@openinc/parse-server-opendash 4.2.0 → 4.2.2

package/dist/features/openservice/serviceSchedules/acl/assignmentAcl.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Marks a save this module made itself, so the `afterSave` that follows it does
+ * not start over. Without it every ACL write would trigger another pass — the
+ * second one is a no-op and would stop, but the round trip is pure waste.
+ */
+export declare const ASSIGNMENT_ACL_CONTEXT_FLAG = "fromAssignmentAcl";
+/** Which relations grant read access on this class. */
+export interface AssignmentAclOptions {
+    /** Relation of `_Role`s that may read the record. */
+    roleRelations: string[];
+    /** Relation of `_User`s that may read the record. */
+    userRelations?: string[];
+}
+/**
+ * Who may see a maintenance plan (or a template): its creator, the roles and
+ * users assigned to it, and the administrators — nobody else.
+ *
+ * **Why this is rebuilt rather than amended.** Un-assigning somebody has to take
+ * their access away again, and an ACL carries no record of *why* a grant is
+ * there. Adding grants on every save would therefore be a one-way door: a role
+ * removed from the plan would keep reading it forever. The ACL is derived from
+ * the assignments instead, so it always says exactly what the assignments say.
+ *
+ * `od-admin` and `od-tenant-admin-<tenant>` are re-added by `defaultAclHandler`
+ * on the save that follows, so an assignment can never lock administrators out.
+ *
+ * Runs in `afterSave`, not `beforeSave`: relations are only queryable once the
+ * pending add/remove operations have been applied, which happens on save.
+ */
+export declare function syncAssignmentAcl(object: Parse.Object, options: AssignmentAclOptions): Promise<void>;

package/dist/features/openservice/serviceSchedules/acl/assignmentAcl.js

@@ -0,0 +1,85 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ASSIGNMENT_ACL_CONTEXT_FLAG = void 0;
+exports.syncAssignmentAcl = syncAssignmentAcl;
+const node_1 = __importDefault(require("parse/node"));
+/**
+ * Marks a save this module made itself, so the `afterSave` that follows it does
+ * not start over. Without it every ACL write would trigger another pass — the
+ * second one is a no-op and would stop, but the round trip is pure waste.
+ */
+exports.ASSIGNMENT_ACL_CONTEXT_FLAG = "fromAssignmentAcl";
+/**
+ * Who may see a maintenance plan (or a template): its creator, the roles and
+ * users assigned to it, and the administrators — nobody else.
+ *
+ * **Why this is rebuilt rather than amended.** Un-assigning somebody has to take
+ * their access away again, and an ACL carries no record of *why* a grant is
+ * there. Adding grants on every save would therefore be a one-way door: a role
+ * removed from the plan would keep reading it forever. The ACL is derived from
+ * the assignments instead, so it always says exactly what the assignments say.
+ *
+ * `od-admin` and `od-tenant-admin-<tenant>` are re-added by `defaultAclHandler`
+ * on the save that follows, so an assignment can never lock administrators out.
+ *
+ * Runs in `afterSave`, not `beforeSave`: relations are only queryable once the
+ * pending add/remove operations have been applied, which happens on save.
+ */
+async function syncAssignmentAcl(object, options) {
+    const acl = new node_1.default.ACL();
+    // Administrators. Mirrors `defaultAclHandler` so the ACL is already complete
+    // when it is written, rather than only after the next save.
+    acl.setRoleReadAccess("od-admin", true);
+    acl.setRoleWriteAccess("od-admin", true);
+    const tenant = object.get("tenant");
+    if (tenant) {
+        acl.setRoleReadAccess(`od-tenant-admin-${tenant.id}`, true);
+        acl.setRoleWriteAccess(`od-tenant-admin-${tenant.id}`, true);
+    }
+    // The creator keeps write — the record is theirs.
+    const creator = object.get("user");
+    if (creator?.id) {
+        acl.setReadAccess(creator.id, true);
+        acl.setWriteAccess(creator.id, true);
+    }
+    for (const relation of options.roleRelations) {
+        for (const role of await readRelation(object, relation)) {
+            const name = role.get("name");
+            // Roles are addressed by name in an ACL, not by id.
+            if (name)
+                acl.setRoleReadAccess(name, true);
+        }
+    }
+    for (const relation of options.userRelations ?? []) {
+        for (const user of await readRelation(object, relation)) {
+            if (user.id)
+                acl.setReadAccess(user.id, true);
+        }
+    }
+    if (sameAcl(object.getACL(), acl))
+        return;
+    object.setACL(acl);
+    await object.save(null, {
+        useMasterKey: true,
+        context: { [exports.ASSIGNMENT_ACL_CONTEXT_FLAG]: true },
+    });
+}
+/** The members of a relation, or an empty list when it has none. */
+async function readRelation(object, field) {
+    try {
+        return await object.relation(field).query().find({ useMasterKey: true });
+    }
+    catch {
+        // A relation that was never written has no backing table yet.
+        return [];
+    }
+}
+/** Whether two ACLs grant exactly the same thing. */
+function sameAcl(current, next) {
+    if (!current)
+        return false;
+    return JSON.stringify(current.toJSON()) === JSON.stringify(next.toJSON());
+}

