@openinc/parse-server-opendash 4.1.1 → 4.1.3

package/dist/hooks/Service_Tag.js

@@ -0,0 +1,168 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.init = init;
+const node_1 = __importDefault(require("parse/node"));
+const index_js_1 = require("../features/schema/index.js");
+const index_js_2 = require("../types/index.js");
+async function init() {
+    (0, index_js_1.beforeSaveHook)(index_js_2.Service_Tag, async (request) => {
+        const { object, original, user } = request;
+        await (0, index_js_1.defaultHandler)(request);
+        await (0, index_js_1.defaultAclHandler)(request);
+        // TODO
+    });
+    (0, index_js_1.afterSaveHook)(index_js_2.Service_Tag, async ({ object, original }) => {
+        // Entities store the *ancestor closure* of the tags picked on them (see the
+        // tags README). Re-parenting a tag changes those ancestors, so every
+        // equipment/ticket whose closure includes this tag must be rebuilt.
+        // A brand-new tag (no `original`) has nothing referencing it yet.
+        if (!original)
+            return;
+        // A migration re-run can re-parent an already-imported tag; rebuilding
+        // closures mid-import would race the pass that is still writing them. The
+        // migration rebuilds once at the end instead. See helper/migrationMode.ts.
+        if ((0, index_js_1.isMigrationMode)())
+            return;
+        const oldParentId = getParentId(original);
+        const newParentId = getParentId(object);
+        if (oldParentId === newParentId)
+            return; // parent unchanged → closures fine
+        await reconcileClosures(object, oldParentId, newParentId);
+    });
+    (0, index_js_1.afterDeleteHook)(index_js_2.Service_Tag, async (request) => {
+        const { object } = request;
+        await cleanupTagArrays(object);
+    });
+}
+async function cleanupTagArrays(object) {
+    if (!object.id)
+        return;
+    await Promise.all([
+        removeTagFromClass(index_js_2.Service_Ticket, object),
+        removeTagFromClass(index_js_2.Service_Equipment, object),
+    ]);
+}
+async function removeTagFromClass(ObjectClass, tag) {
+    const query = new node_1.default.Query(ObjectClass);
+    query.equalTo("tags", tag.id);
+    // A tag can only be referenced by objects of the same tenant, so we narrow
+    // the query to avoid scanning (and touching) other tenants' data.
+    if (tag.tenant) {
+        query.equalTo("tenant", tag.tenant);
+    }
+    const affected = await query.findAll({ useMasterKey: true });
+    for (const object of affected) {
+        object.remove("tags", tag.id);
+    }
+    if (affected.length > 0) {
+        await node_1.default.Object.saveAll(affected, { useMasterKey: true });
+    }
+}
+function getParentId(tag) {
+    return tag.get("parent")?.id ?? null;
+}
+/** Ancestor ids, nearest first; stops on an unknown parent, breaks cycles. */
+function ancestorsOf(id, parents) {
+    const out = [];
+    const seen = new Set([id]);
+    let cur = parents.get(id) ?? null;
+    while (cur && !seen.has(cur)) {
+        seen.add(cur);
+        out.push(cur);
+        cur = parents.get(cur) ?? null;
+    }
+    return out;
+}
+/** Every id plus all of its ancestors, de-duplicated, order preserved. */
+function closureOf(ids, parents) {
+    const out = [];
+    const seen = new Set();
+    const add = (id) => {
+        if (seen.has(id))
+            return;
+        seen.add(id);
+        out.push(id);
+    };
+    for (const id of ids) {
+        add(id);
+        for (const anc of ancestorsOf(id, parents))
+            add(anc);
+    }
+    return out;
+}
+/** Collapse a closure back to only its deepest members. Unknown ids are kept. */
+function deepestOf(ids, parents) {
+    const set = new Set(ids);
+    const impliedByChild = new Set();
+    for (const id of ids) {
+        for (const anc of ancestorsOf(id, parents)) {
+            if (set.has(anc))
+                impliedByChild.add(anc);
+        }
+    }
+    const seen = new Set();
+    return ids.filter((id) => {
+        if (impliedByChild.has(id) || seen.has(id))
+            return false;
+        seen.add(id);
+        return true;
+    });
+}
+function sameMembers(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const set = new Set(a);
+    return b.every((x) => set.has(x));
+}
+/**
+ * Rebuild the ancestor closures stored on equipment/tickets after `tag` was
+ * re-parented. Only this tag moved, so the "old tree" is the current tree with
+ * this tag's parent reverted — recovering the user's real (deepest) picks under
+ * the old tree lets us drop now-invalid ancestors when re-expanding under the
+ * new tree.
+ */
+async function reconcileClosures(tag, oldParentId, newParentId) {
+    const tagId = tag.id;
+    if (!tagId)
+        return;
+    const tenant = tag.tenant;
+    const query = new node_1.default.Query(index_js_2.Service_Tag);
+    if (tenant)
+        query.equalTo("tenant", tenant);
+    const allTags = await query.findAll({ useMasterKey: true });
+    const newParents = new Map();
+    for (const t of allTags) {
+        if (t.id)
+            newParents.set(t.id, getParentId(t));
+    }
+    newParents.set(tagId, newParentId);
+    const oldParents = new Map(newParents);
+    oldParents.set(tagId, oldParentId);
+    await Promise.all([
+        reconcileClass(index_js_2.Service_Ticket, tagId, tenant, oldParents, newParents),
+        reconcileClass(index_js_2.Service_Equipment, tagId, tenant, oldParents, newParents),
+    ]);
+}
+async function reconcileClass(ObjectClass, tagId, tenant, oldParents, newParents) {
+    const query = new node_1.default.Query(ObjectClass);
+    query.equalTo("tags", tagId);
+    // A tag is only referenced by objects of the same tenant.
+    if (tenant)
+        query.equalTo("tenant", tenant);
+    const affected = await query.findAll({ useMasterKey: true });
+    const toSave = [];
+    for (const object of affected) {
+        const current = object.get("tags") ?? [];
+        const rebuilt = closureOf(deepestOf(current, oldParents), newParents);
+        if (!sameMembers(current, rebuilt)) {
+            object.set("tags", rebuilt);
+            toSave.push(object);
+        }
+    }
+    if (toSave.length > 0) {
+        await node_1.default.Object.saveAll(toSave, { useMasterKey: true });
+    }
+}

