@openinc/parse-server-opendash 4.1.5 → 4.1.7

package/dist/features/schema/helper/hideSoftDeleted.d.ts

@@ -0,0 +1,46 @@
+export interface HideSoftDeletedOptions {
+    /** Column carrying the soft-delete marker, e.g. `"deleted"` / `"deletedAt"`. */
+    field: string;
+    /**
+     * How the marker is stored:
+     * - `"boolean"` (default): archived when the column is `true`. Rows where the
+     *   column is missing count as *not* archived, so legacy rows written before
+     *   the column existed stay visible.
+     * - `"date"`: archived when the column is set at all.
+     */
+    type?: "boolean" | "date";
+}
+/**
+ * Hides soft-deleted rows of a class from every client query — the server-side
+ * counterpart of the frontend's soft delete (the admin action stamps the marker
+ * column instead of destroying the row, so nothing pointing at the record ends
+ * up dangling).
+ *
+ * Doing it here rather than in each frontend query means a class is filtered
+ * *once*, for every consumer: dashboards, reference dropdowns, KPI counts
+ * (`count` runs through beforeFind too) and any plugin that queries the class
+ * later on. A caller that forgets the filter no longer leaks archived rows.
+ *
+ * Three escape hatches, in the order they are checked:
+ *
+ * 1. **Master key** — backend hooks, cloud functions and migration scripts see
+ *    everything. They are the ones that have to clean archived rows up.
+ * 2. **The query already constrains `field`** — an explicit constraint always
+ *    wins, which is how an "archive" view asks for the hidden rows
+ *    (`deleted = true`) and how a query asks for *all* rows regardless of the
+ *    marker (`deleted $nin []` matches every row, including those where the
+ *    column is missing).
+ * 3. **The query names object ids** (`objectId` / `objectId $in [...]`) — such a
+ *    query resolves a *known reference* rather than listing: a `get` by id, the
+ *    server resolving an `include`d pointer, or a batch label lookup. Parse runs
+ *    beforeFind for include resolution as well, so without this a ticket
+ *    pointing at an archived status would come back with an unresolved pointer
+ *    and the UI would lose the label. Hiding is about listing, not about
+ *    breaking references that already exist.
+ *
+ * @param target - The Parse class (or its name) to filter.
+ * @param options - Marker column and how it is stored, see {@link HideSoftDeletedOptions}.
+ */
+export declare function hideSoftDeleted<T extends Parse.Object<Parse.Attributes>>(target: string | {
+    new (): T;
+}, options: HideSoftDeletedOptions): void;

