@openinc/parse-server-opendash 4.1.6 → 4.1.7

package/dist/features/schema/helper/hideSoftDeleted.d.ts

@@ -0,0 +1,46 @@
+export interface HideSoftDeletedOptions {
+    /** Column carrying the soft-delete marker, e.g. `"deleted"` / `"deletedAt"`. */
+    field: string;
+    /**
+     * How the marker is stored:
+     * - `"boolean"` (default): archived when the column is `true`. Rows where the
+     *   column is missing count as *not* archived, so legacy rows written before
+     *   the column existed stay visible.
+     * - `"date"`: archived when the column is set at all.
+     */
+    type?: "boolean" | "date";
+}
+/**
+ * Hides soft-deleted rows of a class from every client query — the server-side
+ * counterpart of the frontend's soft delete (the admin action stamps the marker
+ * column instead of destroying the row, so nothing pointing at the record ends
+ * up dangling).
+ *
+ * Doing it here rather than in each frontend query means a class is filtered
+ * *once*, for every consumer: dashboards, reference dropdowns, KPI counts
+ * (`count` runs through beforeFind too) and any plugin that queries the class
+ * later on. A caller that forgets the filter no longer leaks archived rows.
+ *
+ * Three escape hatches, in the order they are checked:
+ *
+ * 1. **Master key** — backend hooks, cloud functions and migration scripts see
+ *    everything. They are the ones that have to clean archived rows up.
+ * 2. **The query already constrains `field`** — an explicit constraint always
+ *    wins, which is how an "archive" view asks for the hidden rows
+ *    (`deleted = true`) and how a query asks for *all* rows regardless of the
+ *    marker (`deleted $nin []` matches every row, including those where the
+ *    column is missing).
+ * 3. **The query names object ids** (`objectId` / `objectId $in [...]`) — such a
+ *    query resolves a *known reference* rather than listing: a `get` by id, the
+ *    server resolving an `include`d pointer, or a batch label lookup. Parse runs
+ *    beforeFind for include resolution as well, so without this a ticket
+ *    pointing at an archived status would come back with an unresolved pointer
+ *    and the UI would lose the label. Hiding is about listing, not about
+ *    breaking references that already exist.
+ *
+ * @param target - The Parse class (or its name) to filter.
+ * @param options - Marker column and how it is stored, see {@link HideSoftDeletedOptions}.
+ */
+export declare function hideSoftDeleted<T extends Parse.Object<Parse.Attributes>>(target: string | {
+    new (): T;
+}, options: HideSoftDeletedOptions): void;

package/dist/features/schema/helper/hideSoftDeleted.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hideSoftDeleted = hideSoftDeleted;
+const beforeFindHook_js_1 = require("../services/beforeFindHook.js");
+/**
+ * Hides soft-deleted rows of a class from every client query — the server-side
+ * counterpart of the frontend's soft delete (the admin action stamps the marker
+ * column instead of destroying the row, so nothing pointing at the record ends
+ * up dangling).
+ *
+ * Doing it here rather than in each frontend query means a class is filtered
+ * *once*, for every consumer: dashboards, reference dropdowns, KPI counts
+ * (`count` runs through beforeFind too) and any plugin that queries the class
+ * later on. A caller that forgets the filter no longer leaks archived rows.
+ *
+ * Three escape hatches, in the order they are checked:
+ *
+ * 1. **Master key** — backend hooks, cloud functions and migration scripts see
+ *    everything. They are the ones that have to clean archived rows up.
+ * 2. **The query already constrains `field`** — an explicit constraint always
+ *    wins, which is how an "archive" view asks for the hidden rows
+ *    (`deleted = true`) and how a query asks for *all* rows regardless of the
+ *    marker (`deleted $nin []` matches every row, including those where the
+ *    column is missing).
+ * 3. **The query names object ids** (`objectId` / `objectId $in [...]`) — such a
+ *    query resolves a *known reference* rather than listing: a `get` by id, the
+ *    server resolving an `include`d pointer, or a batch label lookup. Parse runs
+ *    beforeFind for include resolution as well, so without this a ticket
+ *    pointing at an archived status would come back with an unresolved pointer
+ *    and the UI would lose the label. Hiding is about listing, not about
+ *    breaking references that already exist.
+ *
+ * @param target - The Parse class (or its name) to filter.
+ * @param options - Marker column and how it is stored, see {@link HideSoftDeletedOptions}.
+ */
+function hideSoftDeleted(target, options) {
+    const { field, type = "boolean" } = options;
+    (0, beforeFindHook_js_1.beforeFindHook)(target, async (request) => {
+        if (request.master)
+            return;
+        // The marker column is configured by name, so the attribute types of T
+        // cannot describe it — constrain the query untyped.
+        const query = request.query;
+        const where = query.toJSON().where;
+        if (constrainsKey(where, field))
+            return;
+        if (constrainsKey(where, "objectId"))
+            return;
+        if (type === "date")
+            query.doesNotExist(field);
+        // `notEqualTo(true)` rather than `equalTo(false)`: it also keeps rows where
+        // the column was never written.
+        else
+            query.notEqualTo(field, true);
+    });
+}
+/**
+ * Whether a rest `where` clause constrains `key` — including inside the
+ * branches of a compound operator, so an `$or` of two archive filters counts.
+ */
+function constrainsKey(where, key) {
+    if (!where)
+        return false;
+    if (Object.prototype.hasOwnProperty.call(where, key))
+        return true;
+    for (const operator of ["$or", "$and", "$nor"]) {
+        const branches = where[operator];
+        if (Array.isArray(branches) &&
+            branches.some((branch) => constrainsKey(branch, key))) {
+            return true;
+        }
+    }
+    return false;
+}