package/dist/hooks/Service_Ticket.d.ts

@@ -0,0 +1 @@
+export declare function init(): Promise<void>;

package/dist/hooks/Service_Ticket.js

@@ -0,0 +1,433 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.init = init;
+const node_1 = __importStar(require("parse/node"));
+const i18next_1 = __importDefault(require("i18next"));
+const index_js_1 = require("../features/schema/index.js");
+const getUserLanguage_js_1 = require("../helper/getUserLanguage.js");
+const index_js_2 = require("../types/index.js");
+const index_js_3 = require("../features/config/index.js");
+const applyRuleSet_js_1 = require("../features/ruleset/applyRuleSet.js");
+async function init() {
+    (0, index_js_1.beforeSaveHook)("OD3_Service_Ticket", async (request) => {
+        const { object, original, user } = request;
+        const isNew = object.isNew();
+        if (isNew && !object.get("createdBy") && user)
+            object.set("createdBy", user);
+        await (0, index_js_1.defaultHandler)(request);
+        await (0, index_js_1.defaultAclHandler)(request, {
+            allowCustomACL: true,
+            allowTenantUserWrite: true,
+        });
+        await setTicketACL(object);
+        // Assign a sequential ticket number on creation. Done here (backend) rather
+        // than in the frontend because every write path — the create form, the
+        // cross-plugin service, and the generic entity admin — funnels through this
+        // beforeSave, and the counter increment is atomic (no client race).
+        //
+        // Also re-number when an existing ticket's `project` changes: numbers are a
+        // per-project sequence, so a ticket keeping its old-project number after a
+        // move could collide with an existing number in the new project. Drawing a
+        // fresh number from the destination keeps each project's sequence unique
+        // (the source sequence simply gains a gap, which is fine).
+        const projectChanged = !isNew && object.dirty("project");
+        if ((isNew && object.get("number") == null) || projectChanged) {
+            await assignTicketNumber(object);
+        }
+    });
+    (0, index_js_1.afterDeleteHook)(index_js_2.Service_Ticket, async ({ object }) => {
+        if (object.id)
+            await cleanupTicketRelations(object.id);
+    });
+    (0, index_js_1.afterSaveHook)(index_js_2.Service_Ticket, async ({ object, original, user }) => {
+        // A bulk import would otherwise notify every assignee once per migrated
+        // ticket (~10k per tenant). See helper/migrationMode.ts.
+        if ((0, index_js_1.isMigrationMode)())
+            return;
+        try {
+            // Shared across the assignee + watcher passes so a user who is both an
+            // assignee and a matched watcher is notified only once (assignee first).
+            const notified = new Set();
+            if (user?.id)
+                notified.add(user.id); // never notify the acting user
+            const assignerName = getUsername(user);
+            await notifyNewAssignees(object, original, notified, assignerName);
+            // Conditional "watcher" rules are evaluated on ticket creation only for
+            // now — re-evaluating them on every edit (and tracking who was already
+            // notified across edits) is deferred.
+            if (!original) {
+                await notifyWatchers(object, notified, assignerName);
+            }
+        }
+        catch (error) {
+            console.error("[@openinc/parse-server-opendash][Service_Ticket] Failed to notify on assignment", error);
+        }
+    });
+}
+/** Upper bound on related records deleted per ticket — far above any realistic
+ * meta/chat/notification count for a single ticket. */
+const RELATED_DELETE_LIMIT = 10000;
+/**
+ * Removes the data attached to a ticket after it is deleted. Parse cannot
+ * cascade these on its own: meta head-data ({@link Meta_Entry}) and chat
+ * messages ({@link Chat_Message}) link to the ticket by a plain string key
+ * rather than a pointer, and notifications reference it inside their JSON `data`
+ * blob. Without this hook all three would be orphaned.
+ *
+ * Child tickets (the `parent` self-pointer) are intentionally left untouched.
+ *
+ * This is the single cleanup path for both single deletes and the dev
