@openinc/parse-server-opendash 4.2.4 → 4.3.1

package/dist/features/config/helper/customOptions.js

@@ -266,7 +266,7 @@ exports.customoptions = {
         required: false,
         secret: false,
         public: false,
-        description: "The directory where the email templates are stored. The default is 'views/emails'.",
+        description: "The directory where the email templates are stored. The default is 'views/emails'. Templates placed here override the ones shipped with this package; if neither provides a template, the fallback text of the sending code is used.",
         default: "views/emails",
     },
     SMTP_ENABLED: {

package/dist/features/notifications/services/initEmailTransport.js

@@ -36,7 +36,9 @@ async function initEmailTransport() {
             emailState.setTransport(transport);
             const templateDir = (0, path_1.resolve)(process.cwd(), index_js_1.ConfigInstance.getInstance().get("EMAIL_TEMPLATE_DIR"));
             emailState.setEmailTemplateDir(templateDir);
-            nunjucks_1.default.configure(templateDir, { autoescape: true });
+            nunjucks_1.default.configure(emailState.getEmailTemplateDirs(), {
+                autoescape: true,
+            });
             console.log("[@openinc/parse-server-opendash] Email transport initialized successfully");
         }
         else {

package/dist/features/notifications/services/sendMails.js

@@ -71,9 +71,9 @@ function validateEmailTemplate(templateDir, template) {
  */
 function renderEmailTemplate(type, template, data, fallback) {
     const emailState = EmailState_js_1.EmailState.getInstance();
-    const emailTemplateDir = emailState.getEmailTemplateDir();
+    const emailTemplateDirs = emailState.getEmailTemplateDirs();
     const fullTemplate = template + "." + type;
-    if (validateEmailTemplate(emailTemplateDir, fullTemplate)) {
+    if (emailTemplateDirs.some((dir) => validateEmailTemplate(dir, fullTemplate))) {
         return nunjucks_1.default.render(fullTemplate, data);
     }
     if (type === "html") {

package/dist/features/notifications/states/EmailState.d.ts

@@ -28,6 +28,12 @@ export declare class EmailState {
      * Get the email template directory
      */
     getEmailTemplateDir(): string;
+    /**
+     * Get all directories a template is searched in, in order of precedence:
+     * the deployment specific directory first, the templates shipped with this
+     * package second.
+     */
+    getEmailTemplateDirs(): string[];
     /**
      * Check if email transport is configured and ready
      */

package/dist/features/notifications/states/EmailState.js

@@ -1,6 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EmailState = void 0;
+const path_1 = require("path");
+/**
+ * Email templates shipped with this package. They are used whenever the
+ * deployment specific template directory does not provide a template of the
+ * same name. Resolved relative to this file, so it works both for the compiled
+ * output (dist/templates/emails) and for the sources (src/templates/emails).
+ */
+const BUILTIN_EMAIL_TEMPLATE_DIR = (0, path_1.resolve)(__dirname, "../../../templates/emails");
 /**
  * Singleton class to manage email transport and template directory
  */
@@ -42,6 +50,14 @@ class EmailState {
     getEmailTemplateDir() {
         return this.emailTemplateDir;
     }
+    /**
+     * Get all directories a template is searched in, in order of precedence:
+     * the deployment specific directory first, the templates shipped with this
+     * package second.
+     */
+    getEmailTemplateDirs() {
+        return [this.emailTemplateDir, BUILTIN_EMAIL_TEMPLATE_DIR];
+    }
     /**
      * Check if email transport is configured and ready
      */

package/dist/features/permissions/types/Permissions.d.ts

@@ -40,7 +40,8 @@ export declare namespace Permissions {
         rmqadmin = "parse-admin:can-access-rmq-admin",
         metaadmin = "meta:can-see-admin",
         chatadmin = "chat:can-see-admin",
-        changelog = "changelog:can-see-app"
+        changelog = "changelog:can-see-app",
+        changelog_restore = "changelog:can-restore-deleted"
     }
     enum GTFS {
         global = "gtfs:can-access-global"

