Class AISkillPermissionProvider

Wraps MJ: AI Skill Permissions behind the unified PermissionProviderBase contract — the closed-by-default, explicit-grants view that powers the Sharing Center and audit.

This is the skill sibling of AIAgentPermissionProvider. AISkillPermission rows grant either a User (via UserID) or a Role (via RoleID) — never both; the server entity enforces this. Action mapping:

CanView → Read
CanRun → Execute (request/activate the skill at agent runtime)
CanEdit → Update
CanDelete → Delete

User+Role grants for the same user are OR-aggregated (any grant of an action suffices).

resourceType is "AI Skills". resourceId is the skill ID. NOTE: this provider reports only explicit grants; the open-by-default runtime behavior (no rows → View+Run for everyone) lives in AISkillPermissionHelper — see guides/UNIFIED_PERMISSIONS_GUIDE.md for why the two paths differ.

Hierarchy (View Summary)

PermissionProviderBase
- AISkillPermissionProvider

Index

Constructors

constructor

new AISkillPermissionProvider(): AISkillPermissionProvider
Returns AISkillPermissionProvider
Inherited from PermissionProviderBase.constructor

Properties

`Readonly`Description

Description: "User- or role-level permissions on AI skills. Actions: View (Read), Run (Execute), Edit (Update), Delete." = 'User- or role-level permissions on AI skills. Actions: View (Read), Run (Execute), Edit (Update), Delete.'

Human-readable description of what this provider covers.

`Readonly`DomainName

DomainName: "AI Skill Permissions" = 'AI Skill Permissions'

Opt-in marker read by ClassFactory (see ClassResolutionResult): this class CANNOT function standalone — every member below is abstract, so a base instance is a method-less stub. TypeScript's abstract is erased at runtime, so the factory cannot detect that on its own; without this marker an unresolvable ProviderClassName would silently be handed back as a live "provider" and blow up later at the first method call.

With the marker set, CreateInstance throws and TryCreateInstance returns {Resolved: false, Instance: null} — both of which PermissionEngine handles by skipping the domain.

`Readonly`SupportedActions

SupportedActions: PermissionAction[] = ...

What actions this provider can evaluate.

`Readonly`SupportedGranteeTypes

SupportedGranteeTypes: GranteeType[] = ...

What grantee types this provider supports.

`Readonly`SupportsDeny

SupportsDeny: false

Whether this provider supports explicit Deny records.

Methods

`Protected`boolsToActions

boolsToActions(
flags: Partial<Record<PermissionAction, boolean | null | undefined>>,
): PermissionAction[]
Map a { Read?: boolean, Update?: boolean, … } descriptor to a canonical PermissionAction[]. Replaces the 9 hand-rolled copies that each walked their row's CRUD-ish booleans and pushed action names.

Output order matches the canonical order declared in PermissionAction. Entries that are null/undefined/false are skipped.
Parameters
- flags: Partial<Record<PermissionAction, boolean | null | undefined>>
Returns PermissionAction[]
Example
```
const actions = this.boolsToActions({
    Read: row.CanRead,
    Update: row.CanEdit,       // domain-specific flag name
    Delete: row.CanDelete,
    Share: row.CanShare,
});
// → ['Read', 'Update', 'Delete', 'Share']  // in this order, where truthy
```
Inherited from PermissionProviderBase.boolsToActions
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:232

`Protected`buildNormalizedPermission

buildNormalizedPermission(
    args: {
        actions: PermissionAction[];
        effect?: "Allow" | "Deny";
        expiresAt?: Date;
        granteeId: string;
        granteeName?: string;
        granteeType: GranteeType;
        resourceId: string;
        resourceName?: string;
        resourceType: string;
        sourceRecordId?: string;
    },
): NormalizedPermission
Build a NormalizedPermission with DomainName and Effect pre-filled from the provider. Centralizes the ~10-field literal that used to be constructed in every GetUserResources / GetEffectivePermissions / GetResourcePermissions implementation.

Effect defaults to 'Allow' since the vast majority of providers don't support Deny. Providers that emit Deny records (EntityPermissionProvider) pass { effect: 'Deny' } explicitly.
Parameters
- args: {
      actions: PermissionAction[];
      effect?: "Allow" | "Deny";
      expiresAt?: Date;
      granteeId: string;
      granteeName?: string;
      granteeType: GranteeType;
      resourceId: string;
      resourceName?: string;
      resourceType: string;
      sourceRecordId?: string;
  }
Returns NormalizedPermission
Inherited from PermissionProviderBase.buildNormalizedPermission
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:201

`Protected`bulkLookupNames

bulkLookupNames(
    entityName: string,
    ids: string[],
    nameField?: string,
): Promise<Map<string, string>>
Given a list of IDs, fetch {ID, <nameField>} from entityName and return a Map<ID, name>. Used by providers whose domain views don't denormalize a resource name onto the permission row (AI Agents, Artifacts, Collections).