+ * "delete all" command, so the frontend no longer needs to delete related data
+ * itself.
+ */
+async function cleanupTicketRelations(ticketId) {
+    const [metaEntries, chatMessages, notifications] = await Promise.all([
+        new node_1.default.Query(index_js_2.Meta_Entry)
+            .equalTo("entryClassName", index_js_2.Service_Ticket.className)
+            .equalTo("entryObjectId", ticketId)
+            .limit(RELATED_DELETE_LIMIT)
+            .find({ useMasterKey: true }),
+        // Chat context is stored as `contextToString(["service","ticket",id])`,
+        // i.e. a JSON.stringify of the tuple — match it exactly.
+        new node_1.default.Query(index_js_2.Chat_Message)
+            .equalTo("context", JSON.stringify(["service", "ticket", ticketId]))
+            .limit(RELATED_DELETE_LIMIT)
+            .find({ useMasterKey: true }),
+        // `data` is a JSON Object column; Parse supports dot-notation into it. Query
+        // by class name (untyped) so the `data.ticketId` path key is accepted.
+        new node_1.default.Query(index_js_2.Notification.className)
+            .equalTo("data.ticketId", ticketId)
+            .limit(RELATED_DELETE_LIMIT)
+            .find({ useMasterKey: true }),
+    ]);
+    await node_1.default.Object.destroyAll([...metaEntries, ...chatMessages, ...notifications], { useMasterKey: true });
+}
+/**
+ * Assigns a sequential `number` to a new ticket.
+ *
+ * - With a project: atomically increments that project's `ticketCounter` and
+ *   uses the result, so numbers are per-project sequences.
+ * - Without a project: falls back to a per-tenant counter
+ *   (`OD3_Service_TicketCounter`, one row per tenant), so every ticket still
+ *   gets a number.
+ *
+ * The increments use Parse's atomic `$inc`, so concurrent creates never collide.
+ */
+async function assignTicketNumber(ticket) {
+    const project = ticket.get("project");
+    if (project) {
+        await project.fetch({ useMasterKey: true });
+        project.increment("ticketCounter", 1);
+        await project.save(null, { useMasterKey: true });
+        ticket.set("number", project.get("ticketCounter"));
+        return;
+    }
+    const tenant = ticket.get("tenant");
+    if (!tenant)
+        return; // no scope to count within — leave unnumbered
+    ticket.set("number", await nextTenantTicketNumber(tenant));
+}
+/** Find-or-create the tenant's ticket counter and return the next value. */
+async function nextTenantTicketNumber(tenant) {
+    const existing = await new node_1.default.Query("OD3_Service_TicketCounter")
+        .equalTo("tenant", tenant)
+        .first({ useMasterKey: true });
+    if (existing) {
+        existing.increment("value", 1);
+        await existing.save(null, { useMasterKey: true });
+        return existing.get("value");
+    }
+    const Counter = node_1.default.Object.extend("OD3_Service_TicketCounter");
+    const counter = new Counter();
+    counter.set("tenant", tenant);
+    counter.set("value", 1);
+    await counter.save(null, { useMasterKey: true });
+    return 1;
+}
+/**
+ * Sets the ticket ACL from `createdBy`, `assignedUsers` and `assignedRoles` —
+ * each gets read/write. `assignedUsers`/`assignedRoles` are arrays of Parse
+ * pointers, so we iterate the entries (by object id) rather than the array
+ * indices. Parse ACL role grants require the role *name*, not its id, so the
+ * assigned role pointers are resolved to names first.
+ */
+async function setTicketACL(object) {
+    const acl = object.getACL() ?? new node_1.default.ACL();
+    // deny global read / write
+    acl.setPublicReadAccess(false);
+    acl.setPublicWriteAccess(false);
+    // creator read/write
+    const creatorId = object.get("createdBy")?.id;
+    if (creatorId) {
+        acl.setReadAccess(creatorId, true);
+        acl.setWriteAccess(creatorId, true);
+    }
+    // assigned users read/write
+    for (const userId of pointerIds(object.get("assignedUsers"))) {
+        acl.setReadAccess(userId, true);
+        acl.setWriteAccess(userId, true);
+    }
+    // assigned roles read/write (resolve pointer ids → role names)
+    const roleIds = pointerIds(object.get("assignedRoles"));
+    if (roleIds.length > 0) {
+        const roles = await new node_1.default.Query(node_1.default.Role)
+            .containedIn("objectId", roleIds)
