cleanup

Bumps [tar](https://github.com/npm/node-tar) from 6.1.2 to 6.1.9.
- [Release notes](https://github.com/npm/node-tar/releases)
- [Changelog](https://github.com/npm/node-tar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/npm/node-tar/compare/v6.1.2...v6.1.9)

---
updated-dependencies:
- dependency-name: tar
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,30 @@
+---
+name: Bug report
+about: Create a bug report
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. ...
+2. ...
+3. ...
+...
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**EspoCRM version**
+Specify the EspoCRM version (or versions) on which the bug occurs.
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,4 @@
+contact_links:
+  - name: EspoCRM forum
+    url: https://forum.espocrm.com/
+    about: Please use our forum to ask questions not related to product development

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for EspoCRM
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is.
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.gitignore

@@ -4,6 +4,7 @@
 /data/preferences/*
 /data/.backup/*
 /data/config.php
+/data/config-internal.php
 /data/tmp/*
 /build
 /node_modules
@@ -18,4 +19,7 @@
 /composer.phar
 /vendor/
 /custom/Espo/Custom/*
+/custom/Espo/Modules/*
+!/custom/Espo/Custom/.htaccess
+!/custom/Espo/Modules/.htaccess
 /install/config.php

.htaccess

@@ -1,24 +1,44 @@
 <ifModule mod_headers.c>
-  Header always set Access-Control-Allow-Methods "POST, GET, PUT, PATCH, DELETE"
+    Header always set Access-Control-Allow-Methods "POST, GET, PUT, PATCH, DELETE"
 </ifModule>
 
-DirectoryIndex index.php index.html
+DirectoryIndex index.php
+
+Options -Indexes
 
 <IfModule mod_rewrite.c>
-  RewriteEngine On
+    RewriteEngine On
 
-  # PROTECTED DIRECTORIES
-  RewriteCond %{REQUEST_FILENAME} -d
-  RewriteRule ^/?(api|client)/ - [F]
+    # Forbid access. Not actual as redirect to `public` is applied.
+    # An extra security measure if redirect not fired.
+    RewriteRule ^/?data/ - [F]
+    RewriteRule ^/?application/ - [F]
+    RewriteRule ^/?custom/ - [F]
+    RewriteRule ^/?vendor/ - [F]
+    RewriteRule /?web\.config - [F]
 
-  RewriteRule ^/?data/ - [F]
-  RewriteRule ^/?application/ - [F]
-  RewriteRule ^/?custom/ - [F]
-  RewriteRule ^/?vendor/ - [F]
-  RewriteRule ^/?client/?$ - [F]
-  #END PROTECTED DIRECTORIES
+    # Forbid `public` dir.
+    RewriteCond %{ENV:REDIRECT_STATUS} !=200
+    RewriteRule ^/?public/? - [F,L]
 
-  RewriteRule .* - [E=HTTP_ESPO_CGI_AUTH:%{HTTP:Authorization}]
+    # Skip redirect for `client` dir.
+    RewriteRule ^client/ - [L]
 
-  RewriteRule /?web\.config - [F]
-</IfModule>
+# {#dev}
+    # Skip redirect for `node_modules` dir. Actual only for dev environment.
+    RewriteRule ^node_modules/ - [L]
+# {/dev}
+
+    # Store base path.
+    RewriteCond %{REQUEST_URI}::$1 ^(.*?/)(.*)::\2$
+    RewriteRule ^(.*)$ - [E=BASE:%1]
+
+    # Add trailing slash.
+    RewriteCond %{DOCUMENT_ROOT}/%{ENV:BASE}/public/$1 -d
+    RewriteRule ^(.*?[^/])$ %{REQUEST_URI}/ [L,R=301,NE]
+
+    # Rewrite to `public` dir.
+    RewriteRule ^((?!public/).*)$ %{ENV:BASE}/public/$1 [L,NC]
+
+    RewriteRule .* - [E=HTTP_ESPO_CGI_AUTH:%{HTTP:Authorization}]
+</IfModule>

Gruntfile.js

@@ -19,113 +19,67 @@
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
  ************************************************************************/
 
- /**
-  * * `grunt` - full build
-  * * `grunt dev` - build only items needed for development (takes less time)
-  * * `grunt offline` - build but skip *composer install*
-  * * `grant release` - full build plus upgrade packages`
-  * * `grant test` - build for test running
-  * * `grant run-tests` - build and run unit and integratino tests
-  */
+/**
+* * `grunt` - full build
+* * `grunt dev` - build only items needed for development (takes less time)
+* * `grunt offline` - build but skip *composer install*
+* * `grant release` - full build plus upgrade packages`
+* * `grant test` - build for tests running
+* * `grant run-tests` - build and run unit and integration tests
+*/
 
