Class EntityPermissionProvider

Wraps the Metadata + EntityInfo.GetUserPermisions() path behind the unified PermissionProviderBase contract. Entity permissions are role-only, additive (OR across roles), and cover the CRUD action set only.

resourceType is the entity name (e.g., "Users"). resourceId is unused — entity permissions are domain-wide per entity, not per-row. Row-level filters are a separate concern handled by the RLS system.

Hierarchy (View Summary)

PermissionProviderBase
- EntityPermissionProvider

Index

Constructors

constructor

new EntityPermissionProvider(): EntityPermissionProvider
Returns EntityPermissionProvider
Inherited from PermissionProviderBase.constructor

Properties

`Readonly`Description

Description: "CRUD permissions on MJ entities, role-based with optional row-level security filters and explicit Allow/Deny rows" = 'CRUD permissions on MJ entities, role-based with optional row-level security filters and explicit Allow/Deny rows'

Human-readable description of what this provider covers.

`Readonly`DomainName

DomainName: "Entity Permissions" = 'Entity Permissions'

Opt-in marker read by ClassFactory (see ClassResolutionResult): this class CANNOT function standalone — every member below is abstract, so a base instance is a method-less stub. TypeScript's abstract is erased at runtime, so the factory cannot detect that on its own; without this marker an unresolvable ProviderClassName would silently be handed back as a live "provider" and blow up later at the first method call.

With the marker set, CreateInstance throws and TryCreateInstance returns {Resolved: false, Instance: null} — both of which PermissionEngine handles by skipping the domain.

`Readonly`SupportedActions

SupportedActions: PermissionAction[] = ...

What actions this provider can evaluate.

`Readonly`SupportedGranteeTypes

SupportedGranteeTypes: GranteeType[] = ...

What grantee types this provider supports.

`Readonly`SupportsDeny

SupportsDeny: true

Whether this provider supports explicit Deny records.

Methods

`Protected`boolsToActions

boolsToActions(
flags: Partial<Record<PermissionAction, boolean | null | undefined>>,
): PermissionAction[]
Map a { Read?: boolean, Update?: boolean, … } descriptor to a canonical PermissionAction[]. Replaces the 9 hand-rolled copies that each walked their row's CRUD-ish booleans and pushed action names.

Output order matches the canonical order declared in PermissionAction. Entries that are null/undefined/false are skipped.
Parameters
- flags: Partial<Record<PermissionAction, boolean | null | undefined>>
Returns PermissionAction[]
Example
```
const actions = this.boolsToActions({
    Read: row.CanRead,
    Update: row.CanEdit,       // domain-specific flag name
    Delete: row.CanDelete,
    Share: row.CanShare,
});
// → ['Read', 'Update', 'Delete', 'Share']  // in this order, where truthy
```
Inherited from PermissionProviderBase.boolsToActions
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:232

`Protected`buildNormalizedPermission

buildNormalizedPermission(
    args: {
        actions: PermissionAction[];
        effect?: "Allow" | "Deny";
        expiresAt?: Date;
        granteeId: string;
        granteeName?: string;
        granteeType: GranteeType;
        resourceId: string;
        resourceName?: string;
        resourceType: string;
        sourceRecordId?: string;
    },
): NormalizedPermission
Build a NormalizedPermission with DomainName and Effect pre-filled from the provider. Centralizes the ~10-field literal that used to be constructed in every GetUserResources / GetEffectivePermissions / GetResourcePermissions implementation.

Effect defaults to 'Allow' since the vast majority of providers don't support Deny. Providers that emit Deny records (EntityPermissionProvider) pass { effect: 'Deny' } explicitly.
Parameters
- args: {
      actions: PermissionAction[];
      effect?: "Allow" | "Deny";
      expiresAt?: Date;
      granteeId: string;
      granteeName?: string;
      granteeType: GranteeType;
      resourceId: string;
      resourceName?: string;
      resourceType: string;
      sourceRecordId?: string;
  }
Returns NormalizedPermission
Inherited from PermissionProviderBase.buildNormalizedPermission
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:201

`Protected`bulkLookupNames

bulkLookupNames(
    entityName: string,
    ids: string[],
    nameField?: string,
): Promise<Map<string, string>>
Given a list of IDs, fetch {ID, <nameField>} from entityName and return a Map<ID, name>. Used by providers whose domain views don't denormalize a resource name onto the permission row (AI Agents, Artifacts, Collections).

Returns an empty Map when ids is empty or the RunView fails — callers should treat a missing key as "name unknown."
Parameters
- entityName: string
- ids: string[]
- OptionalnameField: string
Returns Promise<Map<string, string>>
Inherited from PermissionProviderBase.bulkLookupNames
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:257

CheckPermission

CheckPermission(
    user: UserInfo,
    resourceType: string,
    _resourceId: string,
    action: PermissionAction,
    provider?: IMetadataProvider,
): Promise<PermissionCheckResult>
Check if a user has a specific permission on a specific resource.
Parameters
- user: UserInfo
  The user whose permissions are being checked (roles come from user.UserRoles).
- resourceType: string
  The resource type within this domain (e.g., entity name, resource type name).
- _resourceId: string
  The specific resource ID; null for domain-wide checks.
- action: PermissionAction
  The action being requested.
- Optionalprovider: IMetadataProvider
Returns Promise<PermissionCheckResult>
Overrides PermissionProviderBase.CheckPermission
- Defined in MJCoreEntities/src/custom/PermissionProviders/EntityPermissionProvider.ts:38

