Class AccessControlRuleProvider

Wraps MJ: Access Control Rules behind the unified PermissionProviderBase contract.

ACRs are record-scoped permissions on any entity, using a single polymorphic (GranteeType, GranteeID) column pair. They support the broadest grantee set (User, Role, Everyone, Public), the full CRUD+Share action set, and optional time-bound expiration via ExpiresAt.

resourceType is the entity name the ACR targets (e.g., "Accounts"); the provider resolves it to the EntityID before querying. resourceId is the RecordID value (typically a UUID but stored as nvarchar(500) to accommodate composite keys).

Hierarchy (View Summary)

PermissionProviderBase
- AccessControlRuleProvider

Index

Constructors

constructor

new AccessControlRuleProvider(): AccessControlRuleProvider
Returns AccessControlRuleProvider
Inherited from PermissionProviderBase.constructor

Properties

`Readonly`Description

Description: "Record-level permissions with User/Role/Everyone/Public grantees, full CRUD+Share, and optional expiration." = 'Record-level permissions with User/Role/Everyone/Public grantees, full CRUD+Share, and optional expiration.'

Human-readable description of what this provider covers.

`Readonly`DomainName

DomainName: "Access Control Rules" = 'Access Control Rules'

Opt-in marker read by ClassFactory (see ClassResolutionResult): this class CANNOT function standalone — every member below is abstract, so a base instance is a method-less stub. TypeScript's abstract is erased at runtime, so the factory cannot detect that on its own; without this marker an unresolvable ProviderClassName would silently be handed back as a live "provider" and blow up later at the first method call.

With the marker set, CreateInstance throws and TryCreateInstance returns {Resolved: false, Instance: null} — both of which PermissionEngine handles by skipping the domain.

`Readonly`SupportedActions

SupportedActions: PermissionAction[] = ...

What actions this provider can evaluate.

`Readonly`SupportedGranteeTypes

SupportedGranteeTypes: GranteeType[] = ...

What grantee types this provider supports.

`Readonly`SupportsDeny

SupportsDeny: false

Whether this provider supports explicit Deny records.

`Readonly`SupportsExpiration

SupportsExpiration: true

Methods

`Protected`boolsToActions

boolsToActions(
flags: Partial<Record<PermissionAction, boolean | null | undefined>>,
): PermissionAction[]
Map a { Read?: boolean, Update?: boolean, … } descriptor to a canonical PermissionAction[]. Replaces the 9 hand-rolled copies that each walked their row's CRUD-ish booleans and pushed action names.

Output order matches the canonical order declared in PermissionAction. Entries that are null/undefined/false are skipped.
Parameters
- flags: Partial<Record<PermissionAction, boolean | null | undefined>>
Returns PermissionAction[]
Example
```
const actions = this.boolsToActions({
    Read: row.CanRead,
    Update: row.CanEdit,       // domain-specific flag name
    Delete: row.CanDelete,
    Share: row.CanShare,
});
// → ['Read', 'Update', 'Delete', 'Share']  // in this order, where truthy
```
Inherited from PermissionProviderBase.boolsToActions
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:232

`Protected`buildNormalizedPermission

buildNormalizedPermission(
    args: {
        actions: PermissionAction[];
        effect?: "Allow" | "Deny";
        expiresAt?: Date;
        granteeId: string;
        granteeName?: string;
        granteeType: GranteeType;
        resourceId: string;
        resourceName?: string;
        resourceType: string;
        sourceRecordId?: string;
    },
): NormalizedPermission
Build a NormalizedPermission with DomainName and Effect pre-filled from the provider. Centralizes the ~10-field literal that used to be constructed in every GetUserResources / GetEffectivePermissions / GetResourcePermissions implementation.