package/dist/features/schema/helper/hideSoftDeleted.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hideSoftDeleted = hideSoftDeleted;
+const beforeFindHook_js_1 = require("../services/beforeFindHook.js");
+/**
+ * Hides soft-deleted rows of a class from every client query — the server-side
+ * counterpart of the frontend's soft delete (the admin action stamps the marker
+ * column instead of destroying the row, so nothing pointing at the record ends
+ * up dangling).
+ *
+ * Doing it here rather than in each frontend query means a class is filtered
+ * *once*, for every consumer: dashboards, reference dropdowns, KPI counts
+ * (`count` runs through beforeFind too) and any plugin that queries the class
+ * later on. A caller that forgets the filter no longer leaks archived rows.
+ *
+ * Three escape hatches, in the order they are checked:
+ *
+ * 1. **Master key** — backend hooks, cloud functions and migration scripts see
+ *    everything. They are the ones that have to clean archived rows up.
+ * 2. **The query already constrains `field`** — an explicit constraint always
+ *    wins, which is how an "archive" view asks for the hidden rows
+ *    (`deleted = true`) and how a query asks for *all* rows regardless of the
+ *    marker (`deleted $nin []` matches every row, including those where the
+ *    column is missing).
+ * 3. **The query names object ids** (`objectId` / `objectId $in [...]`) — such a
+ *    query resolves a *known reference* rather than listing: a `get` by id, the
+ *    server resolving an `include`d pointer, or a batch label lookup. Parse runs
+ *    beforeFind for include resolution as well, so without this a ticket
+ *    pointing at an archived status would come back with an unresolved pointer
+ *    and the UI would lose the label. Hiding is about listing, not about
+ *    breaking references that already exist.
+ *
+ * @param target - The Parse class (or its name) to filter.
+ * @param options - Marker column and how it is stored, see {@link HideSoftDeletedOptions}.
+ */
+function hideSoftDeleted(target, options) {
+    const { field, type = "boolean" } = options;
+    (0, beforeFindHook_js_1.beforeFindHook)(target, async (request) => {
+        if (request.master)
+            return;
+        // The marker column is configured by name, so the attribute types of T
+        // cannot describe it — constrain the query untyped.
+        const query = request.query;
+        const where = query.toJSON().where;
+        if (constrainsKey(where, field))
+            return;
+        if (constrainsKey(where, "objectId"))
+            return;
+        if (type === "date")
+            query.doesNotExist(field);
+        // `notEqualTo(true)` rather than `equalTo(false)`: it also keeps rows where
+        // the column was never written.
+        else
+            query.notEqualTo(field, true);
+    });
+}
+/**
+ * Whether a rest `where` clause constrains `key` — including inside the
+ * branches of a compound operator, so an `$or` of two archive filters counts.
+ */
+function constrainsKey(where, key) {
+    if (!where)
+        return false;
+    if (Object.prototype.hasOwnProperty.call(where, key))
+        return true;
+    for (const operator of ["$or", "$and", "$nor"]) {
+        const branches = where[operator];
+        if (Array.isArray(branches) &&
+            branches.some((branch) => constrainsKey(branch, key))) {
+            return true;
+        }
+    }
+    return false;
+}

package/dist/features/schema/index.d.ts

@@ -1,9 +1,11 @@
 export { afterDeleteHook } from "./services/afterDeleteHook.js";
 export { afterSaveHook } from "./services/afterSaveHook.js";
 export { beforeDeleteHook } from "./services/beforeDeleteHook.js";
+export { beforeFindHook } from "./services/beforeFindHook.js";
 export { beforeSaveHook } from "./services/beforeSaveHook.js";
 export * from "./types/hookTypes.js";
 export { defaultAclHandler, defaultHandler } from "./helper/defaultHandler.js";
+export { hideSoftDeleted, type HideSoftDeletedOptions, } from "./helper/hideSoftDeleted.js";
 export { immutableField } from "./helper/immutableField.js";
 export { isMigrationMode } from "./helper/migrationMode.js";
 export { ensureRole } from "./helper/ensureRole.js";

package/dist/features/schema/index.js

@@ -14,19 +14,23 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.initDefaultRoles = exports.initDefaultData = exports.initSchema = exports.ensureUserRole = exports.ensureRole = exports.isMigrationMode = exports.immutableField = exports.defaultHandler = exports.defaultAclHandler = exports.beforeSaveHook = exports.beforeDeleteHook = exports.afterSaveHook = exports.afterDeleteHook = void 0;
+exports.initDefaultRoles = exports.initDefaultData = exports.initSchema = exports.ensureUserRole = exports.ensureRole = exports.isMigrationMode = exports.immutableField = exports.hideSoftDeleted = exports.defaultHandler = exports.defaultAclHandler = exports.beforeSaveHook = exports.beforeFindHook = exports.beforeDeleteHook = exports.afterSaveHook = exports.afterDeleteHook = void 0;
 var afterDeleteHook_js_1 = require("./services/afterDeleteHook.js");
 Object.defineProperty(exports, "afterDeleteHook", { enumerable: true, get: function () { return afterDeleteHook_js_1.afterDeleteHook; } });
 var afterSaveHook_js_1 = require("./services/afterSaveHook.js");
 Object.defineProperty(exports, "afterSaveHook", { enumerable: true, get: function () { return afterSaveHook_js_1.afterSaveHook; } });
 var beforeDeleteHook_js_1 = require("./services/beforeDeleteHook.js");
 Object.defineProperty(exports, "beforeDeleteHook", { enumerable: true, get: function () { return beforeDeleteHook_js_1.beforeDeleteHook; } });
+var beforeFindHook_js_1 = require("./services/beforeFindHook.js");
+Object.defineProperty(exports, "beforeFindHook", { enumerable: true, get: function () { return beforeFindHook_js_1.beforeFindHook; } });
 var beforeSaveHook_js_1 = require("./services/beforeSaveHook.js");
 Object.defineProperty(exports, "beforeSaveHook", { enumerable: true, get: function () { return beforeSaveHook_js_1.beforeSaveHook; } });
 __exportStar(require("./types/hookTypes.js"), exports);
 var defaultHandler_js_1 = require("./helper/defaultHandler.js");
 Object.defineProperty(exports, "defaultAclHandler", { enumerable: true, get: function () { return defaultHandler_js_1.defaultAclHandler; } });
 Object.defineProperty(exports, "defaultHandler", { enumerable: true, get: function () { return defaultHandler_js_1.defaultHandler; } });
+var hideSoftDeleted_js_1 = require("./helper/hideSoftDeleted.js");
+Object.defineProperty(exports, "hideSoftDeleted", { enumerable: true, get: function () { return hideSoftDeleted_js_1.hideSoftDeleted; } });
 var immutableField_js_1 = require("./helper/immutableField.js");
 Object.defineProperty(exports, "immutableField", { enumerable: true, get: function () { return immutableField_js_1.immutableField; } });
 var migrationMode_js_1 = require("./helper/migrationMode.js");