+            .find({ useMasterKey: true });
+        for (const role of roles) {
+            const name = role.getName();
+            if (name) {
+                acl.setRoleReadAccess(name, true);
+                acl.setRoleWriteAccess(name, true);
+            }
+        }
+    }
+    object.setACL(acl);
+}
+/**
+ * Notifies the users and roles that were newly assigned to a ticket.
+ *
+ * Runs on every save and diffs the current `assignedUsers`/`assignedRoles`
+ * (arrays of pointers) against the previous version (`original`). On creation
+ * `original` is undefined, so everyone assigned is new; on an edit only the
+ * added assignees are notified, so re-saving a ticket never re-notifies people
+ * who were already assigned.
+ *
+ * Dedup + precedence mirror the chat-mention feature: one notification per user,
+ * directly assigned users win over role membership (`users` > `roles`), and the
+ * acting user (whoever performed the save) is never notified.
+ */
+async function notifyNewAssignees(ticket, original, notified, assignerName) {
+    const newUserIds = addedIds(ticket.get("assignedUsers"), original?.get("assignedUsers"));
+    const newRoleIds = addedIds(ticket.get("assignedRoles"), original?.get("assignedRoles"));
+    if (newUserIds.length === 0 && newRoleIds.length === 0)
+        return;
+    await notifyRecipients(newUserIds, newRoleIds, notified, ticket, {
+        variant: "assigned",
+        assignerName,
+    });
+}
+/** OD3_Config key holding the per-tenant assignment-notification rules. */
+const ASSIGNMENT_NOTIFICATION_CONFIG_KEY = "OPENSERVICE_ASSIGNMENT_NOTIFICATIONS";
+/**
+ * Notifies the configured "watchers": users/roles that a conditional ruleset
+ * says should hear about a ticket, independent of assignment. The rules live in
+ * a per-tenant {@link Config} row (`OPENSERVICE_ASSIGNMENT_NOTIFICATIONS`) as a
+ * JSON array of RuleSet function entries authored in the frontend admin. Each
+ * matching rule's assignees (`user:<id>` / `role:<id>`) are notified, deduped
+ * against the shared `notified` set (so assignees already handled win).
+ */
+async function notifyWatchers(ticket, notified, assignerName) {
+    const rules = await loadWatcherRules(ticket.get("tenant"));
+    if (rules.length === 0)
+        return;
+    const getValue = (field) => ticket.get(field);
+    for (const rule of rules) {
+        if (rule.function !== "notify" || !rule.ruleset)
+            continue;
+        if (!(0, applyRuleSet_js_1.applyRuleSet)(rule.ruleset, getValue))
+            continue;
+        const assignees = Array.isArray(rule.params?.assignees)
+            ? rule.params.assignees
+            : [];
+        const userIds = assignees
+            .filter((a) => a.startsWith("user:"))
+            .map((a) => a.slice(5));
+        const roleIds = assignees
+            .filter((a) => a.startsWith("role:"))
+            .map((a) => a.slice(5));
+        await notifyRecipients(userIds, roleIds, notified, ticket, {
+            variant: "watcher",
+            assignerName,
+            frontpage: rule.params?.frontpage === true,
+        });
+    }
+}
+/** Loads and parses the tenant's assignment-notification rules. */
+async function loadWatcherRules(tenant) {
+    if (!tenant)
+        return [];
+    const config = await new node_1.default.Query(index_js_2.Config)
+        .equalTo("key", ASSIGNMENT_NOTIFICATION_CONFIG_KEY)
+        .equalTo("tenant", tenant)
+        .first({ useMasterKey: true });
+    const raw = config?.get("value");
+    if (typeof raw !== "string")
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Resolves a set of user ids + role ids to concrete recipients and sends one
+ * notification each, skipping anyone already in `notified`. Directly listed
+ * users take precedence over users reached via a role. `notified` is mutated so
+ * callers can chain multiple passes (assignees, then watchers) with shared
+ * de-duplication.
+ */
+async function notifyRecipients(userIds, roleIds, notified, ticket, options) {
+    const users = userIds.length
+        ? await new node_1.default.Query(node_1.default.User)
+            .containedIn("objectId", userIds)
+            .findAll({ useMasterKey: true })
+        : [];
+    for (const user of users) {
+        if (!user.id || notified.has(user.id))
+            continue;