Returns an empty Map when ids is empty or the RunView fails — callers should treat a missing key as "name unknown."
Parameters
- entityName: string
- ids: string[]
- OptionalnameField: string
Returns Promise<Map<string, string>>
Inherited from PermissionProviderBase.bulkLookupNames
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:257

CheckPermission

CheckPermission(
    user: UserInfo,
    _resourceType: string,
    resourceId: string,
    action: PermissionAction,
): Promise<PermissionCheckResult>
Check if a user has a specific permission on a specific resource.
Parameters
- user: UserInfo
  The user whose permissions are being checked (roles come from user.UserRoles).
- _resourceType: string
  The resource type within this domain (e.g., entity name, resource type name).
- resourceId: string
  The specific resource ID; null for domain-wide checks.
- action: PermissionAction
  The action being requested.
Returns Promise<PermissionCheckResult>
Overrides PermissionProviderBase.CheckPermission
- Defined in MJCoreEntities/src/custom/PermissionProviders/AISkillPermissionProvider.ts:55

`Protected`fetchRows

fetchRows<T>(
    entityName: string,
    extraFilter: string,
    fields: string[],
    methodName: string,
): Promise<T[]>
Standard RunView wrapper that logs failures with <ProviderClass>.<methodName>: prefix and returns the row list (or [] on failure). Replaces the boilerplate that each provider previously carried around its RunView calls.
Type Parameters
- T
Parameters
- entityName: string
- extraFilter: string
- fields: string[]
- methodName: string
Returns Promise<T[]>
Example
```
const rows = await this.fetchRows<MyRow>(
    'MJ: AI Agent Permissions',
    `AgentID='${agentId}'`,
    ['ID', 'AgentID', 'CanView', 'CanRun'],
    'fetchPermissionsForAgent'
);
```
Inherited from PermissionProviderBase.fetchRows
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:248

GetEffectivePermissions

GetEffectivePermissions(
    user: UserInfo,
    _resourceType: string,
    resourceId: string,
): Promise<NormalizedPermission[]>
Get all effective permissions a user has on a specific resource. Returns an empty array when the user has no access.
Parameters
- user: UserInfo
- _resourceType: string
- resourceId: string
Returns Promise<NormalizedPermission[]>
Overrides PermissionProviderBase.GetEffectivePermissions
- Defined in MJCoreEntities/src/custom/PermissionProviders/AISkillPermissionProvider.ts:81

GetPermissionsGrantedByUser

GetPermissionsGrantedByUser(
_grantor: UserInfo,
_provider?: IMetadataProvider,
): Promise<NormalizedPermission[]>
Default implementation returns [] — role-only providers don't support user-granted sharing. User-granted-sharing providers (Dashboards, Artifacts, Collections, Resource Permissions, Access Control Rules) should override this to query their source table.
Parameters
- _grantor: UserInfo
- Optional_provider: IMetadataProvider
Returns Promise<NormalizedPermission[]>
Inherited from PermissionProviderBase.GetPermissionsGrantedByUser
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:179

GetPermissionsSharedWithUser

GetPermissionsSharedWithUser(
_grantee: UserInfo,
_provider?: IMetadataProvider,
): Promise<NormalizedPermission[]>
Default implementation returns [] — role-only providers have no "shared with me" concept. User-grantee providers should override this to return only permissions where grantee is the direct grantee AND someone else is the grantor/owner.
Parameters
- _grantee: UserInfo
- Optional_provider: IMetadataProvider
Returns Promise<NormalizedPermission[]>
Inherited from PermissionProviderBase.GetPermissionsSharedWithUser
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:185

GetResourcePermissions

GetResourcePermissions(
resourceType: string,
resourceId: string,
): Promise<NormalizedPermission[]>
Get all permissions granted on a specific resource across every grantee. Powers the Sharing Center's "Resource Access Report" view.
Parameters
- resourceType: string
- resourceId: string
Returns Promise<NormalizedPermission[]>
Overrides PermissionProviderBase.GetResourcePermissions
- Defined in MJCoreEntities/src/custom/PermissionProviders/AISkillPermissionProvider.ts:132

GetResourceTypes

GetResourceTypes(): string[]
Default implementation returns [] — providers should override to advertise their supported resource types (see IPermissionProvider.GetResourceTypes).

Returns string[]
Overrides PermissionProviderBase.GetResourceTypes
- Defined in MJCoreEntities/src/custom/PermissionProviders/AISkillPermissionProvider.ts:51

GetUserResources

GetUserResources(
user: UserInfo,
resourceType?: string,
): Promise<NormalizedPermission[]>
Get all resources within this domain that the user has access to. Powers the Sharing Center's "User Access Report" view.
Parameters
- user: UserInfo
- OptionalresourceType: string
  Optional filter to one resource type within the domain.
Returns Promise<NormalizedPermission[]>
Overrides PermissionProviderBase.GetUserResources
- Defined in MJCoreEntities/src/custom/PermissionProviders/AISkillPermissionProvider.ts:93

Class AISkillPermissionProvider

Hierarchy (View Summary)

Index

Constructors

Properties

Methods

Constructors

constructor

Returns AISkillPermissionProvider

Properties

ReadonlyDescription

ReadonlyDomainName

ReadonlySupportedActions

ReadonlySupportedGranteeTypes

ReadonlySupportsDeny

Methods

ProtectedboolsToActions

Parameters

Returns PermissionAction[]

Example

ProtectedbuildNormalizedPermission

Parameters

Returns NormalizedPermission

ProtectedbulkLookupNames

Parameters

Returns Promise<Map<string, string>>

CheckPermission

Parameters

Returns Promise<PermissionCheckResult>

ProtectedfetchRows

Type Parameters

Parameters

Returns Promise<T[]>

Example

GetEffectivePermissions

Parameters

Returns Promise<NormalizedPermission[]>

GetPermissionsGrantedByUser

Parameters

Returns Promise<NormalizedPermission[]>

GetPermissionsSharedWithUser

Parameters

Returns Promise<NormalizedPermission[]>

GetResourcePermissions

Parameters

Returns Promise<NormalizedPermission[]>

GetResourceTypes

Returns string[]

GetUserResources

Parameters

Returns Promise<NormalizedPermission[]>

Settings

On This Page

`Readonly`Description

`Readonly`DomainName

`Readonly`SupportedActions

`Readonly`SupportedGranteeTypes

`Readonly`SupportsDeny

`Protected`boolsToActions

`Protected`buildNormalizedPermission

`Protected`bulkLookupNames

`Protected`fetchRows