package/dist/features/schema/index.d.ts

@@ -1,9 +1,11 @@
 export { afterDeleteHook } from "./services/afterDeleteHook.js";
 export { afterSaveHook } from "./services/afterSaveHook.js";
 export { beforeDeleteHook } from "./services/beforeDeleteHook.js";
+export { beforeFindHook } from "./services/beforeFindHook.js";
 export { beforeSaveHook } from "./services/beforeSaveHook.js";
 export * from "./types/hookTypes.js";
 export { defaultAclHandler, defaultHandler } from "./helper/defaultHandler.js";
+export { hideSoftDeleted, type HideSoftDeletedOptions, } from "./helper/hideSoftDeleted.js";
 export { immutableField } from "./helper/immutableField.js";
 export { isMigrationMode } from "./helper/migrationMode.js";
 export { ensureRole } from "./helper/ensureRole.js";

package/dist/features/schema/index.js

@@ -14,19 +14,23 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.initDefaultRoles = exports.initDefaultData = exports.initSchema = exports.ensureUserRole = exports.ensureRole = exports.isMigrationMode = exports.immutableField = exports.defaultHandler = exports.defaultAclHandler = exports.beforeSaveHook = exports.beforeDeleteHook = exports.afterSaveHook = exports.afterDeleteHook = void 0;
+exports.initDefaultRoles = exports.initDefaultData = exports.initSchema = exports.ensureUserRole = exports.ensureRole = exports.isMigrationMode = exports.immutableField = exports.hideSoftDeleted = exports.defaultHandler = exports.defaultAclHandler = exports.beforeSaveHook = exports.beforeFindHook = exports.beforeDeleteHook = exports.afterSaveHook = exports.afterDeleteHook = void 0;
 var afterDeleteHook_js_1 = require("./services/afterDeleteHook.js");
 Object.defineProperty(exports, "afterDeleteHook", { enumerable: true, get: function () { return afterDeleteHook_js_1.afterDeleteHook; } });
 var afterSaveHook_js_1 = require("./services/afterSaveHook.js");
 Object.defineProperty(exports, "afterSaveHook", { enumerable: true, get: function () { return afterSaveHook_js_1.afterSaveHook; } });
 var beforeDeleteHook_js_1 = require("./services/beforeDeleteHook.js");
 Object.defineProperty(exports, "beforeDeleteHook", { enumerable: true, get: function () { return beforeDeleteHook_js_1.beforeDeleteHook; } });
+var beforeFindHook_js_1 = require("./services/beforeFindHook.js");
+Object.defineProperty(exports, "beforeFindHook", { enumerable: true, get: function () { return beforeFindHook_js_1.beforeFindHook; } });
 var beforeSaveHook_js_1 = require("./services/beforeSaveHook.js");
 Object.defineProperty(exports, "beforeSaveHook", { enumerable: true, get: function () { return beforeSaveHook_js_1.beforeSaveHook; } });
 __exportStar(require("./types/hookTypes.js"), exports);
 var defaultHandler_js_1 = require("./helper/defaultHandler.js");
 Object.defineProperty(exports, "defaultAclHandler", { enumerable: true, get: function () { return defaultHandler_js_1.defaultAclHandler; } });
 Object.defineProperty(exports, "defaultHandler", { enumerable: true, get: function () { return defaultHandler_js_1.defaultHandler; } });
+var hideSoftDeleted_js_1 = require("./helper/hideSoftDeleted.js");
+Object.defineProperty(exports, "hideSoftDeleted", { enumerable: true, get: function () { return hideSoftDeleted_js_1.hideSoftDeleted; } });
 var immutableField_js_1 = require("./helper/immutableField.js");
 Object.defineProperty(exports, "immutableField", { enumerable: true, get: function () { return immutableField_js_1.immutableField; } });
 var migrationMode_js_1 = require("./helper/migrationMode.js");