package/dist/features/permissions/types/Permissions.js

@@ -70,6 +70,9 @@ var Permissions;
         CORE["metaadmin"] = "meta:can-see-admin";
         CORE["chatadmin"] = "chat:can-see-admin";
         CORE["changelog"] = "changelog:can-see-app";
+        // Restoring a deleted object writes with the master key, so it is kept
+        // separate from merely reading the changelog.
+        CORE["changelog_restore"] = "changelog:can-restore-deleted";
     })(CORE = Permissions.CORE || (Permissions.CORE = {}));
     let GTFS;
     (function (GTFS) {

package/dist/functions/openinc-repair-meta-entry-acl.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Repairs the ACL of one meta entry — a Parse Dashboard script, run from
+ * "Run script on selected row" in the data browser.
+ *
+ * Rows written before the write grants in `hooks/Meta_Entry.ts` existed came
+ * out writable only by `od-admin` and the tenant admins. A plain tenant user
+ * could create such an entry and never update it again: Parse answers the
+ * denied write with `101 Object not found`. The hook fixes every write from
+ * here on, but it only sees writes, and the affected users are exactly the ones
+ * who cannot make one — so the repair has to come from a master-key caller.
+ *
+ * All this does is re-save the row. The JS SDK issues the request even when
+ * nothing is dirty, and the beforeSave triggers run for master-key writes, so
+ * `defaultAclHandler` rebuilds the ACL and the hook layers the current grants
+ * back on. Nothing else about the row changes, and running it on an already
+ * correct row is a no-op — so it is safe to select everything and run it once.
+ *
+ * Registered for `OD3_Meta_Entry` only. The same re-save would rebuild the ACL
+ * of any class whose `beforeSave` calls `defaultAclHandler`, but the narrower
+ * the blast radius of a one-click dashboard action, the better.
+ *
+ * @param name The function name, derived from the file name.
+ */
+export declare function init(name: string): Promise<void>;

package/dist/functions/openinc-repair-meta-entry-acl.js

@@ -0,0 +1,59 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.init = init;
+const node_1 = __importDefault(require("parse/node"));
+const index_js_1 = require("../types/index.js");
+/**
+ * Repairs the ACL of one meta entry — a Parse Dashboard script, run from
+ * "Run script on selected row" in the data browser.
+ *
+ * Rows written before the write grants in `hooks/Meta_Entry.ts` existed came
+ * out writable only by `od-admin` and the tenant admins. A plain tenant user
+ * could create such an entry and never update it again: Parse answers the
+ * denied write with `101 Object not found`. The hook fixes every write from
+ * here on, but it only sees writes, and the affected users are exactly the ones
+ * who cannot make one — so the repair has to come from a master-key caller.
+ *
+ * All this does is re-save the row. The JS SDK issues the request even when
+ * nothing is dirty, and the beforeSave triggers run for master-key writes, so
+ * `defaultAclHandler` rebuilds the ACL and the hook layers the current grants
+ * back on. Nothing else about the row changes, and running it on an already
+ * correct row is a no-op — so it is safe to select everything and run it once.
+ *
+ * Registered for `OD3_Meta_Entry` only. The same re-save would rebuild the ACL
+ * of any class whose `beforeSave` calls `defaultAclHandler`, but the narrower
+ * the blast radius of a one-click dashboard action, the better.
+ *
+ * @param name The function name, derived from the file name.
+ */
+async function init(name) {
+    node_1.default.Cloud.define(name, async function (request) {
+        const object = request.params.object;
+        // Thrown rather than returned: the dashboard surfaces a rejection as an
+        // error toast, while any resolved value reads as success.
+        if (!object) {
+            throw new node_1.default.Error(node_1.default.Error.INVALID_JSON, "No object was passed. Run this from the data browser on a selected row.");
+        }
+        if (object.className !== index_js_1.Meta_Entry.className) {
+            throw new node_1.default.Error(node_1.default.Error.INVALID_CLASS_NAME, `Expected a ${index_js_1.Meta_Entry.className} row, got ${object.className}.`);
+        }
+        await object.save(null, { useMasterKey: true });
+        const acl = object.getACL();
+        const subjectId = object.get("entryObjectId");
+        return {
+            success: true,
+            id: object.id,
+            context: object.get("context"),
+            entryClassName: object.get("entryClassName"),
+            // Reported back so the dashboard shows whether the grant actually
+            // landed, rather than just "done".
+            subjectCanWrite: !!subjectId && !!acl?.getWriteAccess(subjectId),
+        };
+    }, {
+        // Parse Dashboard runs scripts with the master key.
+        requireMaster: true,
+    });
+}

