@openinc/parse-server-opendash 4.1.8 → 4.2.1

package/dist/features/openservice/serviceTickets/alarmActions/functions/alarmTicketFields.d.ts

@@ -0,0 +1,35 @@
+import { type AlarmEvent, type AlarmTicketParams } from "../types/AlarmTicketTypes.js";
+/**
+ * Alarm + action parameters → the text fields of a ticket.
+ *
+ * Pure, so the wording and — more importantly — the `origin` marker can be
+ * checked without a database. The marker is what makes the whole thing
+ * idempotent: it identifies the alarm, and one open ticket per marker is the
+ * default.
+ */
+/** Title, description and origin of the ticket a fired alarm produces. */
+export interface AlarmTicketFields {
+    title: string;
+    description: string;
+    origin: string;
+}
+export declare function alarmTicketFields(event: AlarmEvent, params?: AlarmTicketParams): AlarmTicketFields;
+/**
+ * The `origin` marker: `alarm:<key>`.
+ *
+ * Same idea as the schedule plugin's `schedule:<id>:<occurrence>` — a
+ * free-form, greppable string that says where a ticket came from and can be
+ * queried back (`equalTo("origin", …)`). The key is the alarm's id when the
+ * executor knows it, otherwise source and sensor, which stay stable across
+ * firings of the same alarm.
+ */
+export declare function alarmOrigin(event: AlarmEvent): string;
+/**
+ * A stable identity for the alarm — the one thing a payload must carry.
+ *
+ * Returns `undefined` when the executor reports neither an alarm id nor a
+ * sensor: such a call cannot be deduplicated and is rejected rather than
+ * silently creating a ticket on every firing.
+ */
+export declare function alarmKey(event: AlarmEvent): string | undefined;
+export declare function firedAt(event: AlarmEvent): Date;

package/dist/features/openservice/serviceTickets/alarmActions/functions/alarmTicketFields.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.alarmTicketFields = alarmTicketFields;
+exports.alarmOrigin = alarmOrigin;
+exports.alarmKey = alarmKey;
+exports.firedAt = firedAt;
+const AlarmTicketTypes_js_1 = require("../types/AlarmTicketTypes.js");
+function alarmTicketFields(event, params = {}) {
+    return {
+        title: renderTitle(event, params),
+        description: renderDescription(event, params),
+        origin: alarmOrigin(event),
+    };
+}
+/**
+ * The `origin` marker: `alarm:<key>`.
+ *
+ * Same idea as the schedule plugin's `schedule:<id>:<occurrence>` — a
+ * free-form, greppable string that says where a ticket came from and can be
+ * queried back (`equalTo("origin", …)`). The key is the alarm's id when the
+ * executor knows it, otherwise source and sensor, which stay stable across
+ * firings of the same alarm.
+ */
+function alarmOrigin(event) {
+    return `alarm:${alarmKey(event)}`;
+}
+/**
+ * A stable identity for the alarm — the one thing a payload must carry.
+ *
+ * Returns `undefined` when the executor reports neither an alarm id nor a
+ * sensor: such a call cannot be deduplicated and is rejected rather than
+ * silently creating a ticket on every firing.
+ */
+function alarmKey(event) {
+    if (event.alarmId)
+        return event.alarmId;
+    const sensor = [event.item_source, event.item_id].filter(Boolean).join("/");
+    if (!sensor)
+        return undefined;
+    return event.item_dimension != null
+        ? `${sensor}#${event.item_dimension}`
+        : sensor;
+}
+/** `{{alarm}}` / `{{sensor}}` / `{{value}}` in the configured title. */
+function renderTitle(event, params) {
+    const template = params.title?.trim();
+    const sensor = sensorLabel(event);
+    if (!template) {
+        // No template: the alarm's own name is the most recognisable thing there
+        // is, and a ticket must have a title.
+        return event.name || (sensor ? `Alarm: ${sensor}` : "Alarm");
+    }
+    return template
+        .replace(/\{\{\s*alarm\s*\}\}/gi, event.name ?? "")
+        .replace(/\{\{\s*sensor\s*\}\}/gi, sensor)
+        .replace(/\{\{\s*value\s*\}\}/gi, formatValue(event.value))
+        .replace(/\s+/g, " ")
+        .trim();
+}
+/**
+ * The configured note plus what the alarm actually reported.
+ *
+ * The details are appended rather than templated, because the person handling
+ * the ticket needs to know which sensor, which value and when — and forgetting
+ * a placeholder in the form should not lose that.
+ */
+function renderDescription(event, params) {
+    const lines = [];
+    const note = params.description?.trim();
+    if (note)
+        lines.push(note, "");
+    const sensor = sensorLabel(event);
+    if (event.name)
+        lines.push(`Alarm: ${event.name}`);
+    if (sensor)
+        lines.push(`Sensor: ${sensor}`);
+    if (event.value !== undefined)
+        lines.push(`Wert: ${formatValue(event.value)}`);
+    if (event.condition)
+        lines.push(`Regel: ${event.condition}`);
+    lines.push(`Ausgelöst: ${firedAt(event).toISOString()}`);
+    lines.push(`Quelle: ${AlarmTicketTypes_js_1.ALARM_TICKET_ACTION_ID}`);
+    return lines.join("\n");
+}
+function firedAt(event) {
+    if (event.firedAt) {
+        const parsed = new Date(event.firedAt);
+        if (!Number.isNaN(parsed.getTime()))
+            return parsed;
+    }
+    return new Date();
+}
+function sensorLabel(event) {
+    const sensor = [event.item_source, event.item_id].filter(Boolean).join("/");
+    return event.item_dimension != null && sensor
+        ? `${sensor} [${event.item_dimension}]`
+        : sensor;
+}
+function formatValue(value) {
+    if (value === undefined || value === null)
+        return "";
+    return String(value);
+}

