Class ResourcePermissionProvider

Wraps ResourcePermissionEngine.GetUserResourcePermissionLevel behind the unified PermissionProviderBase contract.

Resource permissions support both Users and Roles as grantees and use a hierarchical level model (View < Edit < Owner). The provider translates those levels into canonical action sets: View → [Read], Edit → [Read, Update], Owner → [Read, Update, Delete, Share, Admin].

resourceType is the human-readable name from the MJ: Resource Types entity (e.g., "User Views", "Reports"). resourceId is the target record ID.

Hierarchy (View Summary)

PermissionProviderBase
- ResourcePermissionProvider

Index

Constructors

constructor

new ResourcePermissionProvider(): ResourcePermissionProvider
Returns ResourcePermissionProvider
Inherited from PermissionProviderBase.constructor

Properties

`Readonly`Description

Description: "Generic resource sharing with User or Role grantees, hierarchical View/Edit/Owner levels, and status workflow" = 'Generic resource sharing with User or Role grantees, hierarchical View/Edit/Owner levels, and status workflow'

Human-readable description of what this provider covers.

`Readonly`DomainName

DomainName: "Resource Permissions" = 'Resource Permissions'

Opt-in marker read by ClassFactory (see ClassResolutionResult): this class CANNOT function standalone — every member below is abstract, so a base instance is a method-less stub. TypeScript's abstract is erased at runtime, so the factory cannot detect that on its own; without this marker an unresolvable ProviderClassName would silently be handed back as a live "provider" and blow up later at the first method call.

With the marker set, CreateInstance throws and TryCreateInstance returns {Resolved: false, Instance: null} — both of which PermissionEngine handles by skipping the domain.

`Readonly`SupportedActions

SupportedActions: PermissionAction[] = ...

What actions this provider can evaluate.

`Readonly`SupportedGranteeTypes

SupportedGranteeTypes: GranteeType[] = ...

What grantee types this provider supports.

`Readonly`SupportsDeny

SupportsDeny: false

Whether this provider supports explicit Deny records.

Methods

`Protected`boolsToActions

boolsToActions(
flags: Partial<Record<PermissionAction, boolean | null | undefined>>,
): PermissionAction[]
Map a { Read?: boolean, Update?: boolean, … } descriptor to a canonical PermissionAction[]. Replaces the 9 hand-rolled copies that each walked their row's CRUD-ish booleans and pushed action names.

Output order matches the canonical order declared in PermissionAction. Entries that are null/undefined/false are skipped.
Parameters
- flags: Partial<Record<PermissionAction, boolean | null | undefined>>
Returns PermissionAction[]
Example
```
const actions = this.boolsToActions({
    Read: row.CanRead,
    Update: row.CanEdit,       // domain-specific flag name
    Delete: row.CanDelete,
    Share: row.CanShare,
});
// → ['Read', 'Update', 'Delete', 'Share']  // in this order, where truthy
```
Inherited from PermissionProviderBase.boolsToActions
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:232

`Protected`buildNormalizedPermission

buildNormalizedPermission(
    args: {
        actions: PermissionAction[];
        effect?: "Allow" | "Deny";
        expiresAt?: Date;
        granteeId: string;
        granteeName?: string;
        granteeType: GranteeType;
        resourceId: string;
        resourceName?: string;
        resourceType: string;
        sourceRecordId?: string;
    },
): NormalizedPermission
Build a NormalizedPermission with DomainName and Effect pre-filled from the provider. Centralizes the ~10-field literal that used to be constructed in every GetUserResources / GetEffectivePermissions / GetResourcePermissions implementation.