+        notified.add(user.id);
+        await sendAssignmentNotification(user, ticket, options);
+    }
+    const roles = roleIds.length
+        ? await new node_1.default.Query(node_1.Role)
+            .containedIn("objectId", roleIds)
+            .findAll({ useMasterKey: true })
+        : [];
+    for (const role of roles) {
+        const members = await role
+            .relation("users")
+            .query()
+            .findAll({ useMasterKey: true });
+        for (const member of members) {
+            if (!member.id || notified.has(member.id))
+                continue;
+            notified.add(member.id);
+            await sendAssignmentNotification(member, ticket, options);
+        }
+    }
+}
+/**
+ * Builds and saves a single assignment notification, translated into the
+ * recipient's preferred language. Delivery (email + web push) is handled
+ * automatically by the {@link Notification} afterSave hook.
+ */
+async function sendAssignmentNotification(user, ticket, options) {
+    await i18next_1.default.changeLanguage(await (0, getUserLanguage_js_1.getUserLanguage)(user));
+    const ticketLink = await getTicketLink(ticket, user);
+    const base = `openservice:ticket.assignment.${options.variant}`;
+    const ticketName = ticket.get("title");
+    await new index_js_2.Notification({
+        title: i18next_1.default.t(`${base}.title`),
+        description: i18next_1.default.t(`${base}.description`, {
+            username: options.assignerName,
+            ticketName,
+            ticketLink,
+        }),
+        type: options.frontpage ? "frontpage" : "mailbox",
+        data: {
+            ticketId: ticket.id,
+            translation: {
+                username: options.assignerName,
+                ticketName,
+                ticketId: ticket.id,
+            },
+        },
+        user: user,
+        isSent: false,
+    }).save(null, { useMasterKey: true });
+}
+/** Ids present in `current` (array of pointers) but not in `previous`. */
+function addedIds(current, previous) {
+    const previousIds = new Set(pointerIds(previous));
+    return pointerIds(current).filter((id) => !previousIds.has(id));
+}
+/** Extracts the object ids from an array of Parse pointers, tolerating
+ * undefined / malformed entries. */
+function pointerIds(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value
+        .map((entry) => {
+        // The entity adapter stores array-of-ref fields as plain id
+        // STRINGS, not Parse.Objects. Reading `.id` off them returned
+        // undefined, so setTicketACL granted assignees nothing and
+        // notifyNewAssignees found nobody — silently, for every ticket.
+        if (typeof entry === "string")
+            return entry;
+        if (entry && typeof entry === "object") {
+            const o = entry;
+            return o.id ?? o.objectId;
+        }
+        return undefined;
+    })
+        .filter((id) => typeof id === "string");
+}
+/**
+ * Returns the link to a ticket.
+ * @param ticket
+ * @returns
+ */
+async function getTicketLink(ticket, user) {
+    //Get hostname from tenant or environment variable or default to localhost
+    let hostname = "localhost";
+    const tenant = (await user.fetchWithInclude("tenant", { useMasterKey: true })).get("tenant");
+    try {
+        const baseurl = tenant?.get("baseUrl");
+        const publicurl = index_js_3.ConfigInstance.getInstance()
+            .get("PARSE_PUBLIC_SERVER_URL")
+            .replace("/parse", "");
+        if (baseurl !== undefined && baseurl !== "") {
+            hostname = baseurl;
+        }
+        else if (publicurl) {
+            hostname = publicurl;
+        }
+    }
+    catch (error) {
+        console.warn("[@openinc/parse-server-opendash] Could not get a hostname, defaulting to localhost");
+    }
+    return `${hostname}/service/tickets/${ticket.id}`;
+}
+function getUsername(user) {
+    if (!user)
+        return "System";
+    let username = "";
+    if (user?.get("firstname") && user?.get("lastname")) {
+        username = user?.get("firstname") + " " + user?.get("lastname");
+    }
+    else if (user?.get("name")) {
+        username = user.get("name");
+    }
+    else if (user?.getUsername()) {
+        username = user?.getUsername();
+    }
+    return username ?? "System";
+}