package/dist/features/openservice/serviceSchedules/acl/index.d.ts

@@ -0,0 +1 @@
+export { ASSIGNMENT_ACL_CONTEXT_FLAG, syncAssignmentAcl, type AssignmentAclOptions, } from "./assignmentAcl.js";

package/dist/features/openservice/serviceSchedules/acl/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.syncAssignmentAcl = exports.ASSIGNMENT_ACL_CONTEXT_FLAG = void 0;
+var assignmentAcl_js_1 = require("./assignmentAcl.js");
+Object.defineProperty(exports, "ASSIGNMENT_ACL_CONTEXT_FLAG", { enumerable: true, get: function () { return assignmentAcl_js_1.ASSIGNMENT_ACL_CONTEXT_FLAG; } });
+Object.defineProperty(exports, "syncAssignmentAcl", { enumerable: true, get: function () { return assignmentAcl_js_1.syncAssignmentAcl; } });

package/dist/features/openservice/serviceSchedules/calendarSync/functions/outlookRecurrence.d.ts

@@ -9,6 +9,16 @@ export type RRuleParts = {
     bymonth?: number[];
     count?: number;
     wkst?: string;
+    /**
+     * "The nth of the matching days" — `BYDAY=MO,TU,WE,TH,FR;BYSETPOS=-1` is
+     * "last workday of the month".
+     *
+     * Outlook has no equivalent: its `relativeMonthly` pattern takes *one*
+     * weekday and a position. With a single weekday the two agree (that is the
+     * ordinal `BYDAY` form); with several, the rule cannot be expressed — see
+     * {@link calendarUnsupportedReason}.
+     */
+    bysetpos?: number;
 };
 /**
  * Read an RRULE string into its parts.
@@ -29,6 +39,16 @@ export declare function buildRRule(parts: RRuleParts): string;
  * created by hand.
  */
 export declare function eventToCadence(start: Date, recurrence?: Recurrence): ServiceCadence;
+/**
+ * Why this cadence cannot be written to a calendar — `undefined` when it can.
+ *
+ * Outlook's recurrence vocabulary is a **subset** of RFC 5545, and the gap is
+ * not cosmetic: a rule we cannot express would have to be approximated, and an
+ * approximated maintenance date in someone's calendar is worse than no entry
+ * at all. The sync therefore leaves such plans alone instead of guessing (see
+ * `syncPlanToCalendar`).
+ */
+export declare function calendarUnsupportedReason(cadence: ServiceCadence | undefined): string | undefined;
 /**
  * A v2 cadence as an Outlook recurrence — `undefined` for a one-off, which
  * Graph expects as an event without a `recurrence` at all.