package/dist/functions/openinc-restore-deleted-object.d.ts

@@ -0,0 +1,4 @@
+/**
+ * @param name The function name, derived from the file name.
+ */
+export declare function init(name: string): Promise<void>;

package/dist/functions/openinc-restore-deleted-object.js

@@ -0,0 +1,343 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.init = init;
+const node_1 = __importDefault(require("parse/node"));
+const index_js_1 = require("../features/permissions/index.js");
+const index_js_2 = require("../types/index.js");
+/**
+ * Restores an object that was deleted, from its `OD3_Changelog` delete entry.
+ *
+ * Two callers, one contract — both hand over a pointer to the changelog entry
+ * and get back a one-line summary to show the user:
+ *   - the Parse Dashboard, via "Run script on selected row" in the data browser
+ *     (master key);
+ *   - the opendash changelog admin view, via its per-row restore action
+ *     (session token plus `changelog:can-restore-deleted`).
+ *
+ * `hooks/_ChangeLog.ts` writes `original: object.toJSON()` on every
+ * `beforeDelete`, which is a complete snapshot: every field, the ACL, and the
+ * objectId. That snapshot is enough to put the row back, so the restore reads
+ * the changelog entry rather than asking the caller for anything.
+ *
+ * It is offered on `OD3_Changelog` rows only, and that is the only placement
+ * that can work: a deleted object has no row of its own left to select. It
+ * restores into whichever class the entry names, so every class is a valid
+ * restore target.
+ *
+ * **Schema drift.** The snapshot describes the class as it looked at deletion
+ * time, and the class may have moved on since. Every field is therefore checked
+ * against the *current* schema before it is written, and anything that no longer
+ * fits is dropped from the payload and named in the result rather than being
+ * forced through — a mismatched write would either fail with a Parse error that
+ * names one field at a time, or quietly land a value of the wrong type. The
+ * cases handled are: the field was removed, its type changed, a pointer's
+ * targetClass changed, and it is a Relation (which `toJSON()` records as a
+ * marker with no members, so there is nothing to restore). Fields that became
+ * required *after* the deletion are the one drift that blocks the restore, since
+ * Parse would reject the create anyway — they are collected and reported
+ * together instead of one per attempt.
+ *
+ * **objectId.** Keeping the original id is what makes inbound pointers resolve
+ * again, but `parse-server/lib/RestWrite.js` rejects `objectId` on create unless
+ * the server runs with `allowCustomObjectId`. Rather than depend on a
+ * server-wide flag being set, the create is attempted with the original id and
+ * retried without it if the server refuses. That probe is free: the rejection
+ * happens in the `RestWrite` constructor, before any trigger or write.
+ *
+ * **Timestamps.** `createdAt` / `updatedAt` cannot be carried over. Parse only
+ * honours them on create for a *maintenance*-key write, and that path additionally
+ * needs `OD_MIGRATION_MODE=1` server-side or `defaultHandler` fails on the
+ * missing user (see `scripts/migration/lib/env.ts`), which is not a state a
+ * general restore can assume. The restored row is therefore stamped `now`; the
+ * original timestamps stay readable on the changelog entry.
+ *
+ * The write goes through the ordinary REST create with the master key, so
+ * `beforeSave` runs as it would for any other create. For classes whose hook
+ * calls `defaultAclHandler` that means the restored ACL is rebuilt rather than
+ * taken verbatim from the snapshot — the same ACL such a row would get today.
+ */
+/** Snapshot keys that are not ordinary field data. */
+const RESERVED = new Set([
+    "objectId",
+    "className",
+    "__type",
+    "createdAt",
+    "updatedAt",
+    "ACL",
+]);
+/**
+ * The Parse field type a snapshot value would need.
+ *
+ * `null` means "carries no type information" — a null value is assignable to any
+ * optional field, so it is never a drift mismatch on its own.
+ */
+function snapshotType(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (Array.isArray(value))
+        return "Array";
+    switch (typeof value) {
+        case "string":
+            return "String";
+        case "number":
+            return "Number";
+        case "boolean":
+            return "Boolean";
+    }
+    const tagged = value;
+    switch (tagged.__type) {
+        case "Pointer":
+            return "Pointer";
+        case "Date":
+            return "Date";
+        case "File":
+            return "File";
+        case "GeoPoint":
+            return "GeoPoint";
+        case "Polygon":
+            return "Polygon";
+        case "Bytes":
+            return "Bytes";
+        case "Relation":
+            return "Relation";
+    }
+    return "Object";
+}
+function restHeaders() {
+    return {
+        "X-Parse-Application-Id": node_1.default.applicationId,
+        "X-Parse-Master-Key": node_1.default.masterKey,
+        "Content-Type": "application/json",
+    };
+}
+/**
+ * GET one row as raw REST JSON.
+ *
+ * Deliberately not `object.fetch()`. The SDK's `decode()` recurses into
+ * Object-typed fields and turns every `{__type: "Pointer" | "Date" | "File" | …}`
+ * marker it finds into a live SDK instance, so the snapshot would arrive as a mix
+ * of plain JSON and objects. Two things break then: a Pointer reads as type