package/dist/features/schema/services/beforeFindHook.d.ts

@@ -0,0 +1,17 @@
+import { beforeFindHookType } from "../index.js";
+/**
+ * Registers a beforeFind hook for a Parse class. In comparison to
+ * Parse.Cloud.beforeFind(), this function allows multiple beforeFind hooks to be
+ * registered for the same class.
+ *
+ * Each callback either mutates `request.query` in place or returns a
+ * replacement query. The result is threaded into the next callback, so several
+ * hooks compose into one set of constraints.
+ *
+ * @template T - The type of the Parse.Object.
+ * @param {string | { new (): T }} target - The name of the Parse class or the class itself.
+ * @param {beforeFindHookType<T>} callback - The callback function to be executed before querying the class.
+ */
+export declare function beforeFindHook<T extends Parse.Object<Parse.Attributes>>(target: string | {
+    new (): T;
+}, callback: beforeFindHookType<T>): void;

package/dist/features/schema/services/beforeFindHook.js

@@ -0,0 +1,39 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.beforeFindHook = beforeFindHook;
+const node_1 = __importDefault(require("parse/node"));
+const beforeFindHooks = {};
+/**
+ * Registers a beforeFind hook for a Parse class. In comparison to
+ * Parse.Cloud.beforeFind(), this function allows multiple beforeFind hooks to be
+ * registered for the same class.
+ *
+ * Each callback either mutates `request.query` in place or returns a
+ * replacement query. The result is threaded into the next callback, so several
+ * hooks compose into one set of constraints.
+ *
+ * @template T - The type of the Parse.Object.
+ * @param {string | { new (): T }} target - The name of the Parse class or the class itself.
+ * @param {beforeFindHookType<T>} callback - The callback function to be executed before querying the class.
+ */
+function beforeFindHook(target, callback) {
+    // @ts-ignore
+    const className = typeof target === "string" ? target : target.className;
+    if (!beforeFindHooks[className]) {
+        beforeFindHooks[className] = [];
+        node_1.default.Cloud.beforeFind(className, async function beforeFindHookFunction(request) {
+            const sessionToken = request.user?.getSessionToken();
+            let query = request.query;
+            for (const fn of beforeFindHooks[className]) {
+                const result = await fn({ ...request, query, sessionToken });
+                if (result)
+                    query = result;
+            }
+            return query;
+        });
+    }
+    beforeFindHooks[className].push(callback);
+}