package/dist/features/openservice/serviceTickets/alarmActions/index.d.ts

@@ -0,0 +1,7 @@
+export { alarmKey, alarmOrigin, alarmTicketFields, firedAt, } from "./functions/alarmTicketFields.js";
+export type { AlarmTicketFields } from "./functions/alarmTicketFields.js";
+export { createAlarmTicket, tenantForSecret, } from "./service/createAlarmTicket.js";
+export type { AlarmTicketResult } from "./service/createAlarmTicket.js";
+export { ensureAlarmTicketAction } from "./service/ensureAlarmTicketAction.js";
+export { ALARM_TICKET_ACTION_ID, ALARM_TICKET_SECRET_CONFIG_KEY, } from "./types/AlarmTicketTypes.js";
+export type { AlarmEvent, AlarmTicketParams, } from "./types/AlarmTicketTypes.js";

package/dist/features/openservice/serviceTickets/alarmActions/index.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALARM_TICKET_SECRET_CONFIG_KEY = exports.ALARM_TICKET_ACTION_ID = exports.ensureAlarmTicketAction = exports.tenantForSecret = exports.createAlarmTicket = exports.firedAt = exports.alarmTicketFields = exports.alarmOrigin = exports.alarmKey = void 0;
+var alarmTicketFields_js_1 = require("./functions/alarmTicketFields.js");
+Object.defineProperty(exports, "alarmKey", { enumerable: true, get: function () { return alarmTicketFields_js_1.alarmKey; } });
+Object.defineProperty(exports, "alarmOrigin", { enumerable: true, get: function () { return alarmTicketFields_js_1.alarmOrigin; } });
+Object.defineProperty(exports, "alarmTicketFields", { enumerable: true, get: function () { return alarmTicketFields_js_1.alarmTicketFields; } });
+Object.defineProperty(exports, "firedAt", { enumerable: true, get: function () { return alarmTicketFields_js_1.firedAt; } });
+var createAlarmTicket_js_1 = require("./service/createAlarmTicket.js");
+Object.defineProperty(exports, "createAlarmTicket", { enumerable: true, get: function () { return createAlarmTicket_js_1.createAlarmTicket; } });
+Object.defineProperty(exports, "tenantForSecret", { enumerable: true, get: function () { return createAlarmTicket_js_1.tenantForSecret; } });
+var ensureAlarmTicketAction_js_1 = require("./service/ensureAlarmTicketAction.js");
+Object.defineProperty(exports, "ensureAlarmTicketAction", { enumerable: true, get: function () { return ensureAlarmTicketAction_js_1.ensureAlarmTicketAction; } });
+var AlarmTicketTypes_js_1 = require("./types/AlarmTicketTypes.js");
+Object.defineProperty(exports, "ALARM_TICKET_ACTION_ID", { enumerable: true, get: function () { return AlarmTicketTypes_js_1.ALARM_TICKET_ACTION_ID; } });
+Object.defineProperty(exports, "ALARM_TICKET_SECRET_CONFIG_KEY", { enumerable: true, get: function () { return AlarmTicketTypes_js_1.ALARM_TICKET_SECRET_CONFIG_KEY; } });