+ * "Object" when checked against the schema and gets dropped as false drift, and
+ * `JSON.stringify` re-encodes a `Parse.Object` as its full attributes instead of a
+ * pointer. Reading over REST keeps the snapshot in exactly the shape it was
+ * stored in — which is also the shape the create below expects.
+ */
+async function restGet(className, objectId) {
+    const response = await fetch(`${node_1.default.serverURL}/classes/${encodeURIComponent(className)}/${encodeURIComponent(objectId)}`, { method: "GET", headers: restHeaders() });
+    if (!response.ok) {
+        throw new node_1.default.Error(node_1.default.Error.OBJECT_NOT_FOUND, `Could not read ${className} ${objectId}: HTTP ${response.status}.`);
+    }
+    return (await response.json());
+}
+/**
+ * POST a create straight to REST.
+ *
+ * The SDK cannot do this one: `Parse.Object.fromJSON` marks an object with an id
+ * as already saved, so `save()` would issue an update against a row that is gone.
+ */
+async function restCreate(className, body) {
+    const response = await fetch(`${node_1.default.serverURL}/classes/${encodeURIComponent(className)}`, {
+        method: "POST",
+        headers: restHeaders(),
+        body: JSON.stringify(body),
+    });
+    const text = await response.text();
+    let parsed = {};
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return {
+            ok: false,
+            status: response.status,
+            error: text.slice(0, 300) || `HTTP ${response.status}`,
+        };
+    }
+    return response.ok
+        ? { ok: true, status: response.status, objectId: parsed.objectId }
+        : {
+            ok: false,
+            status: response.status,
+            code: parsed.code,
+            error: parsed.error,
+        };
+}
+/** Does `objectId` still exist in `className`? Errors count as "no". */
+async function exists(className, objectId) {
+    try {
+        const query = new node_1.default.Query(className);
+        query.equalTo("objectId", objectId);
+        return (await query.count({ useMasterKey: true })) > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * @param name The function name, derived from the file name.
+ */
+async function init(name) {
+    node_1.default.Cloud.define(name, async function (request) {
+        // Master-key callers (the Parse Dashboard script) pass straight through;
+        // a session caller (the opendash changelog admin view) needs the grant.
+        // The restore itself always writes with the master key, which is why this
+        // is a permission of its own rather than part of `changelog:can-see-app`.
+        await (0, index_js_1.requirePermission)({
+            sessionToken: request.user?.getSessionToken(),
+            master: request.master,
+        }, index_js_1.Permissions.CORE.changelog_restore, "You are not allowed to restore deleted objects");
+        // The dashboard sends `createWithoutData(id).toPointer()`, so this arrives
+        // as an unfetched shell — id and className only, no field data.
+        const pointer = request.params.object;
+        // Thrown rather than returned: the dashboard surfaces a rejection as an
+        // error toast, while any resolved value reads as success.
+        if (!pointer) {
+            throw new node_1.default.Error(node_1.default.Error.INVALID_JSON, "No object was passed. Run this from the data browser on a selected row.");
+        }
+        if (pointer.className !== index_js_2.Changelog.className) {
+            throw new node_1.default.Error(node_1.default.Error.INVALID_CLASS_NAME, `Expected a ${index_js_2.Changelog.className} row, got ${pointer.className}. ` +
+                "Select the delete entry of the object you want back.");
+        }
+        if (!pointer.id) {
+            throw new node_1.default.Error(node_1.default.Error.INVALID_JSON, "The selected row has no objectId.");
+        }
+        const entry = await restGet(index_js_2.Changelog.className, pointer.id);
+        const operation = entry.operation;
+        if (operation !== "delete") {
+            throw new node_1.default.Error(node_1.default.Error.INVALID_QUERY, `This entry records a "${operation}", not a delete — there is nothing to restore. ` +
+                'Filter the browser on operation = "delete".');
+        }
+        const className = entry.nameOfClass;
+        const snapshot = entry.original;
+        if (!className) {
+            throw new node_1.default.Error(node_1.default.Error.INVALID_JSON, "The entry has no nameOfClass, so the target class is unknown.");
+        }
+        if (!snapshot || typeof snapshot !== "object") {
+            throw new node_1.default.Error(node_1.default.Error.INVALID_JSON, "The entry has no `original` snapshot, so there is nothing to restore from. " +
+                "Entries written while the delete hook was failing can look like this.");
+        }
+        const originalId = snapshot.objectId ??
+            entry.changedObject;
+        // The class itself may be gone, which Parse reports as a failure to read
+        // its schema. Say so plainly instead of leaking the schema error.
+        let fields;
+        try {
+            // `get()` takes no options — the SDK forces useMasterKey internally.
+            const schema = await new node_1.default.Schema(className).get();
+            fields = (schema.fields ?? {});
+        }
+        catch {