package/dist/features/schema/types/hookTypes.d.ts

@@ -11,3 +11,11 @@ export type beforeDeleteHookType<T extends Parse.Object<Parse.Attributes>> = (re
 export type afterDeleteHookType<T extends Parse.Object<Parse.Attributes>> = (request: Parse.Cloud.AfterDeleteRequest<T> & {
     sessionToken: SessionTokenType;
 }) => Promise<void>;
+/**
+ * A beforeFind hook. May mutate `request.query` in place or return a
+ * replacement query — the registry threads the returned query through the
+ * remaining hooks of the class.
+ */
+export type beforeFindHookType<T extends Parse.Object<Parse.Attributes>> = (request: Parse.Cloud.BeforeFindRequest<T> & {
+    sessionToken: SessionTokenType;
+}) => Promise<Parse.Query<T> | void>;

package/dist/helper/appLinks.d.ts

@@ -0,0 +1,21 @@
+import { _User } from "../types/index.js";
+/**
+ * App-relative deep link to a service ticket (`OD3_Service_Ticket`).
+ *
+ * Notifications store links relative to the app root rather than absolute:
+ * the same notification is rendered in the frontend (which navigates by route)
+ * and mailed out (which needs a host), and the host depends on the recipient's
+ * tenant. {@link getAppBaseUrl} resolves it at delivery time.
+ */
+export declare function ticketPath(ticketId: string): string;
+/**
+ * Resolves the base URL of the open.DASH frontend for a given recipient, so
+ * links in notification emails point at the app that user actually works in.
+ *
+ * Precedence: the user's tenant `baseUrl` (multi-tenant installs serve each
+ * tenant from its own host), then the global `APP_URL`, then
+ * `PARSE_PUBLIC_SERVER_URL` with the trailing `/parse` stripped. Returns an
+ * empty string when nothing is configured, so callers emit the bare relative
+ * path instead of a link to a bogus host.
+ */
+export declare function getAppBaseUrl(user: _User): Promise<string>;

package/dist/helper/appLinks.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ticketPath = ticketPath;
+exports.getAppBaseUrl = getAppBaseUrl;
+const index_js_1 = require("../features/config/index.js");
+/**
+ * App-relative deep link to a service ticket (`OD3_Service_Ticket`).
+ *
+ * Notifications store links relative to the app root rather than absolute:
+ * the same notification is rendered in the frontend (which navigates by route)
+ * and mailed out (which needs a host), and the host depends on the recipient's
+ * tenant. {@link getAppBaseUrl} resolves it at delivery time.
+ */
+function ticketPath(ticketId) {
+    return `/service/tickets/${ticketId}`;
+}
+/**
+ * Resolves the base URL of the open.DASH frontend for a given recipient, so
+ * links in notification emails point at the app that user actually works in.
+ *
+ * Precedence: the user's tenant `baseUrl` (multi-tenant installs serve each
+ * tenant from its own host), then the global `APP_URL`, then
+ * `PARSE_PUBLIC_SERVER_URL` with the trailing `/parse` stripped. Returns an
+ * empty string when nothing is configured, so callers emit the bare relative
+ * path instead of a link to a bogus host.
+ */
+async function getAppBaseUrl(user) {
+    let baseUrl = "";
+    try {
+        const tenant = (await user.fetchWithInclude("tenant", { useMasterKey: true })).get("tenant");
+        baseUrl = tenant?.get("baseUrl") || "";
+    }
+    catch (error) {
+        // No tenant / not fetchable — fall through to the global configuration.
+    }
+    if (!baseUrl) {
+        try {
+            const config = index_js_1.ConfigInstance.getInstance();
+            const parseUrl = config.get("PARSE_PUBLIC_SERVER_URL") || "";
+            baseUrl = config.get("APP_URL") || parseUrl.replace(/\/parse\/?$/, "");
+        }
+        catch (error) {
+            console.warn("[@openinc/parse-server-opendash] Could not resolve an app base URL for notification links");
+        }
+    }
+    return (baseUrl || "").replace(/\/+$/, "");
+}