package/dist/features/openservice/serviceTickets/alarmActions/service/createAlarmTicket.d.ts

@@ -0,0 +1,33 @@
+import { Tenant } from "../../../../../types/index.js";
+import { type AlarmEvent, type AlarmTicketParams } from "../types/AlarmTicketTypes.js";
+/** Outcome of one fired alarm. */
+export interface AlarmTicketResult {
+    ticketId: string;
+    /** `false` when an open ticket for this alarm already existed. */
+    created: boolean;
+    origin: string;
+    equipmentId?: string;
+}
+/**
+ * Create the ticket a fired alarm asks for — or return the one that is already
+ * open for it.
+ *
+ * **One open ticket per alarm** is the default (`params.duplicate` opts out).
+ * A sensor that crosses its threshold every few minutes would otherwise bury
+ * the inbox, and the person on shift needs one work item, not a log. Closing
+ * the ticket arms the alarm again, which is the behaviour people expect from
+ * every other alerting tool.
+ *
+ * Deliberately thin: number, ACL, assignment notifications and the tenant's
+ * watcher rules all happen in the `Service_Ticket` hooks, on every write path.
+ */
+export declare function createAlarmTicket(tenant: Tenant, event: AlarmEvent, params?: AlarmTicketParams): Promise<AlarmTicketResult>;
+/**
+ * The tenant a call belongs to, identified by its shared secret.
+ *
+ * The executor lives outside this server and is not trusted to name a tenant —
+ * so the secret does it. One `OD3_Config` row per tenant
+ * (`OPENSERVICE_ALARM_TICKET_SECRET`); no row means the tenant has not switched
+ * the endpoint on, and the call is refused.
+ */
+export declare function tenantForSecret(secret: string): Promise<Tenant | undefined>;

package/dist/features/openservice/serviceTickets/alarmActions/service/createAlarmTicket.js