+            throw new node_1.default.Error(node_1.default.Error.INVALID_CLASS_NAME, `Class ${className} no longer exists, so its rows cannot be restored.`);
+        }
+        if (originalId && (await exists(className, originalId))) {
+            throw new node_1.default.Error(node_1.default.Error.DUPLICATE_VALUE, `${className} ${originalId} already exists — it was restored already, or the id was reused. ` +
+                "Nothing was written.");
+        }
+        // Walk the snapshot against the current schema.
+        const payload = {};
+        const skipped = [];
+        const warnings = [];
+        const pointerFields = [];
+        let restoredCount = 0;
+        for (const [key, value] of Object.entries(snapshot)) {
+            if (RESERVED.has(key))
+                continue;
+            const field = fields[key];
+            if (!field) {
+                skipped.push(`${key} (field no longer exists)`);
+                continue;
+            }
+            if (field.type === "Relation") {
+                // toJSON() writes `{__type: "Relation", className}` — a marker, not the
+                // members. Restoring the row cannot restore what it pointed at.
+                skipped.push(`${key} (Relation — members are not in the snapshot)`);
+                continue;
+            }
+            const type = snapshotType(value);
+            if (type !== null && type !== field.type) {
+                skipped.push(`${key} (type changed ${type} → ${field.type})`);
+                continue;
+            }
+            if (type === "Pointer") {
+                const p = value;
+                if (field.targetClass && field.targetClass !== p.className) {
+                    skipped.push(`${key} (pointer target changed ${p.className} → ${field.targetClass})`);
+                    continue;
+                }
+                pointerFields.push({ key, className: p.className, id: p.objectId });
+            }
+            payload[key] = value;
+            restoredCount++;
+        }
+        // Fields that became required after the deletion would make Parse reject
+        // the create one field at a time. Collect them and report them together.
+        const missingRequired = Object.entries(fields)
+            .filter(([key, field]) => field.required &&
+            field.defaultValue === undefined &&
+            !RESERVED.has(key) &&
+            (payload[key] === undefined || payload[key] === null))
+            .map(([key, field]) => `${key} (${field.type})`);
+        if (missingRequired.length > 0) {
+            throw new node_1.default.Error(node_1.default.Error.VALIDATION_ERROR, `${className} has required fields the snapshot cannot fill: ${missingRequired.join(", ")}. ` +
+                "They were added after this object was deleted. Nothing was written — " +
+                "give them a defaultValue in the schema, or restore the row by hand.");
+        }
+        // Pointers to objects that are themselves gone still restore (Parse does
+        // not enforce referential integrity), but they are worth naming.
+        for (const p of pointerFields) {
+            if (!(await exists(p.className, p.id))) {
+                warnings.push(`${p.key} → ${p.className} ${p.id} no longer exists`);
+            }
+        }
+        if (snapshot.ACL)
+            payload.ACL = snapshot.ACL;
+        if (className === "_User") {
+            // toJSON() never carries the password hash.
+            warnings.push("restored _User rows have no password — the user must reset it");
+        }
+        // Try to keep the original id; fall back to a generated one when the
+        // server runs without allowCustomObjectId.
+        let keptId = true;
+        let result;
+        if (originalId) {
+            result = await restCreate(className, {
+                ...payload,
+                objectId: originalId,
+            });
+            if (!result.ok && result.code === node_1.default.Error.INVALID_KEY_NAME) {
+                keptId = false;
+                result = await restCreate(className, payload);
+            }
+        }
+        else {
+            keptId = false;
+            warnings.push("the snapshot had no objectId to restore");
+            result = await restCreate(className, payload);
+        }
+        if (!result.ok) {
+            throw new node_1.default.Error(node_1.default.Error.INTERNAL_SERVER_ERROR, `Restore of ${className} ${originalId ?? ""} failed: ${result.error ?? `HTTP ${result.status}`}`);
+        }
+        const newId = result.objectId ?? "?";
+        const parts = [
+            `Restored ${className} ${newId} ` +
+                (keptId
+                    ? "with its original objectId."
+                    : `under a NEW objectId (server has no allowCustomObjectId; original was ${originalId}). ` +
+                        "Pointers to the old id still dangle."),
+            `${restoredCount} field(s) restored.`,
+            "createdAt/updatedAt are set to now; the originals stay on the changelog entry.",
+        ];
+        if (skipped.length > 0) {
+            parts.push(`Skipped ${skipped.length} field(s): ${skipped.join("; ")}.`);
+        }
+        if (warnings.length > 0) {
+            parts.push(`Warnings: ${warnings.join("; ")}.`);
+        }
+        // Returned as a string: the dashboard passes the result straight to
+        // showNote(), which renders an object as "[object Object]".
+        return parts.join(" ");
+    });
+}