package/dist/hooks/Service_TriggerState.d.ts

@@ -0,0 +1 @@
+export declare function init(): Promise<void>;

package/dist/hooks/Service_TriggerState.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.init = init;
+const index_js_1 = require("../features/schema/index.js");
+const index_js_2 = require("../types/index.js");
+async function init() {
+    (0, index_js_1.beforeSaveHook)(index_js_2.Service_TriggerState, async (request) => {
+        const { object, original, user } = request;
+        await (0, index_js_1.defaultHandler)(request);
+        await (0, index_js_1.defaultAclHandler)(request);
+        // TODO
+    });
+    (0, index_js_1.afterSaveHook)(index_js_2.Service_TriggerState, async (request) => {
+        const { object, original, user } = request;
+        // TODO
+    });
+}

package/dist/hooks/_ChangeLog.js

@@ -23,10 +23,24 @@ async function init() {
     ];
     console.log(`ChangeLog blacklisted classes: ${blacklistedClasses.join(", ") || "None"}`);
     (0, index_js_1.beforeSaveHook)(index_js_3.Changelog.className, async (request) => {
-        const { object, original, user } = request;
+        const { object, user } = request;
         await (0, index_js_1.defaultHandler)(request);
-        await (0, index_js_1.defaultAclHandler)(request);
-        if (user && user.id && object && object.getACL()) {
+        // Mirror the ACL of the changed object instead of locking the changelog to
+        // the od-admin role: whoever can see the underlying object can see its
+        // history. The object snapshot lives in `value` for create/update and in
+        // `original` for delete (both are `Parse.Object.toJSON()` output, which
+        // carries the object's ACL under the `ACL` key).
+        const snapshot = object.get("value") ?? object.get("original");
+        const sourceAcl = snapshot?.ACL;
+        if (sourceAcl) {
+            object.setACL(new node_1.default.ACL(sourceAcl));
+        }
+        else {
+            // No ACL on the source (e.g. public or masterkey-only object): fall back
+            // to the restrictive default rather than leaving the changelog public.
+            await (0, index_js_1.defaultAclHandler)(request);
+        }
+        if (user && user.id && object.getACL()) {
             object.getACL().setReadAccess(user.id, true);
         }
     });
@@ -77,9 +91,16 @@ async function init() {
         (0, index_js_1.beforeDeleteHook)(classSchema.className, async (request) => {
             console.log(`Creating ChangeLog entry for DELETE on class ${classSchema.className} and object ${request.object.id}`);
             try {
-                const { object, user, master } = request;
-                if (blacklistedClasses.includes(classSchema.className)) {
-                    console.log(`Skipping ChangeLog entry for class ${classSchema.className} and object ${object.id} due to blacklisted class.`);
+                const { object, user, master, context } = request;
+                // `context.skipChangelog` is honoured here as well as on afterSave. The
+                // two were asymmetric: a caller could suppress the create/update entry but
+                // not the delete entry, so a bulk cleanup (a migration rollback, a dev
+                // purge) wrote one delete entry per row into the very table it was trying
+                // to clear. Parse does pass `context` to beforeDelete, and the JS SDK
+                // forwards it on `destroy`/`destroyAll`, so nothing else was missing.
+                if (context?.skipChangelog ||
+                    blacklistedClasses.includes(classSchema.className)) {
+                    console.log(`Skipping ChangeLog entry for class ${classSchema.className} and object ${object.id} due to ${context?.skipChangelog ? "context flag" : "blacklisted class"}.`);
                     return;
                 }
                 const changelog = new index_js_3.Changelog();