@@ -0,0 +1,179 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAlarmTicket = createAlarmTicket;
+exports.tenantForSecret = tenantForSecret;
+const node_1 = __importDefault(require("parse/node"));
+const index_js_1 = require("../../../../../types/index.js");
+const alarmTicketFields_js_1 = require("../functions/alarmTicketFields.js");
+const AlarmTicketTypes_js_1 = require("../types/AlarmTicketTypes.js");
+/**
+ * Create the ticket a fired alarm asks for — or return the one that is already
+ * open for it.
+ *
+ * **One open ticket per alarm** is the default (`params.duplicate` opts out).
+ * A sensor that crosses its threshold every few minutes would otherwise bury
+ * the inbox, and the person on shift needs one work item, not a log. Closing
+ * the ticket arms the alarm again, which is the behaviour people expect from
+ * every other alerting tool.
+ *
+ * Deliberately thin: number, ACL, assignment notifications and the tenant's
+ * watcher rules all happen in the `Service_Ticket` hooks, on every write path.
+ */
+async function createAlarmTicket(tenant, event, params = {}) {
+    if (!(0, alarmTicketFields_js_1.alarmKey)(event)) {
+        throw new node_1.default.Error(node_1.default.Error.INVALID_QUERY, "The alarm payload identifies no alarm: pass alarmId, or item_source/item_id.");
+    }
+    const fields = (0, alarmTicketFields_js_1.alarmTicketFields)(event, params);
+    if (!params.duplicate) {
+        const open = await findOpenTicket(tenant, fields.origin);
+        if (open) {
+            return {
+                ticketId: open.id,
+                created: false,
+                origin: fields.origin,
+                equipmentId: open.get("equipment")?.id,
+            };
+        }
+    }
+    const status = await resolveDefaultStatus(tenant);
+    if (!status) {
+        throw new node_1.default.Error(node_1.default.Error.INVALID_QUERY, `No "${AlarmTicketTypes_js_1.DEFAULT_STATUS_CATEGORY}" status configured for this tenant — cannot create a ticket.`);
+    }
+    const equipment = await resolveEquipment(tenant, event, params);
+    const ticket = new index_js_1.Service_Ticket();
+    ticket.set("deleted", false);
+    ticket.set("tenant", tenant);
+    ticket.set("status", status);
+    ticket.set("title", fields.title);
+    ticket.set("description", fields.description);
+    ticket.set("origin", fields.origin);
+    // The moment the alarm fired, not the moment we got the call — a queued or
+    // retried webhook must not move the incident.
+    ticket.set("startDate", (0, alarmTicketFields_js_1.firedAt)(event));
+    if (equipment)
+        ticket.set("equipment", equipment);
+    if (params.priority != null)
+        ticket.set("priority", params.priority);
+    if (params.projectId) {
+        const project = new index_js_1.Service_Project();
+        project.id = params.projectId;
+        ticket.set("project", project);
+    }
+    // Assignment arrays hold plain ids in this schema (see the `pointerIds`
+    // helper in the ticket hook, which accepts both).
+    if (params.assignedUserIds?.length) {
+        ticket.set("assignedUsers", params.assignedUserIds);
+    }
+    if (params.assignedRoleIds?.length) {
+        ticket.set("assignedRoles", params.assignedRoleIds);
+    }
+    if (params.tagIds?.length)
+        ticket.set("tags", params.tagIds);
+    await ticket.save(null, { useMasterKey: true });
+    return {
+        ticketId: ticket.id,
+        created: true,
+        origin: fields.origin,
+        equipmentId: equipment?.id,
+    };
+}
+/**
+ * An unfinished ticket of this alarm, if there is one.
+ *
+ * "Unfinished" is decided by the **status category**, not by `closedAt`: a
+ * tenant can name its statuses whatever it likes, the category is the contract
+ * (`done` / `cancelled` — the same list core uses).
+ */
+async function findOpenTicket(tenant, origin) {
+    const tickets = await new node_1.default.Query(index_js_1.Service_Ticket)
+        .equalTo("tenant", tenant)
+        .equalTo("origin", origin)
+        .equalTo("deleted", false)
+        .include("status")
+        .descending("createdAt")
+        .limit(20)
+        .find({ useMasterKey: true });
+    return tickets.find((ticket) => {
+        const category = ticket.get("status")?.get("category");
+        return !AlarmTicketTypes_js_1.DONE_STATUS_CATEGORIES.includes(category);
+    });
+}
+/** The tenant's inbox status, else a global one — never another tenant's. */
+async function resolveDefaultStatus(tenant) {
+    const statuses = await new node_1.default.Query(index_js_1.Service_Status)
+        .equalTo("category", AlarmTicketTypes_js_1.DEFAULT_STATUS_CATEGORY)
+        .equalTo("deleted", false)
+        .ascending("order")
+        .find({ useMasterKey: true });
+    return (statuses.find((status) => status.get("tenant")?.id === tenant.id) ?? statuses.find((status) => !status.get("tenant")));
+}
+/**
+ * The machine the ticket belongs to.
+ *
+ * 1. what was configured on the alarm — the only reliable source, because
+ *    **nothing in the data model links a sensor to a machine**;
+ * 2. otherwise a machine whose `sourceTags` name the sensor or its source.
+ *    That is a convention, not a relation, so it is a fallback: `sourceTags`
+ *    was meant for source scoping, and a site-level tag can match several
+ *    machines — the first one wins, which is a guess.
+ *
+ * No machine is not an error: `equipment` is optional on a ticket, and an
+ * unassigned alarm ticket in the inbox is better than one on the wrong machine.
+ */
+async function resolveEquipment(tenant, event, params) {
+    if (params.equipmentId) {
+        const explicit = await new node_1.default.Query(index_js_1.Service_Equipment)
+            .equalTo("objectId", params.equipmentId)
+            .first({ useMasterKey: true });
+        if (explicit)
+            return explicit;
+        console.warn(`[AlarmTicket] Configured machine ${params.equipmentId} does not exist`);
+    }
+    const candidates = [event.item_id, event.item_source].filter((value) => !!value);
+    if (candidates.length === 0)
+        return undefined;
+    const query = new node_1.default.Query(index_js_1.Service_Equipment)
+        .equalTo("tenant", tenant)
+        .notEqualTo("deleted", true)
+        // `sourceTags` is an Array column: Mongo reads "contained in" as "the array
+        // holds one of these". The generated type only knows `any[]`, hence the cast.
+        .containedIn("sourceTags", candidates);
+    return (await query.first({ useMasterKey: true })) ?? undefined;
+}
+/**
+ * The tenant a call belongs to, identified by its shared secret.
+ *
+ * The executor lives outside this server and is not trusted to name a tenant —
+ * so the secret does it. One `OD3_Config` row per tenant
+ * (`OPENSERVICE_ALARM_TICKET_SECRET`); no row means the tenant has not switched
+ * the endpoint on, and the call is refused.
+ */
+async function tenantForSecret(secret) {
+    if (!secret)
+        return undefined;
+    const configs = await new node_1.default.Query(index_js_1.Config)
+        .equalTo("key", AlarmTicketTypes_js_1.ALARM_TICKET_SECRET_CONFIG_KEY)
+        .include("tenant")
+        .find({ useMasterKey: true });
+    const match = configs.find((config) => {
+        const value = config.get("value");
+        return typeof value === "string" && constantTimeEqual(value.trim(), secret);
+    });
+    return match?.get("tenant") ?? undefined;
+}
+/**
+ * Compare without leaking the answer through timing — the caller controls one
+ * side of this comparison and may try many.
+ */
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return diff === 0;
+}