package/dist/hooks/Meta_Entry.js

@@ -1,13 +1,58 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.init = init;
+const node_1 = __importDefault(require("parse/node"));
 const index_js_1 = require("../features/meta/index.js");
 const index_js_2 = require("../features/schema/index.js");
 const index_js_3 = require("../types/index.js");
+/**
+ * Grant the user an entry is *about* write access to it.
+ *
+ * `defaultAclHandler` keys its owner grant on a `user` field, and `Meta_Entry`
+ * has none — it addresses its subject by `entryClassName` + `entryObjectId`
+ * instead. So a `_User` entry came out writable only by `od-admin` and the
+ * tenant admins, while a plain tenant user got read-only: they could create
+ * their entry (the CLP allows it) and never update it again, with Parse
+ * answering the denied write as `101 Object not found`.
+ *
+ * These entries are the user's own data — their saved dashboard views, their
+ * employee number — and the user is who writes them from the UI, so the grant
+ * belongs to them. Read access is left as the default handler set it.
+ *
+ * Runs for master-key writes too (the triggers here are registered without
+ * `skipWithMasterKey`), so re-saving an entry written before this existed is
+ * enough to repair its ACL.
+ */
+function allowSubjectUserWrite(object) {
+    if (object.entryClassName !== "_User")
+        return;
+    const subjectId = object.entryObjectId;
+    if (!subjectId)
+        return;
+    const acl = object.getACL() ?? new node_1.default.ACL();
+    acl.setReadAccess(subjectId, true);
+    acl.setWriteAccess(subjectId, true);
+    object.setACL(acl);
+}
 async function init() {
     (0, index_js_2.beforeSaveHook)(index_js_3.Meta_Entry, async (request) => {
         await (0, index_js_2.defaultHandler)(request);
-        await (0, index_js_2.defaultAclHandler)(request);
+        await (0, index_js_2.defaultAclHandler)(request, {
+            // Meta entries are collaborative header data: the tenant's users are the
+            // ones filling them in from the ticket/equipment UI, so they need write
+            // and not just read. Without this a plain tenant user could create an
+            // entry and never edit it again — the write came back as Parse's
+            // `101 Object not found`.
+            //
+            // A `_User` entry is the exception. It is one person's own data, and
+            // `allowSubjectUserWrite` grants write to exactly that person below, so
+            // there is no reason for every colleague in the tenant to have it.
+            allowTenantUserWrite: request.object.entryClassName !== "_User",
+        });
+        allowSubjectUserWrite(request.object);
     });
     (0, index_js_2.afterSaveHook)(index_js_3.Meta_Entry, async ({ object }) => {
         // An entry is the only trace of a context that has no config behind it —