package/dist/hooks/BDE_Article.js

@@ -4,8 +4,30 @@ exports.init = init;
 const index_js_1 = require("../features/schema/index.js");
 const index_js_2 = require("../types/index.js");
 async function init() {
+    // Soft delete: articles are referenced from a ticket's `material` list and
+    // from BDE work orders, so both admin UIs archive instead of destroying.
+    // Archived articles are hidden from every client query — including BDE's, the
+    // catalog being shared. The escape hatches keep both usable: a query naming
+    // object ids still resolves an archived article (so an existing work order or
+    // material line keeps its label), and a query constraining `isDeleted` sees
+    // the archive — which is what BDE's `isDeleted` column filter sends, so
+    // un-archiving from the parse admin table still works.
+    (0, index_js_1.hideSoftDeleted)(index_js_2.BDE_Article, { field: "isDeleted" });
     (0, index_js_1.beforeSaveHook)(index_js_2.BDE_Article, async (request) => {
         const { object, original, user } = request;
+        // Normalize the soft-delete marker: an absent column means "not archived",
+        // so write that out explicitly. Not every write path fills it in — BDE's own
+        // admin form does not list the field, and neither does the ABAS sync — and
+        // consumers match on `isDeleted = false` rather than `!= true` (e.g. the
+        // ticket material picker), which an unset column fails.
+        //
+        // Deliberately not limited to `isNew()`: that leaves every already-synced
+        // article invisible to those consumers until someone backfills. Filling it
+        // on any save heals the existing rows instead, as the ABAS sync re-saves the
+        // whole catalog on its first run after a restart.
+        if (object.get("isDeleted") == null) {
+            object.set("isDeleted", false);
+        }
         await (0, index_js_1.defaultHandler)(request);
         // Ported from the former MES_Article hook: tenant users may manage the
         // shared article catalog, and custom ACLs are honoured.

package/dist/hooks/Chat_Message.js

@@ -7,6 +7,7 @@ exports.init = init;
 const node_1 = __importDefault(require("parse/node"));
 const i18next_1 = __importDefault(require("i18next"));
 const index_js_1 = require("../features/schema/index.js");
+const appLinks_js_1 = require("../helper/appLinks.js");
 const getUserLanguage_js_1 = require("../helper/getUserLanguage.js");
 const index_js_2 = require("../types/index.js");
 async function init() {
@@ -49,7 +50,8 @@ async function notifyMentions(object, original) {
         return;
     const username = object.get("authorName") || "System";
     const messageText = messageSnippet(object.get("text"));
-    const url = getMessageLink(object.get("context"));
+    // The only linkable chat context today is a service ticket's comment section.
+    const ticketId = getTicketId(object.get("context"));
     // Users already handled — seeded with the author so they never self-notify.
     const notified = new Set();
     const authorId = object.get("author")?.id;
@@ -71,7 +73,7 @@ async function notifyMentions(object, original) {
         await sendMentionNotification(user, "user", object, {
             username,
             messageText,
-            url,
+            ticketId,
         });
     }
     // 2. Mentioned roles → their members, skipping anyone already notified.
@@ -95,7 +97,7 @@ async function notifyMentions(object, original) {
             await sendMentionNotification(member, "role", object, {
                 username,
                 messageText,
-                url,
+                ticketId,
                 role: role.get("label"),
             });
         }
@@ -105,6 +107,12 @@ async function notifyMentions(object, original) {
  * Builds and saves a single mention notification, translated into the
  * recipient's preferred language. Delivery (email + web push) is handled
  * automatically by the {@link Notification} afterSave hook.
+ *
+ * When the chat belongs to a service ticket the notification also carries that
+ * ticket: `data.url` gives the notification email a deep link (the host is
+ * resolved per recipient at delivery time) and `data.ticketId` gives the
+ * frontend its "open ticket" action — the same two keys assignment
+ * notifications use, so a mention behaves like any other ticket notification.
  */
 async function sendMentionNotification(user, kind, message, vars) {
     await i18next_1.default.changeLanguage(await (0, getUserLanguage_js_1.getUserLanguage)(user));
@@ -117,7 +125,9 @@ async function sendMentionNotification(user, kind, message, vars) {
             role: vars.role,
         }),
         data: {
-            url: vars.url,
+            ...(vars.ticketId
+                ? { ticketId: vars.ticketId, url: (0, appLinks_js_1.ticketPath)(vars.ticketId) }
+                : {}),
             messageId: message.id,
             context: message.get("context"),
             translation: {
@@ -143,11 +153,11 @@ function mentionKey(mention) {
     return `${mention.className}:${mention.id}`;
 }
 /**
- * Derives a deep-link path from the chat's `context`. The context is the
+ * Extracts the ticket a chat belongs to from its `context`. The context is the
  * JSON-stringified address tuple (e.g. `["service","ticket","<id>"]`). Only the
- * service-ticket context is linkable today; anything else yields no link.
+ * service-ticket context is linkable today; anything else yields no ticket.
  */
-function getMessageLink(context) {
+function getTicketId(context) {
     if (typeof context !== "string")
         return undefined;
     try {
@@ -155,12 +165,13 @@ function getMessageLink(context) {
         if (Array.isArray(parts) &&
             parts[0] === "service" &&
             parts[1] === "ticket" &&
+            typeof parts[2] === "string" &&
             parts[2]) {
-            return `/service/tickets/${parts[2]}`;
+            return parts[2];
         }
     }
     catch {
-        // context is not a JSON tuple — no link
+        // context is not a JSON tuple — not ticket-bound
     }
     return undefined;
 }