package/dist/features/openservice/serviceTickets/alarmActions/service/ensureAlarmTicketAction.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Make "create a ticket" selectable in the alarm dialog.
+ *
+ * Alarm actions are **data**, not code: `OD3_AlarmAction` rows that the
+ * monitoring adapter loads into the frontend, where the chosen row's
+ * `formFields` are rendered as the action's settings form (see
+ * `plugins/monitoring/src/components/AlarmCreate.tsx`). There is no plugin-side
+ * `registerAlarmAction`, so the row is seeded here — find-or-create by `topic`,
+ * like the other open.SERVICE bootstraps.
+ *
+ * The row is **global** (no tenant): the action makes sense for every tenant,
+ * and the tenant of a fired alarm is established by its secret, not by this
+ * row.
+ *
+ * ⚠️ `type` / `target` / `payload` are the executor's half of the contract —
+ * the component that evaluates alarms lives outside this server. The values
+ * below assume a webhook-style executor that POSTs `payload` (placeholders
+ * filled from the alarm) to `target`. If the executor expects something else,
+ * this row is where it is corrected; the receiving endpoint accepts any caller
+ * that brings the secret.
+ */
+export declare function ensureAlarmTicketAction(): Promise<void>;

package/dist/features/openservice/serviceTickets/alarmActions/service/ensureAlarmTicketAction.js