Effect defaults to 'Allow' since the vast majority of providers don't support Deny. Providers that emit Deny records (EntityPermissionProvider) pass { effect: 'Deny' } explicitly.
Parameters
- args: {
      actions: PermissionAction[];
      effect?: "Allow" | "Deny";
      expiresAt?: Date;
      granteeId: string;
      granteeName?: string;
      granteeType: GranteeType;
      resourceId: string;
      resourceName?: string;
      resourceType: string;
      sourceRecordId?: string;
  }
Returns NormalizedPermission
Inherited from PermissionProviderBase.buildNormalizedPermission
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:201

`Protected`bulkLookupNames

bulkLookupNames(
    entityName: string,
    ids: string[],
    nameField?: string,
): Promise<Map<string, string>>
Given a list of IDs, fetch {ID, <nameField>} from entityName and return a Map<ID, name>. Used by providers whose domain views don't denormalize a resource name onto the permission row (AI Agents, Artifacts, Collections).

Returns an empty Map when ids is empty or the RunView fails — callers should treat a missing key as "name unknown."
Parameters
- entityName: string
- ids: string[]
- OptionalnameField: string
Returns Promise<Map<string, string>>
Inherited from PermissionProviderBase.bulkLookupNames
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:257

CheckPermission

CheckPermission(
    user: UserInfo,
    resourceType: string,
    resourceId: string,
    action: PermissionAction,
    _provider?: IMetadataProvider,
): Promise<PermissionCheckResult>
Check if a user has a specific permission on a specific resource.
Parameters
- user: UserInfo
  The user whose permissions are being checked (roles come from user.UserRoles).
- resourceType: string
  The resource type within this domain (e.g., entity name, resource type name).
- resourceId: string
  The specific resource ID; null for domain-wide checks.
- action: PermissionAction
  The action being requested.
- Optional_provider: IMetadataProvider
Returns Promise<PermissionCheckResult>
Overrides PermissionProviderBase.CheckPermission
- Defined in MJCoreEntities/src/custom/PermissionProviders/ResourcePermissionProvider.ts:43

`Protected`fetchRows

fetchRows<T>(
    entityName: string,
    extraFilter: string,
    fields: string[],
    methodName: string,
): Promise<T[]>
Standard RunView wrapper that logs failures with <ProviderClass>.<methodName>: prefix and returns the row list (or [] on failure). Replaces the boilerplate that each provider previously carried around its RunView calls.
Type Parameters
- T
Parameters
- entityName: string
- extraFilter: string
- fields: string[]
- methodName: string
Returns Promise<T[]>
Example
```
const rows = await this.fetchRows<MyRow>(
    'MJ: AI Agent Permissions',
    `AgentID='${agentId}'`,
    ['ID', 'AgentID', 'CanView', 'CanRun'],
    'fetchPermissionsForAgent'
);
```
Inherited from PermissionProviderBase.fetchRows
- Defined in MJCore/dist/generic/permissionInterfaces.d.ts:248

GetEffectivePermissions

GetEffectivePermissions(
    user: UserInfo,
    resourceType: string,
    resourceId: string,
    _provider?: IMetadataProvider,
): Promise<NormalizedPermission[]>
Get all effective permissions a user has on a specific resource. Returns an empty array when the user has no access.
Parameters
- user: UserInfo
- resourceType: string
- resourceId: string
- Optional_provider: IMetadataProvider
Returns Promise<NormalizedPermission[]>
Overrides PermissionProviderBase.GetEffectivePermissions
- Defined in MJCoreEntities/src/custom/PermissionProviders/ResourcePermissionProvider.ts:78

GetPermissionsGrantedByUser

GetPermissionsGrantedByUser(grantor: UserInfo): Promise<NormalizedPermission[]>
Rows granted directly by this user to other users. Uses the SharedByUserID column (added in migration V202604231235__v5.29.x__ResourcePermission_SharedByUserID.sql) so every resource type that writes through MJ: Resource Permissions surfaces correctly in the end-user Sharing Center's "Shared by me" tab.

Only Approved, User-grantee rows are returned — pending requests (Status === 'Requested') and Role grants don't belong in a personal sharing view.
Parameters
- grantor: UserInfo
Returns Promise<NormalizedPermission[]>
Overrides PermissionProviderBase.GetPermissionsGrantedByUser
- Defined in MJCoreEntities/src/custom/PermissionProviders/ResourcePermissionProvider.ts:162

GetPermissionsSharedWithUser

GetPermissionsSharedWithUser(grantee: UserInfo): Promise<NormalizedPermission[]>
Rows where this user is the direct grantee AND someone else is the grantor — the inverse of GetPermissionsGrantedByUser. Powers the Sharing Center's "Shared with me" tab for every resource type that writes through MJ: Resource Permissions (Conversations, Reports, User Views, etc.).