Effect defaults to 'Allow' since the vast majority of providers don't support Deny. Providers that emit Deny records (EntityPermissionProvider) pass { effect: 'Deny' } explicitly.
Parameters
- args: {
      actions: PermissionAction[];
      effect?: "Allow" | "Deny";
      expiresAt?: Date;
      granteeId: string;
      granteeName?: string;
      granteeType: GranteeType;
      resourceId: string;
      resourceName?: string;
      resourceType: string;
      sourceRecordId?: string;
  }
Returns NormalizedPermission
Inherited from PermissionProviderBase.buildNormalizedPermission
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:201

`Protected`bulkLookupNames

bulkLookupNames(
    entityName: string,
    ids: string[],
    nameField?: string,
): Promise<Map<string, string>>
Given a list of IDs, fetch {ID, <nameField>} from entityName and return a Map<ID, name>. Used by providers whose domain views don't denormalize a resource name onto the permission row (AI Agents, Artifacts, Collections).

Returns an empty Map when ids is empty or the RunView fails — callers should treat a missing key as "name unknown."
Parameters
- entityName: string
- ids: string[]
- OptionalnameField: string
Returns Promise<Map<string, string>>
Inherited from PermissionProviderBase.bulkLookupNames
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:257

CheckPermission

CheckPermission(
    user: UserInfo,
    resourceType: string,
    resourceId: string,
    action: PermissionAction,
    provider?: IMetadataProvider,
): Promise<PermissionCheckResult>
Check if a user has a specific permission on a specific resource.
Parameters
- user: UserInfo
  The user whose permissions are being checked (roles come from user.UserRoles).
- resourceType: string
  The resource type within this domain (e.g., entity name, resource type name).
- resourceId: string
  The specific resource ID; null for domain-wide checks.
- action: PermissionAction
  The action being requested.
- Optionalprovider: IMetadataProvider
Returns Promise<PermissionCheckResult>
Overrides PermissionProviderBase.CheckPermission
- Defined in MJCoreEntities/src/custom/PermissionProviders/AccessControlRuleProvider.ts:62

`Protected`fetchRows

fetchRows<T>(
    entityName: string,
    extraFilter: string,
    fields: string[],
    methodName: string,
): Promise<T[]>
Standard RunView wrapper that logs failures with <ProviderClass>.<methodName>: prefix and returns the row list (or [] on failure). Replaces the boilerplate that each provider previously carried around its RunView calls.
Type Parameters
- T
Parameters
- entityName: string
- extraFilter: string
- fields: string[]
- methodName: string
Returns Promise<T[]>
Example
```
const rows = await this.fetchRows<MyRow>(
    'MJ: AI Agent Permissions',
    `AgentID='${agentId}'`,
    ['ID', 'AgentID', 'CanView', 'CanRun'],
    'fetchPermissionsForAgent'
);
```
Inherited from PermissionProviderBase.fetchRows
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:248

GetEffectivePermissions

GetEffectivePermissions(
    user: UserInfo,
    resourceType: string,
    resourceId: string,
    provider?: IMetadataProvider,
): Promise<NormalizedPermission[]>
Get all effective permissions a user has on a specific resource. Returns an empty array when the user has no access.
Parameters
- user: UserInfo
- resourceType: string
- resourceId: string
- Optionalprovider: IMetadataProvider
Returns Promise<NormalizedPermission[]>
Overrides PermissionProviderBase.GetEffectivePermissions
- Defined in MJCoreEntities/src/custom/PermissionProviders/AccessControlRuleProvider.ts:97

GetPermissionsGrantedByUser

GetPermissionsGrantedByUser(grantor: UserInfo): Promise<NormalizedPermission[]>
Every ACR where this user is the grantor. Only unexpired rules are returned — an expired ACR can't be acted on, so surfacing it in "Shared by me" would be noise.
Parameters
- grantor: UserInfo
Returns Promise<NormalizedPermission[]>
Overrides PermissionProviderBase.GetPermissionsGrantedByUser
- Defined in MJCoreEntities/src/custom/PermissionProviders/AccessControlRuleProvider.ts:221