@@ -0,0 +1,127 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureAlarmTicketAction = ensureAlarmTicketAction;
+const node_1 = __importDefault(require("parse/node"));
+const index_js_1 = require("../../../../../types/index.js");
+const AlarmTicketTypes_js_1 = require("../types/AlarmTicketTypes.js");
+/**
+ * Make "create a ticket" selectable in the alarm dialog.
+ *
+ * Alarm actions are **data**, not code: `OD3_AlarmAction` rows that the
+ * monitoring adapter loads into the frontend, where the chosen row's
+ * `formFields` are rendered as the action's settings form (see
+ * `plugins/monitoring/src/components/AlarmCreate.tsx`). There is no plugin-side
+ * `registerAlarmAction`, so the row is seeded here — find-or-create by `topic`,
+ * like the other open.SERVICE bootstraps.
+ *
+ * The row is **global** (no tenant): the action makes sense for every tenant,
+ * and the tenant of a fired alarm is established by its secret, not by this
+ * row.
+ *
+ * ⚠️ `type` / `target` / `payload` are the executor's half of the contract —
+ * the component that evaluates alarms lives outside this server. The values
+ * below assume a webhook-style executor that POSTs `payload` (placeholders
+ * filled from the alarm) to `target`. If the executor expects something else,
+ * this row is where it is corrected; the receiving endpoint accepts any caller
+ * that brings the secret.
+ */
+async function ensureAlarmTicketAction() {
+    const existing = await new node_1.default.Query(index_js_1.AlarmAction)
+        .equalTo("topic", AlarmTicketTypes_js_1.ALARM_TICKET_ACTION_ID)
+        .first({ useMasterKey: true });
+    if (existing)
+        return;
+    const action = new index_js_1.AlarmAction();
+    action.set("label", "Ticket erstellen (open.SERVICE)");
+    action.set("type", "webhook");
+    action.set("topic", AlarmTicketTypes_js_1.ALARM_TICKET_ACTION_ID);
+    action.set("target", "/parse/functions/openinc-openservice-alarm-create-ticket");
+    action.set("templateType", "json");
+    action.set("payload", JSON.stringify({
+        secret: "{{secret}}",
+        event: {
+            alarmId: "{{alarm.id}}",
+            name: "{{alarm.name}}",
+            item_id: "{{item.id}}",
+            item_source: "{{item.source}}",
+            item_dimension: "{{item.dimension}}",
+            value: "{{value}}",
+            condition: "{{condition}}",
+            firedAt: "{{timestamp}}",
+        },
+        params: "{{action}}",
+    }));
+    // Every value type can breach a rule, so every type may raise a ticket.
+    action.set("supportedTypes", [
+        "Number",
+        "String",
+        "Boolean",
+        "Geo",
+        "Object",
+    ]);
+    action.set("formFields", FORM_FIELDS);
+    await action.save(null, { useMasterKey: true });
+    console.log(`[AlarmTicket] Registered alarm action "${AlarmTicketTypes_js_1.ALARM_TICKET_ACTION_ID}"`);
+}
+/**
+ * What the person configuring an alarm gets to fill in.
+ *
+ * Field types are the ones `FormGenerator` (in `@opendash/core`) understands;
+ * `select.parse` renders an object picker for a Parse class. Keys match
+ * `AlarmTicketParams` — the executor hands the form's values back to us as
+ * `params`.
+ *
+ * The machine is a plain picker rather than something derived from the sensor,
+ * because nothing in the data model links the two. Whoever sets the alarm up
+ * knows which machine it watches; guessing it later is worse than asking now.
+ */
+const FORM_FIELDS = [
+    {
+        key: "title",
+        label: "Titel des Tickets",
+        type: "input",
+        hint: "Platzhalter: {{alarm}}, {{sensor}}, {{value}}. Leer = Name des Alarms.",
+    },
+    {
+        key: "description",
+        label: "Notiz",
+        type: "textarea",
+        hint: "Wird dem Ticket vorangestellt; Sensor, Wert, Regel und Zeitpunkt kommen automatisch dazu.",
+    },
+    {
+        key: "equipmentId",
+        label: "Maschine",
+        type: "select.parse",
+        settings: {
+            className: "OD3_Service_Equipment",
+            displayField: "label",
+            mode: "single",
+        },
+        hint: "Ohne Angabe wird über die Quellen-Tags der Maschine geraten — oder das Ticket bleibt ohne Maschine.",
+    },
+    {
+        key: "projectId",
+        label: "Projekt",
+        type: "select.parse",
+        settings: {
+            className: "OD3_Service_Project",
+            displayField: "label",
+            mode: "single",
+        },
+    },
+    {
+        key: "priority",
+        label: "Priorität",
+        type: "input.number",
+    },
+    {
+        key: "duplicate",
+        label: "Bei jedem Auslösen ein neues Ticket",
+        type: "switch",
+        defaultValue: false,
+        hint: "Aus (Standard): solange das Ticket offen ist, entsteht kein zweites.",
+    },
+];