package/dist/features/schema/services/beforeFindHook.d.ts

@@ -0,0 +1,17 @@
+import { beforeFindHookType } from "../index.js";
+/**
+ * Registers a beforeFind hook for a Parse class. In comparison to
+ * Parse.Cloud.beforeFind(), this function allows multiple beforeFind hooks to be
+ * registered for the same class.
+ *
+ * Each callback either mutates `request.query` in place or returns a
+ * replacement query. The result is threaded into the next callback, so several
+ * hooks compose into one set of constraints.
+ *
+ * @template T - The type of the Parse.Object.
+ * @param {string | { new (): T }} target - The name of the Parse class or the class itself.
+ * @param {beforeFindHookType<T>} callback - The callback function to be executed before querying the class.
+ */
+export declare function beforeFindHook<T extends Parse.Object<Parse.Attributes>>(target: string | {
+    new (): T;
+}, callback: beforeFindHookType<T>): void;

package/dist/features/schema/services/beforeFindHook.js

@@ -0,0 +1,39 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.beforeFindHook = beforeFindHook;
+const node_1 = __importDefault(require("parse/node"));
+const beforeFindHooks = {};
+/**
+ * Registers a beforeFind hook for a Parse class. In comparison to
+ * Parse.Cloud.beforeFind(), this function allows multiple beforeFind hooks to be
+ * registered for the same class.
+ *
+ * Each callback either mutates `request.query` in place or returns a
+ * replacement query. The result is threaded into the next callback, so several
+ * hooks compose into one set of constraints.
+ *
+ * @template T - The type of the Parse.Object.
+ * @param {string | { new (): T }} target - The name of the Parse class or the class itself.
+ * @param {beforeFindHookType<T>} callback - The callback function to be executed before querying the class.
+ */
+function beforeFindHook(target, callback) {
+    // @ts-ignore
+    const className = typeof target === "string" ? target : target.className;
+    if (!beforeFindHooks[className]) {
+        beforeFindHooks[className] = [];
+        node_1.default.Cloud.beforeFind(className, async function beforeFindHookFunction(request) {
+            const sessionToken = request.user?.getSessionToken();
+            let query = request.query;
+            for (const fn of beforeFindHooks[className]) {
+                const result = await fn({ ...request, query, sessionToken });
+                if (result)
+                    query = result;
+            }
+            return query;
+        });
+    }
+    beforeFindHooks[className].push(callback);
+}

package/dist/features/schema/types/hookTypes.d.ts

@@ -11,3 +11,11 @@ export type beforeDeleteHookType<T extends Parse.Object<Parse.Attributes>> = (re
 export type afterDeleteHookType<T extends Parse.Object<Parse.Attributes>> = (request: Parse.Cloud.AfterDeleteRequest<T> & {
     sessionToken: SessionTokenType;
 }) => Promise<void>;
+/**
+ * A beforeFind hook. May mutate `request.query` in place or return a
+ * replacement query — the registry threads the returned query through the
+ * remaining hooks of the class.
+ */
+export type beforeFindHookType<T extends Parse.Object<Parse.Attributes>> = (request: Parse.Cloud.BeforeFindRequest<T> & {
+    sessionToken: SessionTokenType;
+}) => Promise<Parse.Query<T> | void>;

package/dist/hooks/BDE_Article.js

@@ -4,8 +4,30 @@ exports.init = init;
 const index_js_1 = require("../features/schema/index.js");
 const index_js_2 = require("../types/index.js");
 async function init() {
+    // Soft delete: articles are referenced from a ticket's `material` list and
+    // from BDE work orders, so both admin UIs archive instead of destroying.
+    // Archived articles are hidden from every client query — including BDE's, the
+    // catalog being shared. The escape hatches keep both usable: a query naming
+    // object ids still resolves an archived article (so an existing work order or
+    // material line keeps its label), and a query constraining `isDeleted` sees
+    // the archive — which is what BDE's `isDeleted` column filter sends, so
+    // un-archiving from the parse admin table still works.
+    (0, index_js_1.hideSoftDeleted)(index_js_2.BDE_Article, { field: "isDeleted" });
     (0, index_js_1.beforeSaveHook)(index_js_2.BDE_Article, async (request) => {
         const { object, original, user } = request;
+        // Normalize the soft-delete marker: an absent column means "not archived",
+        // so write that out explicitly. Not every write path fills it in — BDE's own
+        // admin form does not list the field, and neither does the ABAS sync — and
+        // consumers match on `isDeleted = false` rather than `!= true` (e.g. the
+        // ticket material picker), which an unset column fails.
+        //
+        // Deliberately not limited to `isNew()`: that leaves every already-synced
+        // article invisible to those consumers until someone backfills. Filling it
+        // on any save heals the existing rows instead, as the ABAS sync re-saves the
+        // whole catalog on its first run after a restart.
+        if (object.get("isDeleted") == null) {
+            object.set("isDeleted", false);
+        }
         await (0, index_js_1.defaultHandler)(request);
         // Ported from the former MES_Article hook: tenant users may manage the
         // shared article catalog, and custom ACLs are honoured.