package/dist/hooks/Notification.js

@@ -9,6 +9,7 @@ const web_push_1 = __importDefault(require("web-push"));
 const index_js_1 = require("../features/schema/index.js");
 const index_js_2 = require("../features/config/index.js");
 const index_js_3 = require("../features/notifications/index.js");
+const appLinks_js_1 = require("../helper/appLinks.js");
 const index_js_4 = require("../types/index.js");
 async function init() {
     (0, index_js_1.beforeSaveHook)(index_js_4.Notification, async (request) => {
@@ -28,13 +29,7 @@ async function init() {
                 const email = user?.getEmail();
                 console.log("[@openinc/parse-server-opendash][Notification]", `notification="${object.id}"`, `type="email"`, `to="${email}"`);
                 if (email) {
-                    let body = description || "";
-                    if (object.get("data")?.url) {
-                        body += "\n\n";
-                        body += index_js_2.ConfigInstance.getInstance().get("APP_URL");
-                        body += object.get("data")?.url;
-                    }
-                    await (0, index_js_3.sendSimpleEmail)(email, title, body);
+                    await (0, index_js_3.sendSimpleEmail)(email, title, await buildEmailBody(description, object.get("data")?.url, user));
                 }
             }
             // Handle Push
@@ -55,6 +50,26 @@ async function init() {
         }
     });
 }
+/**
+ * Plain-text body of a notification email: the (already translated)
+ * description, followed by a link to the thing the notification is about.
+ *
+ * Producers store that link in `data.url` as an app-relative path (e.g.
+ * `/service/tickets/<id>`), because the host depends on the recipient's tenant
+ * and is only known here, at delivery time — the frontend renders the same
+ * notification by route and never needs it. Absolute URLs are passed through
+ * unchanged for producers that resolved a host themselves.
+ */
+async function buildEmailBody(description, url, user) {
+    const body = description || "";
+    if (typeof url !== "string" || url === "") {
+        return body;
+    }
+    const link = /^https?:\/\//i.test(url)
+        ? url
+        : `${await (0, appLinks_js_1.getAppBaseUrl)(user)}${url}`;
+    return `${body}\n\n${link}`;
+}
 async function sendWebPush(subscription, id, title, description, icon, data) {
     try {
         console.log("[@openinc/parse-server-opendash][Notification]", `notification="${id}"`, `type="web"`, `subscription="${subscription?.id}"`);