GetPermissionsSharedWithUser

GetPermissionsSharedWithUser(grantee: UserInfo): Promise<NormalizedPermission[]>
ACRs where this user is the User-type grantee AND someone else issued the grant. Excludes rules the user created for themselves. Role/Everyone/Public grants don't belong in the personal "Shared with me" view — they're always aggregated, and there's no single recipient they were shared with. Only unexpired rules are returned.
Parameters
- grantee: UserInfo
Returns Promise<NormalizedPermission[]>
Overrides PermissionProviderBase.GetPermissionsSharedWithUser
- Defined in MJCoreEntities/src/custom/PermissionProviders/AccessControlRuleProvider.ts:192

GetResourcePermissions

GetResourcePermissions(
    resourceType: string,
    resourceId: string,
    provider?: IMetadataProvider,
): Promise<NormalizedPermission[]>
Get all permissions granted on a specific resource across every grantee. Powers the Sharing Center's "Resource Access Report" view.
Parameters
- resourceType: string
- resourceId: string
- Optionalprovider: IMetadataProvider
Returns Promise<NormalizedPermission[]>
Overrides PermissionProviderBase.GetResourcePermissions
- Defined in MJCoreEntities/src/custom/PermissionProviders/AccessControlRuleProvider.ts:164

GetResourceTypes

GetResourceTypes(provider?: IMetadataProvider): string[]
Default implementation returns [] — providers should override to advertise their supported resource types (see IPermissionProvider.GetResourceTypes).
Parameters
- Optionalprovider: IMetadataProvider
Returns string[]
Overrides PermissionProviderBase.GetResourceTypes
- Defined in MJCoreEntities/src/custom/PermissionProviders/AccessControlRuleProvider.ts:57

GetUserResources

GetUserResources(
    user: UserInfo,
    resourceType?: string,
    provider?: IMetadataProvider,
): Promise<NormalizedPermission[]>
Get all resources within this domain that the user has access to. Powers the Sharing Center's "User Access Report" view.
Parameters
- user: UserInfo
- OptionalresourceType: string
  Optional filter to one resource type within the domain.
- Optionalprovider: IMetadataProvider
Returns Promise<NormalizedPermission[]>
Overrides PermissionProviderBase.GetUserResources
- Defined in MJCoreEntities/src/custom/PermissionProviders/AccessControlRuleProvider.ts:111

Class AccessControlRuleProvider

Hierarchy (View Summary)

Index

Constructors

Properties

Methods

Constructors

constructor

Returns AccessControlRuleProvider

Properties

ReadonlyDescription

ReadonlyDomainName

ReadonlySupportedActions

ReadonlySupportedGranteeTypes

ReadonlySupportsDeny

ReadonlySupportsExpiration

Methods

ProtectedboolsToActions

Parameters

Returns PermissionAction[]

Example

ProtectedbuildNormalizedPermission

Parameters

Returns NormalizedPermission

ProtectedbulkLookupNames

Parameters

Returns Promise<Map<string, string>>

CheckPermission

Parameters

Returns Promise<PermissionCheckResult>

ProtectedfetchRows

Type Parameters

Parameters

Returns Promise<T[]>

Example

GetEffectivePermissions

Parameters

Returns Promise<NormalizedPermission[]>

GetPermissionsGrantedByUser

Parameters

Returns Promise<NormalizedPermission[]>

GetPermissionsSharedWithUser

Parameters

Returns Promise<NormalizedPermission[]>

GetResourcePermissions

Parameters

Returns Promise<NormalizedPermission[]>

GetResourceTypes

Parameters

Returns string[]

GetUserResources

Parameters

Returns Promise<NormalizedPermission[]>

Settings

On This Page

`Readonly`Description

`Readonly`DomainName

`Readonly`SupportedActions

`Readonly`SupportedGranteeTypes

`Readonly`SupportsDeny

`Readonly`SupportsExpiration

`Protected`boolsToActions

`Protected`buildNormalizedPermission

`Protected`bulkLookupNames

`Protected`fetchRows