/**
 * This file is part of the NocoBase (R) project.
 * Copyright (c) 2020-2024 NocoBase Co., Ltd.
 * Authors: NocoBase Team.
 *
 * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
 * For more information, please refer to: https://www.nocobase.com/agreement.
 */
import { Migration } from '@nocobase/server';
/**
 * Grant `trigger` / `triggerNew` action permissions for every role, mirroring the role's
 * existing `view` / `create` permissions.
 *
 * Background: The `trigger` action on collection resources was previously allowed for all
 * logged-in users via `acl.allow('*', ['trigger'], 'loggedIn')`. After that global bypass
 * was removed, `trigger` goes through normal ACL checks. Custom-action trigger is now
 * modelled as two ACL actions:
 *   - `trigger` — invoked on an existing record; follows `view` (with data scope).
 *   - `triggerNew` — invoked on a form that hasn't been persisted yet; follows `create`.
 *
 * 1. Per-data-source strategy (`dataSourcesRoles.strategy.actions`, an array):
 *    - `trigger` mirrors `view` (including scope suffix like `:own`). No `view` → no trigger.
 *    - `triggerNew` is added (unrestricted) if the strategy contains any `create*` entry.
 *      No `create` → no triggerNew. Scope suffixes on `create` are ignored because new-data
 *      actions have no data scope.
 *
 * 2. Specific resource configs (`dataSourcesRolesResources` with `usingActionsConfig: true`):
 *    - If the resource has a `view` action, create a matching `trigger` action that reuses
 *      the same `scopeId`. Skip if `trigger` already exists.
 *    - If the resource has a `create` action, create a matching `triggerNew` action
 *      (scopeId: null — new-data actions carry no scope). Skip if `triggerNew` already
 *      exists.
 *
 * This migration runs only during upgrades (appVersion < 2.0.40), not on fresh installs.
 */
export default class extends Migration {
    appVersion: string;
    on: string;
    up(): Promise<void>;
}