Static ReadonlyAuthorizesTrue when the action authorizes its caller itself, so a public entry point such as the
RunAction mutation may run it for an authenticated user without an MJ: Action Authorizations link. Set it only on an action that either checks an authorization the caller
must hold, or reads and writes only with the caller's own permissions. Leave it false for an
action that acts with more authority than its caller, or that reaches data or sends messages
the caller chooses but could not otherwise reach.
The engine reads the marker only from the class that runs, never from its parent classes. A subclass that overrides a marked action must declare the marker again.
ProtectedAccountWhat this action does to the account it names, which is what the account gate checks: Read (list, download,
search, inspect) unless a subclass overrides it with Write (upload, copy, move, delete, create a directory).
Whether this action can bound what it returns to an audience (RunActionParams.Audience): everyone
besides the caller who will see its output, such as the other participants of a shared conversation.
false by default, and the engine enforces it: when a run's audience adds a reader beyond the caller,
ActionEngineServer.RunAction refuses the action with result code AUDIENCE_UNSUPPORTED, without running
it. Override to return true only when the action honours the audience in full — every record, snippet
and count it returns is something every reader may see (pass the audience to the search engine, check each
reader's entitlement to anything it scopes by, and leave out aggregates computed before that filtering).
ProtectedAccessThe failed result for a refusal by the storage gate.
ProtectedaddHelper to add output parameter
ProtectedCheckThe tracked-file rule: null when the caller may read every MJ: Files row that tracks any of objectKeys in
account (canonicalized by driver), else the ACCESS_DENIED result to return. Apply it to every object an action
returns content or a URL for, and to every object it overwrites, moves or deletes. Empty keys are ignored.
ProtectedcreateProtectedcreateHelper to create success result
Optionalparams: RunActionParamsProtectedgetGet boolean parameter value with default
ProtectedgetResolves the StorageAccount parameter to an account and its driver, gated for AccountAccess.
Action parameters containing StorageAccount
The account and driver, or the failed result to return
ProtectedgetGet numeric parameter value with default
ProtectedgetExtract parameter value by name (case-insensitive)
ProtectedgetGet storage account entity by name using cached metadata.
Name of the storage account
MJFileStorageAccountEntity or null if not found
ProtectedgetGet storage provider entity by ID using cached metadata.
ID of the storage provider
MJFileStorageProviderEntity or null if not found
ProtectedgetGet string parameter value (guaranteed to be string or undefined)
ProtectedgetGet string parameter value with default
ProtectedinitializeInitialize storage driver using the enterprise credential model via FileStorageEngine. No permission check — call it only for an account the caller has passed the gate for (ResolveAccountTarget).
MJFileStorageAccountEntity to initialize
User context for credential access
Initialized FileStorageBase driver
ProtectedInternalMove/rename a file object
The action parameters:
Operation result with:
ProtectedResolveResolves a storage account by name and returns it with an initialized driver — only when contextUser may use it
for access (StorageAccessEvaluator, evaluated per call). An unknown account name and a refused account return
the identical ACCESS_DENIED result, and neither builds a driver.
Executes the action with the provided parameters.
The action execution parameters including context
Promise resolving to the action result
ProtectedUnreadableThe subset of objectKeys that back an MJ: Files row the caller may not read — what a listing or a search drops
so it never names a tracked object the caller is refused.
Action for moving/renaming a file object within a storage provider.
Example