package/dist/features/openservice/serviceSchedules/calendarSync/functions/outlookRecurrence.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseRRule = parseRRule;
 exports.buildRRule = buildRRule;
 exports.eventToCadence = eventToCadence;
+exports.calendarUnsupportedReason = calendarUnsupportedReason;
 exports.cadenceToRecurrence = cadenceToRecurrence;
 /**
  * Outlook recurrence ↔ RRULE, both directions.
@@ -18,12 +19,12 @@ exports.cadenceToRecurrence = cadenceToRecurrence;
  * a maintenance date. `pnpm tsx scripts/…` round-trips it (see the module test
  * at the bottom of the file's docs in OPENSERVICE_V2_SCHEDULES.md).
  *
- * **Known asymmetry**: the plan editor's cadence UI understands
- * FREQ/INTERVAL/BYDAY/BYMONTHDAY/COUNT, but not `BYMONTH` or a positional
- * `BYDAY` (`+2TU`). Occurrence *maths* and the calendar are correct for those
- * (`@opendash/schedule` uses a full RRULE iterator) — but a user who edits such
- * a plan's recurrence in the browser will simplify it. Yearly and "nth weekday"
- * series should therefore be maintained in Outlook.
+ * **Where the two vocabularies differ**: Outlook's patterns are a subset of the
+ * RRULE grammar. A positional weekday (`BYDAY=+2TU`) maps to `relativeMonthly`
+ * and back, but `BYSETPOS` over several weekdays ("last workday"), several
+ * days of the month, or several months do not exist there at all —
+ * {@link calendarUnsupportedReason} names them, and the sync skips such plans
+ * instead of approximating a maintenance date.
  */
 const WEEKDAY_TO_RRULE = {
     Sunday: "SU",
@@ -102,6 +103,12 @@ function parseRRule(rrule) {
             case "WKST":
                 parts.wkst = value;
                 break;
+            case "BYSETPOS": {
+                const parsed = Number(value);
+                if (Number.isFinite(parsed) && parsed !== 0)
+                    parts.bysetpos = parsed;
+                break;
+            }
         }
     }
     return parts;
@@ -119,6 +126,8 @@ function buildRRule(parts) {
     }
     if (parts.bymonth?.length)
         chunks.push(`BYMONTH=${parts.bymonth.join(",")}`);
+    if (parts.bysetpos)
+        chunks.push(`BYSETPOS=${parts.bysetpos}`);
     if (parts.count)
         chunks.push(`COUNT=${parts.count}`);
     if (parts.wkst && parts.wkst !== "MO")
@@ -194,6 +203,34 @@ function eventToCadence(start, recurrence) {
     }
     return cadence;
 }
+/**
+ * Why this cadence cannot be written to a calendar — `undefined` when it can.
+ *
+ * Outlook's recurrence vocabulary is a **subset** of RFC 5545, and the gap is
+ * not cosmetic: a rule we cannot express would have to be approximated, and an
+ * approximated maintenance date in someone's calendar is worse than no entry
+ * at all. The sync therefore leaves such plans alone instead of guessing (see
+ * `syncPlanToCalendar`).
+ */
+function calendarUnsupportedReason(cadence) {
+    if (cadence?.kind !== "rrule" || !cadence.rrule)
+        return undefined;
+    const parts = parseRRule(cadence.rrule);
+    const days = parts.byday?.map(splitByDay) ?? [];
+    if (parts.bysetpos !== undefined && days.length > 1) {
+        return `BYSETPOS with ${days.length} weekdays has no Outlook equivalent`;
+    }
+    if (parts.byday && parts.byday.length > 1 && parts.freq !== "WEEKLY") {
+        return `several weekdays are only expressible for a weekly series (FREQ=${parts.freq})`;
+    }
+    if (parts.bymonthday && parts.bymonthday.length > 1) {
+        return "several days of the month have no Outlook equivalent";
+    }
+    if (parts.bymonth && parts.bymonth.length > 1) {
+        return "several months have no Outlook equivalent";
+    }
+    return undefined;
+}
 /**
  * A v2 cadence as an Outlook recurrence — `undefined` for a one-off, which
  * Graph expects as an event without a `recurrence` at all.
@@ -215,7 +252,13 @@ function cadenceToRecurrence(cadence, start) {
 }
 function recurrencePattern(parts, start) {
     const interval = parts.interval && parts.interval > 0 ? parts.interval : 1;
-    const positional = parts.byday?.map(splitByDay).find((day) => !!day.ordinal);
+    const days = parts.byday?.map(splitByDay) ?? [];
+    // A position comes either as an ordinal on the weekday (`+2TU`) or as
+    // BYSETPOS next to a single weekday — both are one Outlook `index`.
+    const positional = days.find((day) => !!day.ordinal) ??
+        (parts.bysetpos !== undefined && days.length === 1
+            ? { ordinal: parts.bysetpos, weekday: days[0].weekday }
+            : undefined);
     switch (parts.freq ?? "DAILY") {
         case "DAILY":
             return { type: "daily", interval };

package/dist/features/openservice/serviceSchedules/calendarSync/service/syncPlanToCalendar.js

@@ -8,6 +8,7 @@ exports.connectionForTenant = connectionForTenant;
 const node_1 = __importDefault(require("parse/node"));
 const CalendarManager_js_1 = require("../../../schedules/calendarSync/service/CalendarManager.js");
 const index_js_1 = require("../../../../../types/index.js");
+const outlookRecurrence_js_1 = require("../functions/outlookRecurrence.js");
 const planToEvent_js_1 = require("../functions/planToEvent.js");
 const ServiceSyncTypes_js_1 = require("../types/ServiceSyncTypes.js");
 const serviceCalendarMeta_js_1 = require("./serviceCalendarMeta.js");
@@ -33,6 +34,13 @@ async function syncPlanToCalendar(plan) {
     const connection = await connectionForTenant(plan.get("tenant"));
     if (!connection)
         return;
+    // A recurrence Outlook cannot express is left untouched rather than
+    // approximated — a wrong maintenance date in a calendar is worse than none.
+    const unsupported = (0, outlookRecurrence_js_1.calendarUnsupportedReason)(plan.get("cadence"));
+    if (unsupported) {
+        console.warn(`[ServiceCalendarSync] Plan ${plan.id} not synced: ${unsupported}`);
+        return;
+    }
     const meta = await (0, serviceCalendarMeta_js_1.findMetaForPlan)(plan.id);
     const values = meta ? (0, serviceCalendarMeta_js_1.metaValues)(meta) : undefined;
     const eventId = values?.microsoftCalendarEventId;

package/dist/features/permissions/types/Permissions.d.ts

@@ -24,12 +24,11 @@ export declare namespace Permissions {
         ticket_edit = "service:can-edit-ticket",
         ticket_delete = "service:can-delete-ticket",
         ticket_assign = "service:can-assign-ticket",
-        schedule_read = "service:can-read-schedule",
-        schedule_create = "service:can-create-schedule",
-        schedule_edit = "service:can-edit-schedule",
-        schedule_delete = "service:can-delete-schedule",
-        execution_perform = "service:can-perform-execution",
-        template_manage = "service:can-manage-template",
+        schedule_access = "openservice-schedule:can-access-schedule-plugin",
+        schedule_create = "openservice-schedule:can-create-schedule",
+        schedule_delete = "openservice-schedule:can-delete-schedule",
+        execution_perform = "openservice-schedule:can-perform-execution",
+        template_manage = "openservice-schedule:can-manage-template",
         masterdata_manage = "service:can-manage-masterdata",
         formconfig_manage = "service:can-manage-formconfig",
         tag_create = "service:can-create-tag",