package/dist/hooks/Service_Equipment.js

@@ -8,6 +8,10 @@ const node_1 = __importDefault(require("parse/node"));
 const index_js_1 = require("../features/schema/index.js");
 const index_js_2 = require("../types/index.js");
 async function init() {
+    // Soft delete: tickets and meter readings point at equipment, so it is
+    // archived rather than destroyed. Archived rows are hidden from every client
+    // query (see hideSoftDeleted()).
+    (0, index_js_1.hideSoftDeleted)(index_js_2.Service_Equipment, { field: "deleted" });
     (0, index_js_1.beforeSaveHook)(index_js_2.Service_Equipment, async (request) => {
         const { object, original, user } = request;
         await (0, index_js_1.defaultHandler)(request);

package/dist/hooks/Service_Project.js

@@ -4,6 +4,10 @@ exports.init = init;
 const index_js_1 = require("../features/schema/index.js");
 const index_js_2 = require("../types/index.js");
 async function init() {
+    // Soft delete: tickets point at their project and draw their number from its
+    // counter, so a project is archived rather than destroyed. Archived rows are
+    // hidden from every client query (see hideSoftDeleted()).
+    (0, index_js_1.hideSoftDeleted)(index_js_2.Service_Project, { field: "deleted" });
     (0, index_js_1.beforeSaveHook)(index_js_2.Service_Project, async (request) => {
         const { object, original, user } = request;
         await (0, index_js_1.defaultHandler)(request);

package/dist/hooks/Service_Status.js

@@ -8,6 +8,10 @@ const node_1 = __importDefault(require("parse/node"));
 const index_js_1 = require("../features/schema/index.js");
 const index_js_2 = require("../types/index.js");
 async function init() {
+    // Soft delete: every ticket carries a required `status` pointer, so a status
+    // is archived rather than destroyed. Archived rows are hidden from every
+    // client query (see hideSoftDeleted() for the escape hatches).
+    (0, index_js_1.hideSoftDeleted)(index_js_2.Service_Status, { field: "deleted" });
     (0, index_js_1.beforeSaveHook)(index_js_2.Service_Status, async (request) => {
         const { object, original, user } = request;
         await (0, index_js_1.defaultHandler)(request);

package/dist/hooks/Service_Tag.js

@@ -8,6 +8,10 @@ const node_1 = __importDefault(require("parse/node"));
 const index_js_1 = require("../features/schema/index.js");
 const index_js_2 = require("../types/index.js");
 async function init() {
+    // Soft delete: tags are stored in the ancestor closures on tickets and
+    // equipment, so they are archived rather than destroyed. Archived rows are
+    // hidden from every client query (see hideSoftDeleted()).
+    (0, index_js_1.hideSoftDeleted)(index_js_2.Service_Tag, { field: "deleted" });
     (0, index_js_1.beforeSaveHook)(index_js_2.Service_Tag, async (request) => {
         const { object, original, user } = request;
         await (0, index_js_1.defaultHandler)(request);