package/dist/hooks/Service_Ticket.js

@@ -57,10 +57,13 @@ async function init() {
         if (isNew && !object.get("createdBy") && user)
             object.set("createdBy", user);
         await (0, index_js_1.defaultHandler)(request);
-        await (0, index_js_1.defaultAclHandler)(request, {
-            allowCustomACL: true,
-            allowTenantUserWrite: true,
-        });
+        // No `allowTenantUserWrite`: who may edit a ticket is decided per record by
+        // `setTicketACL` below — creator, assigned users, assigned roles — and a
+        // blanket write grant for every user in the tenant would make that decision
+        // meaningless (it did: `entity.readonly` was never true for a tenant
+        // member). Read is still granted tenant-wide, so the list and board keep
+        // showing every ticket.
+        await (0, index_js_1.defaultAclHandler)(request, { allowCustomACL: true });
         await setTicketACL(object);
         // Assign a sequential ticket number on creation. Done here (backend) rather
         // than in the frontend because every write path — the create form, the
@@ -192,12 +195,25 @@ async function nextTenantTicketNumber(tenant) {
  * pointers, so we iterate the entries (by object id) rather than the array
  * indices. Parse ACL role grants require the role *name*, not its id, so the
  * assigned role pointers are resolved to names first.
+ *
+ * This is the authority on who may write a ticket, which is why the tenant-user
+ * grant is set here explicitly rather than left to `defaultAclHandler`: tickets
+ * saved while that handler still granted the whole tenant write carry the old
+ * grant in their stored ACL, and `allowCustomACL` keeps a stored ACL rather
+ * than rebuilding it. Setting write to `false` repairs such a ticket the next
+ * time it is saved instead of letting the stale grant live on.
  */
 async function setTicketACL(object) {
     const acl = object.getACL() ?? new node_1.default.ACL();
     // deny global read / write
     acl.setPublicReadAccess(false);
     acl.setPublicWriteAccess(false);
+    // the tenant reads every ticket, but writes only its own / assigned ones
+    const tenantId = object.get("tenant")?.id;
+    if (tenantId) {
+        acl.setRoleReadAccess(`od-tenant-user-${tenantId}`, true);
+        acl.setRoleWriteAccess(`od-tenant-user-${tenantId}`, false);
+    }
     // creator read/write
     const creatorId = object.get("createdBy")?.id;
     if (creatorId) {