package/dist/features/permissions/types/Permissions.js

@@ -36,15 +36,20 @@ var Permissions;
         SERVICE["ticket_edit"] = "service:can-edit-ticket";
         SERVICE["ticket_delete"] = "service:can-delete-ticket";
         SERVICE["ticket_assign"] = "service:can-assign-ticket";
-        // Schedules (Wartungspläne)
-        SERVICE["schedule_read"] = "service:can-read-schedule";
-        SERVICE["schedule_create"] = "service:can-create-schedule";
-        SERVICE["schedule_edit"] = "service:can-edit-schedule";
-        SERVICE["schedule_delete"] = "service:can-delete-schedule";
-        // Executions (Durchführungen)
-        SERVICE["execution_perform"] = "service:can-perform-execution";
+        // Schedule-Plugin
+        //
+        // No `read` or `edit` here on purpose: both are decided per record by the
+        // ACL — creator, assigned roles and users — and a capability that says
+        // "may edit" while the ACL says "not this one" only adds a second answer to
+        // a question that already has one. `create` stays a capability because
+        // there is no record yet whose ACL could be asked, and a class-level
+        // permission cannot express it per tenant.
+        SERVICE["schedule_access"] = "openservice-schedule:can-access-schedule-plugin";
+        SERVICE["schedule_create"] = "openservice-schedule:can-create-schedule";
+        SERVICE["schedule_delete"] = "openservice-schedule:can-delete-schedule";
+        SERVICE["execution_perform"] = "openservice-schedule:can-perform-execution";
+        SERVICE["template_manage"] = "openservice-schedule:can-manage-template";
         // Catalog / master data / form config
-        SERVICE["template_manage"] = "service:can-manage-template";
         SERVICE["masterdata_manage"] = "service:can-manage-masterdata";
         SERVICE["formconfig_manage"] = "service:can-manage-formconfig";
         // Narrow master-data capability: create a tag inline from a tag picker,

package/dist/hooks/Service_Schedule.js

@@ -6,29 +6,50 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.init = init;
 const node_1 = __importDefault(require("parse/node"));
 const index_js_1 = require("../features/schema/index.js");
-const index_js_2 = require("../features/openservice/serviceSchedules/calendarSync/index.js");
-const index_js_3 = require("../types/index.js");
+const Permissions_js_1 = require("../features/permissions/types/Permissions.js");
+const index_js_2 = require("../features/permissions/index.js");
+const index_js_3 = require("../features/openservice/serviceSchedules/acl/index.js");
+const index_js_4 = require("../features/openservice/serviceSchedules/calendarSync/index.js");
+const index_js_5 = require("../types/index.js");
 async function init() {
-    (0, index_js_1.beforeSaveHook)(index_js_3.Service_Schedule, async (request) => {
+    (0, index_js_1.beforeSaveHook)(index_js_5.Service_Schedule, async (request) => {
         const { object, original, user } = request;
         await (0, index_js_1.defaultHandler)(request);
-        // `allowCustomACL` keeps an ACL set by the client instead of resetting it on
-        // every save. The frontend uses it for the per-record write lock ("Rechte
-        // nur für Ersteller", `openservice-schedule/utils/acl.ts`): the creator gets
-        // an explicit user grant, everyone else keeps read only. The handler still
-        // re-adds `od-admin` / `od-tenant-admin-<tenant>` write and
-        // `od-tenant-user-<tenant>` read afterwards, so a lock can never lock
-        // administrators out.
-        await (0, index_js_1.defaultAclHandler)(request, { allowCustomACL: true });
-        // TODO
+        // The creator, recorded once and never rewritten: it is who the plan
+        // belongs to, and `defaultAclHandler` turns it into a read+write grant.
+        if (!original && user && !object.get("user")) {
+            object.set("user", user);
+        }
+        // `denyTenantUserRead` is what makes a plan private. Without it every user
+        // of the tenant reads every plan, which is the opposite of what assigning
+        // roles and users to a plan is supposed to mean.
+        //
+        // `allowCustomACL` keeps an ACL the client set instead of resetting it on
+        // every save — the assignment sync in `afterSave` depends on its ACL
+        // surviving the next save. The handler still re-adds `od-admin` /
+        // `od-tenant-admin-<tenant>`, so a plan can never lock administrators out.
+        await (0, index_js_1.defaultAclHandler)(request, {
+            allowCustomACL: true,
+            denyTenantUserRead: true,
+        });
     });
-    (0, index_js_1.afterSaveHook)(index_js_3.Service_Schedule, async (request) => {
+    (0, index_js_1.afterSaveHook)(index_js_5.Service_Schedule, async (request) => {
         const { object, original, context } = request;
+        // Our own ACL write — the assignments already match, nothing to redo.
+        if (context?.[index_js_3.ASSIGNMENT_ACL_CONTEXT_FLAG])
+            return;
+        // Assignments are relations: only readable now that the save applied them.
+        await (0, index_js_3.syncAssignmentAcl)(object, {
+            roleRelations: ["assignedRoles", "escalationRoles"],
+            userRelations: ["assignedUsers"],
+        }).catch((error) => {
+            console.error(`[ServiceScheduleAcl] Plan ${object.id}: could not sync ACL from assignments:`, error);
+        });
         // A change that came *from* the calendar must not be written back to it:
         // that would create a new version there, which the delta feed reports as a
         // foreign change, which we would import again — an endless echo. The
         // poller marks its own writes with this flag.
-        if (context?.[index_js_2.CALENDAR_SYNC_CONTEXT_FLAG])
+        if (context?.[index_js_4.CALENDAR_SYNC_CONTEXT_FLAG])
             return;
         // Seed data belongs to a demo tenant, not in anybody's calendar.
         if (object.get("seed"))
@@ -38,13 +59,18 @@ async function init() {
             // Graph round trip (token + write) would otherwise be part of every save
             // the user waits for. Failures are logged, and the next relevant save
             // retries — as does the delta poller from the other side.
-            (0, index_js_2.syncPlanToCalendar)(object).catch((error) => {
+            (0, index_js_4.syncPlanToCalendar)(object).catch((error) => {
                 console.error(`[ServiceCalendarSync] Plan ${object.id} could not be synced:`, error);
             });
         }
     });
-    (0, index_js_1.beforeDeleteHook)(index_js_3.Service_Schedule, async (request) => {
+    (0, index_js_1.beforeDeleteHook)(index_js_5.Service_Schedule, async (request) => {
         const { object } = request;
+        // Parse has no delete right of its own — an ACL `write` grant covers update
+        // *and* delete, so anyone allowed to edit a plan could otherwise remove it.
+        // Hiding the button in the UI does not change that; this is what makes the
+        // capability real.
+        await (0, index_js_2.requirePermission)(request, Permissions_js_1.Permissions.SERVICE.schedule_delete, "delete maintenance schedule");
         // A protocol points at the plan it documents. Destroying the plan leaves
         // that pointer dangling and the protocol — the record that the work
         // happened — unreachable. Retiring a plan is done by setting `deletedAt`
@@ -53,7 +79,7 @@ async function init() {
         //
         // A plan without any execution carries no history, so removing it stays
         // allowed — that keeps mistakenly created plans cleanable.
-        const executions = await new node_1.default.Query(index_js_3.Service_Schedule_Execution)
+        const executions = await new node_1.default.Query(index_js_5.Service_Schedule_Execution)
             .equalTo("schedule", object)
             .count({ useMasterKey: true });
         if (executions > 0) {

