists: the migration writes with the **maintenance** key, because that
+ * is the only auth level Parse Server lets set a historical `createdAt`
+ * (`RestWrite.js`: `if (this.auth.isMaintenance && this.data.createdAt …)`). But
+ * `Auth.maintenance()` leaves `isMaster: false`, and `getRequestObject()` derives
+ * `request.master` from `isMaster` only — so triggers see `master === false`.
+ * `defaultHandler` therefore does *not* take its master-key shortcut, reaches
+ * `if (!request.user) throw`, and every maintenance-key write fails.
+ *
+ * So `request.master` cannot serve as an "is this the migration?" signal, and
+ * sniffing for a missing user would silently change behaviour for ordinary
+ * requests. An explicit env flag keeps the exception auditable, greppable, and
+ * impossible to hit by accident.
+ *
+ * While enabled, the caller takes over responsibility for everything it disables:
+ * `tenant`, `user` and the ACL on every object written.
+ */
+/**
+ * True when `OD_MIGRATION_MODE=1`. Logs a loud one-time banner the first time it
+ * is observed, so a server accidentally left in migration mode is obvious in the
+ * logs rather than silently permissive.
+ */
+export declare function isMigrationMode(): boolean;