{
  "name": "W3 - Expiry Sync (AList Role Reconciliation)",
  "nodes": [
    {
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "minutes",
              "minutesInterval": 5
            }
          ]
        }
      },
      "id": "trigger-schedule",
      "name": "Every 5 minutes",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.2,
      "position": [
        0,
        0
      ]
    },
    {
      "parameters": {
        "jsCode": "// ============================================================================\n// W3 runtime body — 5-min expiry sweep / full reconciliation.\n// Rebuilt by `node n8n/gen_w3.js` (single source of truth = shared/effective-grants.js).\n// dryRun: W3_DRY_RUN=true -> only print the plan (no writes).\n// autoDisable: ALIST_AUTO_DISABLE_ON_EXPIRE=true -> disable AList user when a\n//              previously-scoped customer's desired set becomes empty. Default off.\n// ============================================================================\n// ============================================================================\n// SHARED: calculateEffectiveGrants — single source of truth for \"what scopes\n// should customer X have right now\", reused by W1 (active resume), W2\n// (CustomerProduct sync) and W3 (expiry sweep).\n//\n// This file is INLINED into each workflow's Code node at build time (see\n// gen_w1.js / gen_w2.js / gen_w3.js). It must therefore be self-contained:\n// no require/import, no process.exit, no top-level return outside functions.\n//\n// Config is read via $env (the ONLY reliable channel in n8n Code nodes for\n// custom env vars — process.env is unreliable there). The caller passes a\n// `ctx` with { $env, helpers } so this file is also unit-testable outside n8n.\n//\n// ============================================================================\n\n// --- helpers (depend on ctx, so they are functions not top-level consts) ---\n\nfunction ncUrl(ctx, path) {\n  return ctx.$env.NOCODB_URL + path;\n}\n\nasync function ncGet(ctx, path) {\n  return await ctx.helpers.httpRequest({\n    method: 'GET',\n    url: ncUrl(ctx, path),\n    headers: { 'xc-token': ctx.$env.NOCODB_TOKEN },\n    json: true,\n  });\n}\n\nasync function alistReq(ctx, method, path, body, token) {\n  // NOTE: AList expects the RAW token in Authorization (no \"Bearer \" prefix).\n  return await ctx.helpers.httpRequest({\n    method,\n    url: ctx.$env.ALIST_URL + path,\n    headers: token ? { Authorization: token } : {},\n    body,\n    json: true,\n  });\n}\n\n// NocoDB LinkToAnotherRecord values are objects/arrays/numbers depending on\n// whether the API was asked to expand them. Normalise to a single id or null.\nfunction linkId(v) {\n  if (v == null) return null;\n  if (typeof v === 'object' && !Array.isArray(v)) return v.Id ?? v.id ?? null;\n  if (Array.isArray(v)) return v[0]?.Id ?? v[0]?.id ?? null;\n  return v;\n}\n\n// --- core algorithm --------------------------------------------------------\n//\n// desired scopes for a customer = union of:\n//   (a) every RESOURCE reachable from an ACTIVE, NOT-YET-EXPIRED CustomerProduct\n//   (b) every RESOURCE granted directly via an ACTIVE, NOT-YET-EXPIRED AccessGrant\n//\n// For (a) the SAME resource coming from MULTIPLE products keeps the MAX\n// expires_at, exactly matching the \"two products share a resource\" semantics\n// the user tested. Expiry boundary is `<= today` (expiring today is expired).\n\nasync function calculateEffectiveGrants(ctx, customerId) {\n  const T_CUST = ctx.$env.NOCODB_TABLE_CUSTOMERS;\n  const T_CUSTPROD = ctx.$env.NOCODB_TABLE_CUSTOMERPRODUCTS;\n  const T_PROD = ctx.$env.NOCODB_TABLE_PRODUCTS;\n  const T_RES = ctx.$env.NOCODB_TABLE_RESOURCES;\n  const T_GRANT = ctx.$env.NOCODB_TABLE_ACCESSGRANTS;\n  const LNK_PROD_RES = ctx.$env.NOCODB_LINK_PROD_RESOURCES; // c4ko4x8kwi16swg\n  const today = new Date().toISOString().slice(0, 10); // 'YYYY-MM-DD'\n\n  // index all Resources by Id -> alist_path (cheap, one query)\n  const allRes = (await ncGet(ctx, `/api/v2/tables/${T_RES}/records?limit=10000`)).list || [];\n  const resPath = {};\n  allRes.forEach(r => { resPath[r.Id] = r.alist_path; });\n\n  const desired = {}; // path -> { expires, permission }\n\n  // (a) CustomerProducts -> Resources (via product M2M link), MAX expiry on\n  //     the same path.\n  //     NOTE: `(customer,eq,N)` matches the link field's DISPLAY NAME and always\n  //     returns 0 rows. Must use the `customer.Id` sub-field syntax (or the\n  //     foreign-key column `nc_jitu___Customers_id`).\n  const cps = (await ncGet(ctx, `/api/v2/tables/${T_CUSTPROD}/records?where=(customer.Id,eq,${customerId})&limit=1000`)).list || [];\n  for (const c of cps) {\n    if (c.status && c.status !