package/dist/hooks/Service_Equipment.js

@@ -8,6 +8,10 @@ const node_1 = __importDefault(require("parse/node"));
 const index_js_1 = require("../features/schema/index.js");
 const index_js_2 = require("../types/index.js");
 async function init() {
+    // Soft delete: tickets and meter readings point at equipment, so it is
+    // archived rather than destroyed. Archived rows are hidden from every client
+    // query (see hideSoftDeleted()).
+    (0, index_js_1.hideSoftDeleted)(index_js_2.Service_Equipment, { field: "deleted" });
     (0, index_js_1.beforeSaveHook)(index_js_2.Service_Equipment, async (request) => {
         const { object, original, user } = request;
         await (0, index_js_1.defaultHandler)(request);

package/dist/hooks/Service_Project.js

@@ -4,6 +4,10 @@ exports.init = init;
 const index_js_1 = require("../features/schema/index.js");
 const index_js_2 = require("../types/index.js");
 async function init() {
+    // Soft delete: tickets point at their project and draw their number from its
+    // counter, so a project is archived rather than destroyed. Archived rows are
+    // hidden from every client query (see hideSoftDeleted()).
+    (0, index_js_1.hideSoftDeleted)(index_js_2.Service_Project, { field: "deleted" });
     (0, index_js_1.beforeSaveHook)(index_js_2.Service_Project, async (request) => {
         const { object, original, user } = request;
         await (0, index_js_1.defaultHandler)(request);

package/dist/hooks/Service_Status.js

@@ -8,6 +8,10 @@ const node_1 = __importDefault(require("parse/node"));
 const index_js_1 = require("../features/schema/index.js");
 const index_js_2 = require("../types/index.js");
 async function init() {
+    // Soft delete: every ticket carries a required `status` pointer, so a status
+    // is archived rather than destroyed. Archived rows are hidden from every
+    // client query (see hideSoftDeleted() for the escape hatches).
+    (0, index_js_1.hideSoftDeleted)(index_js_2.Service_Status, { field: "deleted" });
     (0, index_js_1.beforeSaveHook)(index_js_2.Service_Status, async (request) => {
         const { object, original, user } = request;
         await (0, index_js_1.defaultHandler)(request);

package/dist/hooks/Service_Tag.js

@@ -8,6 +8,10 @@ const node_1 = __importDefault(require("parse/node"));
 const index_js_1 = require("../features/schema/index.js");
 const index_js_2 = require("../types/index.js");
 async function init() {
+    // Soft delete: tags are stored in the ancestor closures on tickets and
+    // equipment, so they are archived rather than destroyed. Archived rows are
+    // hidden from every client query (see hideSoftDeleted()).
+    (0, index_js_1.hideSoftDeleted)(index_js_2.Service_Tag, { field: "deleted" });
     (0, index_js_1.beforeSaveHook)(index_js_2.Service_Tag, async (request) => {
         const { object, original, user } = request;
         await (0, index_js_1.defaultHandler)(request);

package/dist/hooks/Service_Ticket.js

@@ -45,6 +45,12 @@ const getUserLanguage_js_1 = require("../helper/getUserLanguage.js");
 const index_js_2 = require("../types/index.js");
 const applyRuleSet_js_1 = require("../features/ruleset/applyRuleSet.js");
 async function init() {
+    // Soft delete: a ticket is referenced by chat messages, meta entries,
+    // notifications and child tickets, so the frontend archives instead of
+    // destroying. Archived rows are hidden from every client query here — see
+    // hideSoftDeleted() for the escape hatches (master key, an explicit
+    // constraint on `deleted`, and queries naming object ids).
+    (0, index_js_1.hideSoftDeleted)(index_js_2.Service_Ticket, { field: "deleted" });
     (0, index_js_1.beforeSaveHook)("OD3_Service_Ticket", async (request) => {
         const { object, original, user } = request;
         const isNew = object.isNew();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openinc/parse-server-opendash",
-  "version": "4.1.6",
+  "version": "4.1.7",
   "description": "Parse Server Cloud Code for open.INC Stack.",
   "packageManager": "pnpm@11.25.0",
   "keywords": [