package/dist/hooks/Service_Schedule_Template.js

@@ -2,16 +2,37 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.init = init;
 const index_js_1 = require("../features/schema/index.js");
-const index_js_2 = require("../types/index.js");
+const index_js_2 = require("../features/openservice/serviceSchedules/acl/index.js");
+const index_js_3 = require("../types/index.js");
 async function init() {
-    (0, index_js_1.beforeSaveHook)(index_js_2.Service_Schedule_Template, async (request) => {
+    (0, index_js_1.beforeSaveHook)(index_js_3.Service_Schedule_Template, async (request) => {
         const { object, original, user } = request;
         await (0, index_js_1.defaultHandler)(request);
-        await (0, index_js_1.defaultAclHandler)(request);
-        // TODO
+        // The creator, recorded once and never rewritten — a template stays visible
+        // to whoever built it, whatever happens to its assigned roles later.
+        if (!original && user && !object.get("user")) {
+            object.set("user", user);
+        }
+        // A template is private like a plan: its creator, the roles it is assigned
+        // to, and administrators. Without `denyTenantUserRead` the whole tenant
+        // reads every template and assigning roles would mean nothing.
+        await (0, index_js_1.defaultAclHandler)(request, {
+            allowCustomACL: true,
+            denyTenantUserRead: true,
+        });
     });
-    (0, index_js_1.afterSaveHook)(index_js_2.Service_Schedule_Template, async (request) => {
-        const { object, original, user } = request;
-        // TODO
+    (0, index_js_1.afterSaveHook)(index_js_3.Service_Schedule_Template, async (request) => {
+        const { object, context } = request;
+        // Our own ACL write — the assignments already match.
+        if (context?.[index_js_2.ASSIGNMENT_ACL_CONTEXT_FLAG])
+            return;
+        // `assignedRoles` is a relation, readable only after the save applied it.
+        // Templates carry no `assignedUsers`: they are shared by role, and the
+        // creator keeps their own grant.
+        await (0, index_js_2.syncAssignmentAcl)(object, {
+            roleRelations: ["assignedRoles"],
+        }).catch((error) => {
+            console.error(`[ServiceScheduleAcl] Template ${object.id}: could not sync ACL from assignments:`, error);
+        });
     });
 }