Only Approved, User-grantee rows are returned. Role-inherited access is intentionally excluded — a personal "Shared with me" view shouldn't surface org-wide role grants. Self-grants (user shared a resource with themselves) are also filtered out.
Parameters
- grantee: UserInfo
Returns Promise<NormalizedPermission[]>
Overrides PermissionProviderBase.GetPermissionsSharedWithUser
- Defined in MJCoreEntities/src/custom/PermissionProviders/ResourcePermissionProvider.ts:197

GetResourcePermissions

GetResourcePermissions(
    resourceType: string,
    resourceId: string,
    provider?: IMetadataProvider,
): Promise<NormalizedPermission[]>
Get all permissions granted on a specific resource across every grantee. Powers the Sharing Center's "Resource Access Report" view.
Parameters
- resourceType: string
- resourceId: string
- Optionalprovider: IMetadataProvider
Returns Promise<NormalizedPermission[]>
Overrides PermissionProviderBase.GetResourcePermissions
- Defined in MJCoreEntities/src/custom/PermissionProviders/ResourcePermissionProvider.ts:119

GetResourceTypes

GetResourceTypes(): string[]
Default implementation returns [] — providers should override to advertise their supported resource types (see IPermissionProvider.GetResourceTypes).

Returns string[]
Overrides PermissionProviderBase.GetResourceTypes
- Defined in MJCoreEntities/src/custom/PermissionProviders/ResourcePermissionProvider.ts:35

GetUserResources

GetUserResources(
    user: UserInfo,
    resourceType?: string,
    _provider?: IMetadataProvider,
): Promise<NormalizedPermission[]>
Get all resources within this domain that the user has access to. Powers the Sharing Center's "User Access Report" view.
Parameters
- user: UserInfo
- OptionalresourceType: string
  Optional filter to one resource type within the domain.
- Optional_provider: IMetadataProvider
Returns Promise<NormalizedPermission[]>
Overrides PermissionProviderBase.GetUserResources
- Defined in MJCoreEntities/src/custom/PermissionProviders/ResourcePermissionProvider.ts:92

Class ResourcePermissionProvider

Hierarchy (View Summary)

Index

Constructors

Properties

Methods

Constructors

constructor

Returns ResourcePermissionProvider

Properties

ReadonlyDescription

ReadonlyDomainName

ReadonlySupportedActions

ReadonlySupportedGranteeTypes

ReadonlySupportsDeny

Methods

ProtectedboolsToActions

Parameters

Returns PermissionAction[]

Example

ProtectedbuildNormalizedPermission

Parameters

Returns NormalizedPermission

ProtectedbulkLookupNames

Parameters

Returns Promise<Map<string, string>>

CheckPermission

Parameters

Returns Promise<PermissionCheckResult>

ProtectedfetchRows

Type Parameters

Parameters

Returns Promise<T[]>

Example

GetEffectivePermissions

Parameters

Returns Promise<NormalizedPermission[]>

GetPermissionsGrantedByUser

Parameters

Returns Promise<NormalizedPermission[]>

GetPermissionsSharedWithUser

Parameters

Returns Promise<NormalizedPermission[]>

GetResourcePermissions

Parameters

Returns Promise<NormalizedPermission[]>

GetResourceTypes

Returns string[]

GetUserResources

Parameters

Returns Promise<NormalizedPermission[]>

Settings

On This Page

`Readonly`Description

`Readonly`DomainName

`Readonly`SupportedActions

`Readonly`SupportedGranteeTypes

`Readonly`SupportsDeny

`Protected`boolsToActions

`Protected`buildNormalizedPermission

`Protected`bulkLookupNames

`Protected`fetchRows