package/dist/features/openservice/serviceTickets/alarmActions/types/AlarmTicketTypes.d.ts

@@ -0,0 +1,80 @@
+/**
+ * The alarm action "create a ticket".
+ *
+ * An open.DASH alarm watches a sensor value against a rule; when the rule
+ * breaks, its configured **action** runs. The actions are rows in
+ * `OD3_AlarmAction` (loaded into the frontend by the monitoring adapter), and
+ * the executor — the component that evaluates alarms, outside this server —
+ * carries them out. This module is the receiving end: it turns one fired alarm
+ * into an `OD3_Service_Ticket`.
+ */
+/** Id of the action row, and the marker in a ticket's `origin`. */
+export declare const ALARM_TICKET_ACTION_ID = "openservice-create-ticket";
+/**
+ * Config key of the shared secret an executor authenticates with.
+ *
+ * One row per tenant: `key` = this, `value` = the secret, `tenant` = the
+ * tenant's pointer. The secret is what tells us **which tenant** a call belongs
+ * to — an alarm executor is not trusted to name it. Without a row, the endpoint
+ * only answers to the master key.
+ */
+export declare const ALARM_TICKET_SECRET_CONFIG_KEY = "OPENSERVICE_ALARM_TICKET_SECRET";
+/** Status category a fresh ticket lands in — mirrors the ticket plugin's port. */
+export declare const DEFAULT_STATUS_CATEGORY = "inbox";
+/** Categories in which a ticket counts as finished (mirrors core's `DONE_CATEGORIES`). */
+export declare const DONE_STATUS_CATEGORIES: string[];
+/**
+ * What the executor reports about the alarm that fired.
+ *
+ * Field names follow `OD3_Alarm` so a payload can be assembled from the alarm
+ * row without renaming: `item_id` / `item_source` / `item_dimension` identify
+ * the sensor, the rest is context for the ticket text. Everything is optional
+ * except that *something* must identify the alarm — see `alarmKey`.
+ */
+export interface AlarmEvent {
+    /** `OD3_Alarm.objectId`, if the executor knows it. */
+    alarmId?: string;
+    /** The alarm's name, used in the ticket title when no template is given. */
+    name?: string;
+    /** Sensor id, e.g. `cnc04.spindle`. */
+    item_id?: string;
+    /** Source (site/tenant hierarchy) the sensor belongs to. */
+    item_source?: string;
+    /** Which dimension of the sensor tripped. */
+    item_dimension?: number;
+    /** The value that broke the rule. */
+    value?: number | string | boolean;
+    /** Human-readable rule, e.g. `> 80`. */
+    condition?: string;
+    /** When it fired (ISO). Defaults to now. */
+    firedAt?: string;
+}
+/**
+ * What the person configuring the alarm filled into the action's form
+ * (`OD3_AlarmAction.formFields`).
+ */
+export interface AlarmTicketParams {
+    /** Ticket title; `{{alarm}}`, `{{sensor}}` and `{{value}}` are replaced. */
+    title?: string;
+    /** Prepended to the generated alarm details. */
+    description?: string;
+    /**
+     * Machine the ticket belongs to.
+     *
+     * Set explicitly when configuring the alarm — that is the reliable way,
+     * because nothing in the data model links a sensor to a machine. Without it,
+     * `Equipment.sourceTags` is tried (see `resolveEquipment`).
+     */
+    equipmentId?: string;
+    projectId?: string;
+    priority?: number;
+    assignedUserIds?: string[];
+    assignedRoleIds?: string[];
+    tagIds?: string[];
+    /**
+     * Reopen behaviour. `false` (default) keeps **one open ticket per alarm**: a
+     * flapping sensor does not produce a hundred tickets, and closing the ticket
+     * arms the alarm again. `true` creates one per firing.
+     */
+    duplicate?: boolean;
+}

package/dist/features/openservice/serviceTickets/alarmActions/types/AlarmTicketTypes.js