package/dist/hooks/Service_Ticket.js

@@ -43,7 +43,7 @@ const index_js_1 = require("../features/schema/index.js");
 const appLinks_js_1 = require("../helper/appLinks.js");
 const getUserLanguage_js_1 = require("../helper/getUserLanguage.js");
 const index_js_2 = require("../types/index.js");
-const applyRuleSet_js_1 = require("../features/ruleset/applyRuleSet.js");
+const ruleset_core_1 = require("@opendash/ruleset-core");
 async function init() {
     // Soft delete: a ticket is referenced by chat messages, meta entries,
     // notifications and child tickets, so the frontend archives instead of
@@ -266,7 +266,7 @@ async function notifyWatchers(ticket, notified, assignerName) {
     for (const rule of rules) {
         if (rule.function !== "notify" || !rule.ruleset)
             continue;
-        if (!(0, applyRuleSet_js_1.applyRuleSet)(rule.ruleset, getValue))
+        if (!(0, ruleset_core_1.applyRuleSet)(rule.ruleset, getValue))
             continue;
         const assignees = Array.isArray(rule.params?.assignees)
             ? rule.params.assignees

package/dist/types/Service_Schedule.d.ts

@@ -1,5 +1,6 @@
 import Parse from "parse/node";
 import type { _Role } from "./_Role";
+import type { _User } from "./_User";
 import type { Service_Equipment } from "./Service_Equipment";
 import type { Tenant } from "./Tenant";
 export interface Service_ScheduleAttributes {
@@ -10,6 +11,7 @@ export interface Service_ScheduleAttributes {
     active: boolean;
     asset?: any | undefined;
     assignedRoles: Parse.Relation<Service_Schedule, _Role>;
+    assignedUsers: Parse.Relation<Service_Schedule, _User>;
     cadence: any;
     cadenceExceptions?: any[] | undefined;
     color?: string | undefined;
@@ -20,13 +22,14 @@ export interface Service_ScheduleAttributes {
     escalationRoles: Parse.Relation<Service_Schedule, _Role>;
     graceDays?: number | undefined;
     leadDays?: number | undefined;
-    notifications?: any[] | undefined;
+    notifications: any[];
     pausedUntil?: Date | undefined;
     seed?: boolean | undefined;
     serviceProviders?: any[] | undefined;
     steps: any[];
     tenant: Tenant;
     title: string;
+    user?: _User | undefined;
 }
 export declare class Service_Schedule extends Parse.Object<Service_ScheduleAttributes> {
     static className: string;
@@ -36,6 +39,7 @@ export declare class Service_Schedule extends Parse.Object<Service_ScheduleAttri
     get asset(): any | undefined;
     set asset(value: any | undefined);
     get assignedRoles(): Parse.Relation<Service_Schedule, _Role>;
+    get assignedUsers(): Parse.Relation<Service_Schedule, _User>;
     get cadence(): any;
     set cadence(value: any);
     get cadenceExceptions(): any[] | undefined;
@@ -55,8 +59,8 @@ export declare class Service_Schedule extends Parse.Object<Service_ScheduleAttri
     set graceDays(value: number | undefined);
     get leadDays(): number | undefined;
     set leadDays(value: number | undefined);
-    get notifications(): any[] | undefined;
-    set notifications(value: any[] | undefined);
+    get notifications(): any[];
+    set notifications(value: any[]);
     get pausedUntil(): Date | undefined;
     set pausedUntil(value: Date | undefined);
     get seed(): boolean | undefined;
@@ -69,4 +73,6 @@ export declare class Service_Schedule extends Parse.Object<Service_ScheduleAttri
     set tenant(value: Tenant);
     get title(): string;
     set title(value: string);
+    get user(): _User | undefined;
+    set user(value: _User | undefined);
 }

package/dist/types/Service_Schedule.js

@@ -25,6 +25,9 @@ class Service_Schedule extends node_1.default.Object {
     get assignedRoles() {
         return super.relation("assignedRoles");
     }
+    get assignedUsers() {
+        return super.relation("assignedUsers");
+    }
     get cadence() {
         return super.get("cadence");
     }
@@ -124,6 +127,12 @@ class Service_Schedule extends node_1.default.Object {
     set title(value) {
         super.set("title", value);
     }
+    get user() {
+        return super.get("user");
+    }
+    set user(value) {
+        super.set("user", value);
+    }
 }
 exports.Service_Schedule = Service_Schedule;
 node_1.default.Object.registerSubclass("OD3_Service_Schedule", Service_Schedule);

package/dist/types/Service_Schedule_Execution.d.ts

@@ -12,9 +12,10 @@ export interface Service_Schedule_ExecutionAttributes {
     coverageOrigin?: any | undefined;
     performedBy?: _User | undefined;
     schedule: Service_Schedule;
-    signature?: any | undefined;
+    signature?: string | undefined;
     stepResults?: any[] | undefined;
     tenant: Tenant;
+    user?: _User | undefined;
 }
 export declare class Service_Schedule_Execution extends Parse.Object<Service_Schedule_ExecutionAttributes> {
     static className: string;
@@ -29,10 +30,12 @@ export declare class Service_Schedule_Execution extends Parse.Object<Service_Sch
     set performedBy(value: _User | undefined);
     get schedule(): Service_Schedule;
     set schedule(value: Service_Schedule);
-    get signature(): any | undefined;
-    set signature(value: any | undefined);
+    get signature(): string | undefined;
+    set signature(value: string | undefined);
     get stepResults(): any[] | undefined;
     set stepResults(value: any[] | undefined);
     get tenant(): Tenant;
     set tenant(value: Tenant);
+    get user(): _User | undefined;
+    set user(value: _User | undefined);
 }