package/dist/hooks/Service_Ticket.js

@@ -40,11 +40,17 @@ exports.init = init;
 const node_1 = __importStar(require("parse/node"));
 const i18next_1 = __importDefault(require("i18next"));
 const index_js_1 = require("../features/schema/index.js");
+const appLinks_js_1 = require("../helper/appLinks.js");
 const getUserLanguage_js_1 = require("../helper/getUserLanguage.js");
 const index_js_2 = require("../types/index.js");
-const index_js_3 = require("../features/config/index.js");
 const applyRuleSet_js_1 = require("../features/ruleset/applyRuleSet.js");
 async function init() {
+    // Soft delete: a ticket is referenced by chat messages, meta entries,
+    // notifications and child tickets, so the frontend archives instead of
+    // destroying. Archived rows are hidden from every client query here — see
+    // hideSoftDeleted() for the escape hatches (master key, an explicit
+    // constraint on `deleted`, and queries naming object ids).
+    (0, index_js_1.hideSoftDeleted)(index_js_2.Service_Ticket, { field: "deleted" });
     (0, index_js_1.beforeSaveHook)("OD3_Service_Ticket", async (request) => {
         const { object, original, user } = request;
         const isNew = object.isNew();
@@ -338,10 +344,15 @@ async function notifyRecipients(userIds, roleIds, notified, ticket, options) {
  * Builds and saves a single assignment notification, translated into the
  * recipient's preferred language. Delivery (email + web push) is handled
  * automatically by the {@link Notification} afterSave hook.
+ *
+ * The deep link lives in `data.url` rather than inside the description text:
+ * the frontend opens the ticket from `data.ticketId` (see
+ * `TicketNotificationActionAdapter`) and would only render a raw URL as noise,
+ * while the notification email appends `data.url` — resolved against the
+ * recipient's tenant host — to the body.
  */
 async function sendAssignmentNotification(user, ticket, options) {
     await i18next_1.default.changeLanguage(await (0, getUserLanguage_js_1.getUserLanguage)(user));
-    const ticketLink = await getTicketLink(ticket, user);
     const base = `openservice:ticket.assignment.${options.variant}`;
     const ticketName = ticket.get("title");
     await new index_js_2.Notification({
@@ -349,11 +360,11 @@ async function sendAssignmentNotification(user, ticket, options) {
         description: i18next_1.default.t(`${base}.description`, {
             username: options.assignerName,
             ticketName,
-            ticketLink,
         }),
         type: options.frontpage ? "frontpage" : "mailbox",
         data: {
             ticketId: ticket.id,
+            url: (0, appLinks_js_1.ticketPath)(ticket.id),
             translation: {
                 username: options.assignerName,
                 ticketName,
@@ -390,32 +401,6 @@ function pointerIds(value) {
     })
         .filter((id) => typeof id === "string");
 }
-/**
- * Returns the link to a ticket.
- * @param ticket
- * @returns
- */
-async function getTicketLink(ticket, user) {
-    //Get hostname from tenant or environment variable or default to localhost
-    let hostname = "localhost";
-    const tenant = (await user.fetchWithInclude("tenant", { useMasterKey: true })).get("tenant");
-    try {
-        const baseurl = tenant?.get("baseUrl");
-        const publicurl = index_js_3.ConfigInstance.getInstance()
-            .get("PARSE_PUBLIC_SERVER_URL")
-            .replace("/parse", "");
-        if (baseurl !== undefined && baseurl !== "") {
-            hostname = baseurl;
-        }
-        else if (publicurl) {
-            hostname = publicurl;
-        }
-    }
-    catch (error) {
-        console.warn("[@openinc/parse-server-opendash] Could not get a hostname, defaulting to localhost");
-    }
-    return `${hostname}/service/tickets/${ticket.id}`;
-}
 function getUsername(user) {
     if (!user)
         return "System";

package/dist/i18n/de-DE/openservice.json

@@ -3,11 +3,11 @@
         "assignment": {
             "assigned": {
                 "title": "Ihnen wurde ein Ticket zugewiesen",
-                "description": "{{username}} hat Ihnen das Ticket {{ticketName}} zugewiesen.\n\nLink: {{- ticketLink}}"
+                "description": "{{username}} hat Ihnen das Ticket {{ticketName}} zugewiesen."
             },
             "watcher": {
                 "title": "Ein Ticket wurde zugewiesen",
-                "description": "{{username}} hat das Ticket {{ticketName}} zugewiesen.\n\nLink: {{- ticketLink}}"
+                "description": "{{username}} hat das Ticket {{ticketName}} zugewiesen."
             }
         }
     }

package/dist/i18n/en-US/openservice.json

@@ -3,11 +3,11 @@
         "assignment": {
             "assigned": {
                 "title": "You were assigned to a ticket",
-                "description": "{{username}} assigned you to ticket {{ticketName}}.\n\nLink: {{- ticketLink}}"
+                "description": "{{username}} assigned you to ticket {{ticketName}}."
             },
             "watcher": {
                 "title": "A ticket was assigned",
-                "description": "{{username}} assigned ticket {{ticketName}}.\n\nLink: {{- ticketLink}}"
+                "description": "{{username}} assigned ticket {{ticketName}}."
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openinc/parse-server-opendash",
-  "version": "4.1.5",
+  "version": "4.1.7",
   "description": "Parse Server Cloud Code for open.INC Stack.",
   "packageManager": "pnpm@11.25.0",
   "keywords": [