package/dist/templates/emails/openinc-auth-password-reset.html

@@ -0,0 +1,61 @@
+<table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="background:#f4f5f7;padding:32px 12px;font-family:-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;">
+  <tr>
+    <td align="center">
+      <table role="presentation" width="600" cellpadding="0" cellspacing="0" border="0" style="max-width:600px;width:100%;background:#ffffff;border-radius:8px;border:1px solid #e3e5e8;">
+        <tr>
+          <td style="padding:32px 40px 8px 40px;">
+            <h1 style="margin:0 0 16px 0;font-size:20px;line-height:28px;color:#1a1d21;font-weight:600;">Passwort zurücksetzen</h1>
+            <p style="margin:0 0 16px 0;font-size:15px;line-height:23px;color:#40454c;">
+              Hallo,<br>
+              du hast angefordert, dein Passwort zurückzusetzen. Klicke dazu auf den folgenden Button:
+            </p>
+          </td>
+        </tr>
+        <tr>
+          <td align="center" style="padding:8px 40px 24px 40px;">
+            <table role="presentation" cellpadding="0" cellspacing="0" border="0">
+              <tr>
+                <td bgcolor="#2563eb" style="border-radius:6px;">
+                  <a href="{{ link }}" style="display:inline-block;padding:13px 28px;font-size:15px;font-weight:600;color:#ffffff;text-decoration:none;border-radius:6px;">Passwort zurücksetzen</a>
+                </td>
+              </tr>
+            </table>
+          </td>
+        </tr>
+        <tr>
+          <td style="padding:0 40px 24px 40px;">
+            <p style="margin:0 0 8px 0;font-size:13px;line-height:20px;color:#6b7280;">
+              Falls der Button nicht funktioniert, kopiere diesen Link in deinen Browser:
+            </p>
+            <p style="margin:0;font-size:12px;line-height:18px;word-break:break-all;">
+              <a href="{{ link }}" style="color:#2563eb;">{{ link }}</a>
+            </p>
+          </td>
+        </tr>
+        <tr>
+          <td style="padding:0 40px;">
+            <p style="margin:0 0 24px 0;font-size:13px;line-height:20px;color:#6b7280;">
+              Der Link ist nur einmal verwendbar. Hast du diese Anfrage nicht gestellt, ignoriere diese E-Mail – dein Passwort bleibt unverändert.
+            </p>
+            <hr style="border:0;border-top:1px solid #e3e5e8;margin:0 0 24px 0;">
+          </td>
+        </tr>
+        <tr>
+          <td style="padding:0 40px 32px 40px;">
+            <h2 style="margin:0 0 12px 0;font-size:16px;line-height:24px;color:#1a1d21;font-weight:600;">Reset your password</h2>
+            <p style="margin:0 0 12px 0;font-size:14px;line-height:22px;color:#40454c;">
+              Hello,<br>
+              you requested to reset your password. Use the button above, or open this link:
+            </p>
+            <p style="margin:0 0 12px 0;font-size:12px;line-height:18px;word-break:break-all;">
+              <a href="{{ link }}" style="color:#2563eb;">{{ link }}</a>
+            </p>
+            <p style="margin:0;font-size:13px;line-height:20px;color:#6b7280;">
+              The link can only be used once. If you did not request this, simply ignore this email – your password remains unchanged.
+            </p>
+          </td>
+        </tr>
+      </table>
+    </td>
+  </tr>
+</table>

package/dist/templates/emails/openinc-auth-password-reset.subject

@@ -0,0 +1 @@
+Passwort zurücksetzen / Reset your password

package/dist/templates/emails/openinc-auth-password-reset.txt

@@ -0,0 +1,27 @@
+PASSWORT ZURÜCKSETZEN
+=====================
+
+Hallo,
+
+du hast angefordert, dein Passwort zurückzusetzen. Öffne dazu den
+folgenden Link:
+
+{{ link | safe }}
+
+Der Link ist nur einmal verwendbar. Falls du diese Anfrage nicht
+gestellt hast, kannst du diese E-Mail ignorieren – dein Passwort
+bleibt unverändert.
+
+
+RESET YOUR PASSWORD
+===================
+
+Hello,
+
+you requested to reset your password. Please open the following
+link:
+
+{{ link | safe }}
+
+The link can only be used once. If you did not request this, simply
+ignore this email – your password remains unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openinc/parse-server-opendash",
-  "version": "4.2.4",
+  "version": "4.3.1",
   "description": "Parse Server Cloud Code for open.INC Stack.",
   "packageManager": "pnpm@11.25.0",
   "keywords": [
@@ -51,7 +51,7 @@
   "scripts": {
     "start": "tsc -w",
     "dockerstart": "concurrently \"pnpm run start\" \"cd ./docker-dev && docker-compose watch\"",
-    "build": "rimraf ./dist && tsc && node scripts/copyTranslationFiles.js",
+    "build": "rimraf ./dist && tsc && node scripts/copyTranslationFiles.js && node scripts/copyEmailTemplates.js",
     "copy:i18n": "node scripts/copyTranslationFiles.js",
     "deploy": "opendash deploy",
     "schema-down": "parse-server-schema down --prefix OD3_ ./schema",
@@ -69,7 +69,7 @@
     "seed:v1": "node dist/scripts/seed-v1-testdata.js"
   },
   "dependencies": {
-    "@opendash/ruleset-core": "0.1.1-nightly.1",
+    "@opendash/ruleset-core": "nightly",
     "@openinc/parse-server-schema": "^4.1.2",
     "amqplib": "^0.10.9",
     "cron": "^4.4.0",