package/dist/types/Service_Schedule_Execution.js

@@ -58,6 +58,12 @@ class Service_Schedule_Execution extends node_1.default.Object {
     set tenant(value) {
         super.set("tenant", value);
     }
+    get user() {
+        return super.get("user");
+    }
+    set user(value) {
+        super.set("user", value);
+    }
 }
 exports.Service_Schedule_Execution = Service_Schedule_Execution;
 node_1.default.Object.registerSubclass("OD3_Service_Schedule_Execution", Service_Schedule_Execution);

package/dist/types/Service_Schedule_Template.d.ts

@@ -1,6 +1,7 @@
 import Parse from "parse/node";
 import type { _Role } from "./_Role";
 import type { Tenant } from "./Tenant";
+import type { _User } from "./_User";
 export interface Service_Schedule_TemplateAttributes {
     id: string;
     objectId: string;
@@ -10,11 +11,12 @@ export interface Service_Schedule_TemplateAttributes {
     cadence: any;
     deletedAt?: Date | undefined;
     description?: string | undefined;
-    notifications?: any[] | undefined;
+    notifications: any[];
     serviceProviders: any[];
     steps: any[];
     tenant: Tenant;
     title: string;
+    user?: _User | undefined;
 }
 export declare class Service_Schedule_Template extends Parse.Object<Service_Schedule_TemplateAttributes> {
     static className: string;
@@ -26,8 +28,8 @@ export declare class Service_Schedule_Template extends Parse.Object<Service_Sche
     set deletedAt(value: Date | undefined);
     get description(): string | undefined;
     set description(value: string | undefined);
-    get notifications(): any[] | undefined;
-    set notifications(value: any[] | undefined);
+    get notifications(): any[];
+    set notifications(value: any[]);
     get serviceProviders(): any[];
     set serviceProviders(value: any[]);
     get steps(): any[];
@@ -36,4 +38,6 @@ export declare class Service_Schedule_Template extends Parse.Object<Service_Sche
     set tenant(value: Tenant);
     get title(): string;
     set title(value: string);
+    get user(): _User | undefined;
+    set user(value: _User | undefined);
 }

package/dist/types/Service_Schedule_Template.js

@@ -61,6 +61,12 @@ class Service_Schedule_Template extends node_1.default.Object {
     set title(value) {
         super.set("title", value);
     }
+    get user() {
+        return super.get("user");
+    }
+    set user(value) {
+        super.set("user", value);
+    }
 }
 exports.Service_Schedule_Template = Service_Schedule_Template;
 node_1.default.Object.registerSubclass("OD3_Service_Schedule_Template", Service_Schedule_Template);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openinc/parse-server-opendash",
-  "version": "4.2.0",
+  "version": "4.2.2",
   "description": "Parse Server Cloud Code for open.INC Stack.",
   "packageManager": "pnpm@11.25.0",
   "keywords": [
@@ -69,14 +69,15 @@
     "seed:v1": "node dist/scripts/seed-v1-testdata.js"
   },
   "dependencies": {
+    "@opendash/ruleset-core": "0.1.1-nightly.1",
     "@openinc/parse-server-schema": "^4.1.1",
     "amqplib": "^0.10.9",
     "cron": "^4.4.0",
     "dayjs": "^1.11.23",
     "dotenv": "^17.4.2",
-    "fast-equals": "^6.0.2",
-    "i18next": "^26.4.1",
-    "i18next-fs-backend": "^2.6.7",
+    "fast-equals": "^6.0.3",
+    "i18next": "^26.4.2",
+    "i18next-fs-backend": "^2.6.8",
     "jsonwebtoken": "^9.0.3",
     "jwks-rsa": "^4.1.0",
     "nodemailer": "^9.1.1",

package/schema/Service_Schedule.json

@@ -13,6 +13,10 @@
       "targetClass": "_Role",
       "required": false
     },
+    "assignedUsers": {
+      "type": "Relation",
+      "targetClass": "_User"
+    },
     "cadence": {
       "type": "Object",
       "required": true
@@ -81,6 +85,10 @@
     "title": {
       "type": "String",
       "required": true
+    },
+    "user": {
+      "type": "Pointer",
+      "targetClass": "_User"
     }
   },
   "classLevelPermissions": {

package/schema/Service_Schedule_Execution.json

@@ -29,6 +29,11 @@
       "type": "Pointer",
       "targetClass": "{{PREFIX}}Tenant",
       "required": true
+    },
+    "user": {
+      "type": "Pointer",
+      "targetClass": "_User",
+      "required": false
     }
   },
   "classLevelPermissions": {

package/schema/Service_Schedule_Template.json

@@ -41,6 +41,10 @@
     "title": {
       "type": "String",
       "required": true
+    },
+    "user": {
+      "type": "Pointer",
+      "targetClass": "_User"
     }
   },
   "classLevelPermissions": {