== 'active') continue;\n    if (c.expires_at && String(c.expires_at) <= today) continue; // expired (incl. today)\n    const pid = linkId(c.product);\n    if (!pid) continue;\n    const res = (await ncGet(ctx, `/api/v2/tables/${T_PROD}/links/${LNK_PROD_RES}/records/${pid}`)).list || [];\n    const exp = c.expires_at; // 'YYYY-MM-DD' (may be null = no expiry)\n    for (const r of res) {\n      const p = resPath[r.Id];\n      if (!p) continue;\n      const cur = desired[p];\n      if (!cur || !cur.expires || (exp && exp > cur.expires)) {\n        desired[p] = { expires: exp || null, permission: cur?.permission ?? 0 };\n      }\n    }\n  }\n\n  // (b) AccessGrants -> Resources (manual / materialised direct grants)\n  const grants = (await ncGet(ctx, `/api/v2/tables/${T_GRANT}/records?where=(customer.Id,eq,${customerId})&limit=1000`)).list || [];\n  for (const g of grants) {\n    if (g.status && g.status !== 'active') continue;\n    if (g.expires_at && String(g.expires_at) <= today) continue;\n    const p = resPath[linkId(g.resource)];\n    if (!p) continue;\n    const exp = g.expires_at;\n    const cur = desired[p];\n    if (!cur || !cur.expires || (exp && exp > cur.expires)) {\n      desired[p] = { expires: exp || null, permission: g.permission === 'readwrite' ? 1 : 0 };\n    }\n  }\n\n  const desiredPaths = Object.keys(desired).sort();\n  return {\n    customerId,\n    desired,             // { path: {expires, permission} }\n    desiredPaths,        // sorted array of paths\n    newScopes: desiredPaths.map(p => ({ path: p, permission: desired[p].permission })),\n  };\n}\n\n// --- export shim: kept only when unit-tested, stripped when inlined -------\n// ============================================================================\n\nconst ctx = { $env, helpers: this.helpers };\nconst DRY_RUN = ($env.W3_DRY_RUN || '').toLowerCase() === 'true';\nconst AUTO_DISABLE = ($env.ALIST_AUTO_DISABLE_ON_EXPIRE || '').toLowerCase() === 'true';\nconst T_CUST = $env.NOCODB_TABLE_CUSTOMERS;\n\n// admin login once for the whole sweep\nconst login = await alistReq(ctx, 'POST', '/api/auth/login', {\n  username: $env.ALIST_ADMIN_USERNAME,\n  password: $env.ALIST_ADMIN_PASSWORD,\n}, null);\nconst token = login?.data?.token;\nif (!token) throw new Error('AList login failed');\n\nconst customers = (await ncGet(ctx, `/api/v2/tables/${T_CUST}/records?limit=10000`)).list || [];\nconst changed = [], errors = [];\n\nfor (const cust of customers) {\n  try {\n    if (!cust.alist_role_id) continue; // not provisioned yet\n    const cid = cust.Id;\n\n    // desired scopes via shared algorithm\n    const g = await calculateEffectiveGrants(ctx, cid);\n    const desiredPaths = g.desiredPaths;\n\n    // current scopes from AList\n    const role = await alistReq(ctx, 'GET', `/api/admin/role/get?id=${cust.alist_role_id}`, null, token);\n    const currentPaths = (role?.data?.permission_scopes || []).map(s => s.path);\n    const toAdd = desiredPaths.filter(p => !currentPaths.includes(p));\n    const toRemove = currentPaths.filter(p => !desiredPaths.includes(p));\n    const scopesChanged = toAdd.length > 0 || toRemove.length > 0;\n    const nowEmpty = desiredPaths.length === 0;\n\n    // only disable when a customer that HAD scopes now has none (guard\n    // currentPaths>0 avoids killing a fresh customer with an empty role).\n    const shouldDisable = AUTO_DISABLE && nowEmpty && cust.status === 'active' && currentPaths.length > 0;\n\n    const applied = [];\n    if (scopesChanged) {\n      if (!DRY_RUN) await alistReq(ctx, 'POST', '/api/admin/role/update', {\n        id: cust.alist_role_id,\n        name: role?.data?.name,\n        description: role?.data?.description,\n        permission_scopes: g.newScopes,\n      }, token);\n      applied.push('role_scopes');\n    }\n    if (shouldDisable) {\n      if (!DRY_RUN && cust.alist_user_id)\n        await alistReq(ctx, 'POST', '/api/admin/user/update', { id: cust.alist_user_id, disabled: true }, token);\n      applied.push('disable');\n    }\n    if (applied.length) {\n      changed.push({\n        customerId: cid, username: cust.username, roleId: cust.alist_role_id,\n        toAdd, toRemove, desiredPaths, applied,\n      });\n    }\n  } catch (e) {\n    errors.push({ customerId: cust.Id, username: cust.username, error: e.message });\n  }\n}\n\nreturn { json: {\n  dryRun: DRY_RUN, autoDisable: AUTO_DISABLE, at: new Date().toISOString(),\n  customersScanned: customers.length, customersChanged: changed.length,\n  changed, errors,\n} };\n"
      },
      "id": "reconcile",
      "name": "Reconcile & Apply (Expiry Sweep)",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        220,
        0
      ]
    }
  ],
  "connections": {
    "Every 5 minutes": {
      "main": [
        [
          {
            "node": "Reconcile & Apply (Expiry Sweep)",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  },
  "settings": {
    "executionOrder": "v1"
  },
  "pinData": {}
}