@@ -0,0 +1,28 @@
+"use strict";
+/**
+ * The alarm action "create a ticket".
+ *
+ * An open.DASH alarm watches a sensor value against a rule; when the rule
+ * breaks, its configured **action** runs. The actions are rows in
+ * `OD3_AlarmAction` (loaded into the frontend by the monitoring adapter), and
+ * the executor — the component that evaluates alarms, outside this server —
+ * carries them out. This module is the receiving end: it turns one fired alarm
+ * into an `OD3_Service_Ticket`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DONE_STATUS_CATEGORIES = exports.DEFAULT_STATUS_CATEGORY = exports.ALARM_TICKET_SECRET_CONFIG_KEY = exports.ALARM_TICKET_ACTION_ID = void 0;
+/** Id of the action row, and the marker in a ticket's `origin`. */
+exports.ALARM_TICKET_ACTION_ID = "openservice-create-ticket";
+/**
+ * Config key of the shared secret an executor authenticates with.
+ *
+ * One row per tenant: `key` = this, `value` = the secret, `tenant` = the
+ * tenant's pointer. The secret is what tells us **which tenant** a call belongs
+ * to — an alarm executor is not trusted to name it. Without a row, the endpoint
+ * only answers to the master key.
+ */
+exports.ALARM_TICKET_SECRET_CONFIG_KEY = "OPENSERVICE_ALARM_TICKET_SECRET";
+/** Status category a fresh ticket lands in — mirrors the ticket plugin's port. */
+exports.DEFAULT_STATUS_CATEGORY = "inbox";
+/** Categories in which a ticket counts as finished (mirrors core's `DONE_CATEGORIES`). */
+exports.DONE_STATUS_CATEGORIES = ["done", "cancelled"];

package/dist/features/permissions/types/Permissions.d.ts

@@ -24,9 +24,8 @@ export declare namespace Permissions {
         ticket_edit = "service:can-edit-ticket",
         ticket_delete = "service:can-delete-ticket",
         ticket_assign = "service:can-assign-ticket",
-        schedule_read = "service:can-read-schedule",
+        schedule_access = "service:can-access-schedule-plugin",
         schedule_create = "service:can-create-schedule",
-        schedule_edit = "service:can-edit-schedule",
         schedule_delete = "service:can-delete-schedule",
         execution_perform = "service:can-perform-execution",
         template_manage = "service:can-manage-template",

package/dist/features/permissions/types/Permissions.js

@@ -37,9 +37,15 @@ var Permissions;
         SERVICE["ticket_delete"] = "service:can-delete-ticket";
         SERVICE["ticket_assign"] = "service:can-assign-ticket";
         // Schedules (Wartungspläne)
-        SERVICE["schedule_read"] = "service:can-read-schedule";
+        //
+        // No `read` or `edit` here on purpose: both are decided per record by the
+        // ACL — creator, assigned roles and users — and a capability that says
+        // "may edit" while the ACL says "not this one" only adds a second answer to
+        // a question that already has one. `create` stays a capability because
+        // there is no record yet whose ACL could be asked, and a class-level
+        // permission cannot express it per tenant.
+        SERVICE["schedule_access"] = "service:can-access-schedule-plugin";
         SERVICE["schedule_create"] = "service:can-create-schedule";
-        SERVICE["schedule_edit"] = "service:can-edit-schedule";
         SERVICE["schedule_delete"] = "service:can-delete-schedule";
         // Executions (Durchführungen)
         SERVICE["execution_perform"] = "service:can-perform-execution";