package/dist/features/ruleset/applyRuleSet.d.ts

@@ -1,41 +0,0 @@
-/**
- * Backend port of the `@opendash/ui` ruleset evaluator
- * (`libs/ui/src/features/ruleset/functions/applyRuleSet.ts`).
- *
- * The frontend authors condition trees with the RuleSet editor and stores them
- * as JSON; notifications must be created server-side, so the same evaluation
- * logic has to run here. This is a faithful, dependency-free copy of the pure
- * evaluation core — keep the operator semantics in sync with the frontend.
- */
-export type RuleOperator = "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "isEmpty" | "isNotEmpty" | "gt" | "gte" | "lt" | "lte" | "between" | "isTrue" | "isFalse" | "before" | "after";
-/** A single comparison against one field. */
-export interface Rule {
-    id: string;
-    kind: "rule";
-    field: string;
-    operator: RuleOperator;
-    value?: string | number | boolean;
-    /** Secondary value — only used for the "between" operator. */
-    value2?: number;
-}
-/** A logical group that chains rules and nested groups via AND / OR. */
-export interface RuleGroup {
-    id: string;
-    kind: "group";
-    conjunction: "AND" | "OR";
-    rules: Array<Rule | RuleGroup>;
-}
-export type RuleSetValue = RuleGroup;
-/** A saved ruleset-function entry as produced by the RuleSet editor. */
-export interface RuleSetFunctionEntry {
-    ruleset: RuleSetValue;
-    function: string;
-    params?: Record<string, unknown>;
-}
-/** Resolves the current value for a given field name. */
-export type GetValueFn = (fieldName: string) => unknown;
-/**
- * Evaluates a `RuleSetValue` against live data. An empty rule group always
- * returns `true` (matches the frontend semantics).
- */
-export declare function applyRuleSet(ruleSet: RuleSetValue, getValue: GetValueFn): boolean;

package/dist/features/ruleset/applyRuleSet.js

@@ -1,81 +0,0 @@
-"use strict";
-/**
- * Backend port of the `@opendash/ui` ruleset evaluator
- * (`libs/ui/src/features/ruleset/functions/applyRuleSet.ts`).
- *
- * The frontend authors condition trees with the RuleSet editor and stores them
- * as JSON; notifications must be created server-side, so the same evaluation
- * logic has to run here. This is a faithful, dependency-free copy of the pure
- * evaluation core — keep the operator semantics in sync with the frontend.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.applyRuleSet = applyRuleSet;
-function evaluateRule(rule, getValue) {
-    const fieldValue = getValue(rule.field);
-    switch (rule.operator) {
-        case "equals":
-            // eslint-disable-next-line eqeqeq
-            return fieldValue == rule.value;
-        case "notEquals":
-            // eslint-disable-next-line eqeqeq
-            return fieldValue != rule.value;
-        case "contains":
-            return (typeof fieldValue === "string" &&
-                fieldValue.includes(String(rule.value ?? "")));
-        case "notContains":
-            return (typeof fieldValue === "string" &&
-                !fieldValue.includes(String(rule.value ?? "")));
-        case "startsWith":
-            return (typeof fieldValue === "string" &&
-                fieldValue.startsWith(String(rule.value ?? "")));
-        case "endsWith":
-            return (typeof fieldValue === "string" &&
-                fieldValue.endsWith(String(rule.value ?? "")));
-        case "isEmpty":
-            return (fieldValue === null || fieldValue === undefined || fieldValue === "");
-        case "isNotEmpty":
-            return (fieldValue !== null && fieldValue !== undefined && fieldValue !== "");
-        case "gt":
-            return Number(fieldValue) > Number(rule.value);
-        case "gte":
-            return Number(fieldValue) >= Number(rule.value);
-        case "lt":
-            return Number(fieldValue) < Number(rule.value);
-        case "lte":
-            return Number(fieldValue) <= Number(rule.value);
-        case "between":
-            return (Number(fieldValue) >= Number(rule.value) &&
-                Number(fieldValue) <= Number(rule.value2));
-        case "isTrue":
-            return fieldValue === true;
-        case "isFalse":
-            return fieldValue === false;
-        case "before":
-            return new Date(String(fieldValue)) < new Date(String(rule.value ?? ""));
-        case "after":
-            return new Date(String(fieldValue)) > new Date(String(rule.value ?? ""));
-        default:
-            return false;
-    }
-}
-function evaluateGroup(group, getValue) {
-    if (group.rules.length === 0)
-        return true;
-    if (group.conjunction === "AND") {
-        return group.rules.every((item) => item.kind === "rule"
-            ? evaluateRule(item, getValue)
-            : evaluateGroup(item, getValue));
-    }
-    return group.rules.some((item) => item.kind === "rule"
-        ? evaluateRule(item, getValue)
-        : evaluateGroup(item, getValue));
-}
-/**
- * Evaluates a `RuleSetValue` against live data. An empty rule group always
- * returns `true` (matches the frontend semantics).
- */
-function applyRuleSet(ruleSet, getValue) {
-    if (!ruleSet || ruleSet.kind !== "group")
-        return false;
-    return evaluateGroup(ruleSet, getValue);
-}