`Protected`fetchRows

fetchRows<T>(
    entityName: string,
    extraFilter: string,
    fields: string[],
    methodName: string,
): Promise<T[]>
Standard RunView wrapper that logs failures with <ProviderClass>.<methodName>: prefix and returns the row list (or [] on failure). Replaces the boilerplate that each provider previously carried around its RunView calls.
Type Parameters
- T
Parameters
- entityName: string
- extraFilter: string
- fields: string[]
- methodName: string
Returns Promise<T[]>
Example
```
const rows = await this.fetchRows<MyRow>(
    'MJ: AI Agent Permissions',
    `AgentID='${agentId}'`,
    ['ID', 'AgentID', 'CanView', 'CanRun'],
    'fetchPermissionsForAgent'
);
```
Inherited from PermissionProviderBase.fetchRows
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:248

GetEffectivePermissions

GetEffectivePermissions(
    user: UserInfo,
    resourceType: string,
    _resourceId: string,
    provider?: IMetadataProvider,
): Promise<NormalizedPermission[]>
Get all effective permissions a user has on a specific resource. Returns an empty array when the user has no access.
Parameters
- user: UserInfo
- resourceType: string
- _resourceId: string
- Optionalprovider: IMetadataProvider
Returns Promise<NormalizedPermission[]>
Overrides PermissionProviderBase.GetEffectivePermissions
- Defined in MJCoreEntities/src/custom/PermissionProviders/EntityPermissionProvider.ts:66

GetPermissionsGrantedByUser

GetPermissionsGrantedByUser(
_grantor: UserInfo,
_provider?: IMetadataProvider,
): Promise<NormalizedPermission[]>
Default implementation returns [] — role-only providers don't support user-granted sharing. User-granted-sharing providers (Dashboards, Artifacts, Collections, Resource Permissions, Access Control Rules) should override this to query their source table.
Parameters
- _grantor: UserInfo
- Optional_provider: IMetadataProvider
Returns Promise<NormalizedPermission[]>
Inherited from PermissionProviderBase.GetPermissionsGrantedByUser
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:179

GetPermissionsSharedWithUser

GetPermissionsSharedWithUser(
_grantee: UserInfo,
_provider?: IMetadataProvider,
): Promise<NormalizedPermission[]>
Default implementation returns [] — role-only providers have no "shared with me" concept. User-grantee providers should override this to return only permissions where grantee is the direct grantee AND someone else is the grantor/owner.
Parameters
- _grantee: UserInfo
- Optional_provider: IMetadataProvider
Returns Promise<NormalizedPermission[]>
Inherited from PermissionProviderBase.GetPermissionsSharedWithUser
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:185

GetResourcePermissions

GetResourcePermissions(
    resourceType: string,
    _resourceId: string,
    provider?: IMetadataProvider,
): Promise<NormalizedPermission[]>
Get all permissions granted on a specific resource across every grantee. Powers the Sharing Center's "Resource Access Report" view.
Parameters
- resourceType: string
- _resourceId: string
- Optionalprovider: IMetadataProvider
Returns Promise<NormalizedPermission[]>
Overrides PermissionProviderBase.GetResourcePermissions
- Defined in MJCoreEntities/src/custom/PermissionProviders/EntityPermissionProvider.ts:98

GetResourceTypes

GetResourceTypes(provider?: IMetadataProvider): string[]
Default implementation returns [] — providers should override to advertise their supported resource types (see IPermissionProvider.GetResourceTypes).
Parameters
- Optionalprovider: IMetadataProvider
Returns string[]
Overrides PermissionProviderBase.GetResourceTypes
- Defined in MJCoreEntities/src/custom/PermissionProviders/EntityPermissionProvider.ts:32

GetUserResources

GetUserResources(
    user: UserInfo,
    resourceType?: string,
    provider?: IMetadataProvider,
): Promise<NormalizedPermission[]>
Get all resources within this domain that the user has access to. Powers the Sharing Center's "User Access Report" view.
Parameters
- user: UserInfo
- OptionalresourceType: string
  Optional filter to one resource type within the domain.
- Optionalprovider: IMetadataProvider
Returns Promise<NormalizedPermission[]>
Overrides PermissionProviderBase.GetUserResources
- Defined in MJCoreEntities/src/custom/PermissionProviders/EntityPermissionProvider.ts:80

Class EntityPermissionProvider

Hierarchy (View Summary)

Index

Constructors

Properties

Methods

Constructors

constructor

Returns EntityPermissionProvider

Properties

ReadonlyDescription

ReadonlyDomainName

ReadonlySupportedActions

ReadonlySupportedGranteeTypes

ReadonlySupportsDeny

Methods

ProtectedboolsToActions

Parameters

Returns PermissionAction[]

Example

ProtectedbuildNormalizedPermission

Parameters

Returns NormalizedPermission

ProtectedbulkLookupNames

Parameters

Returns Promise<Map<string, string>>

CheckPermission

Parameters

Returns Promise<PermissionCheckResult>

ProtectedfetchRows

Type Parameters

Parameters

Returns Promise<T[]>

Example

GetEffectivePermissions

Parameters

Returns Promise<NormalizedPermission[]>

GetPermissionsGrantedByUser

Parameters

Returns Promise<NormalizedPermission[]>

GetPermissionsSharedWithUser

Parameters

Returns Promise<NormalizedPermission[]>

GetResourcePermissions

Parameters

Returns Promise<NormalizedPermission[]>

GetResourceTypes

Parameters

Returns string[]

GetUserResources

Parameters

Returns Promise<NormalizedPermission[]>

Settings

On This Page

`Readonly`Description

`Readonly`DomainName

`Readonly`SupportedActions

`Readonly`SupportedGranteeTypes

`Readonly`SupportsDeny

`Protected`boolsToActions

`Protected`buildNormalizedPermission

`Protected`bulkLookupNames

`Protected`fetchRows