-module.exports = function (grunt) {
+const fs = require('fs');
+const cp = require('child_process');
+const path = require('path');
 
-    var jsFilesToMinify = [
-        'client/lib/jquery-2.1.4.min.js',
-        'client/lib/underscore-min.js',
-        'client/lib/es6-promise.min.js',
-        'client/lib/backbone-min.js',
-        'client/lib/handlebars.js',
-        'client/lib/base64.js',
-        'client/lib/jquery-ui.min.js',
-        'client/lib/jquery.ui.touch-punch.min.js',
-        'client/lib/moment.min.js',
-        'client/lib/moment-timezone.min.js',
-        'client/lib/moment-timezone-data.js',
-        'client/lib/jquery.timepicker.min.js',
-        'client/lib/jquery.autocomplete.js',
-        'client/lib/bootstrap.min.js',
-        'client/lib/bootstrap-datepicker.js',
-        'client/lib/bull.js',
-        'client/lib/marked.min.js',
-        'client/lib/autobahn.js',
-        'client/lib/gridstack.all.js',
+module.exports = grunt => {
 
-        'client/src/namespace.js',
-        'client/src/exceptions.js',
-        'client/src/loader.js',
-        'client/src/utils.js',
+    const pkg = grunt.file.readJSON('package.json');
+    const bundleConfig = require('./frontend/bundle-config.json');
 
-        'client/src/acl.js',
-        'client/src/model.js',
-        'client/src/model-offline.js',
-        'client/src/ajax.js',
-        'client/src/controller.js',
+    let jsFilesToBundle = getBundleLibList().concat(bundleConfig.jsFiles);
+    let jsFilesToCopy = getCopyLibDataList();
 
-        'client/src/ui.js',
-        'client/src/acl-manager.js',
-        'client/src/cache.js',
-        'client/src/storage.js',
-        'client/src/models/settings.js',
-        'client/src/language.js',
-        'client/src/metadata.js',
-        'client/src/field-manager.js',
-        'client/src/models/user.js',
-        'client/src/models/preferences.js',
-        'client/src/model-factory.js',
-        'client/src/collection-factory.js',
-        'client/src/pre-loader.js',
-        'client/src/controllers/base.js',
-        'client/src/router.js',
-        'client/src/date-time.js',
-        'client/src/layout-manager.js',
-        'client/src/theme-manager.js',
-        'client/src/session-storage.js',
-        'client/src/view-helper.js',
-        'client/src/page-title.js',
+    let libFilesToMinify = jsFilesToCopy
+        .filter(item => item.minify)
+        .reduce((map, item) => (
+            map[item.dest] = item.dest,
+            map
+        ), {});
 
-        'client/src/app.js'
-    ];
+    let currentPath = path.dirname(fs.realpathSync(__filename));
 
-    function camelCaseToHyphen (string){
-        if (string == null) {
-            return string;
-        }
-        return string.replace(/([a-z])([A-Z])/g, '$1-$2').toLowerCase();
-    }
+    let themeList = [];
 
-    var fs = require('fs');
-    var cp = require('child_process');
-    var path = require('path');
-
-    var currentPath = path.dirname(fs.realpathSync(__filename));
-
-    var themeList = [];
-    fs.readdirSync('application/Espo/Resources/metadata/themes').forEach(function (file) {
+    fs.readdirSync('application/Espo/Resources/metadata/themes').forEach(file => {
         themeList.push(file.substr(0, file.length - 5));
     });
 
-    var cssminFilesData = {};
-    var lessData = {};
-    themeList.forEach(function (theme) {
-        var name = camelCaseToHyphen(theme);
-        var files = {};
+    let cssminFilesData = {};
+
+    let lessData = {};
+
+    themeList.forEach(theme => {
+        let name = camelCaseToHyphen(theme);
+
+        let files = {};
+
         files['client/css/espo/'+name+'.css'] = 'frontend/less/'+name+'/main.less';
         files['client/css/espo/'+name+'-iframe.css'] = 'frontend/less/'+name+'/iframe/main.less';
 
         cssminFilesData['client/css/espo/'+name+'.css'] = 'client/css/espo/'+name+'.css';
         cssminFilesData['client/css/espo/'+name+'-iframe.css'] = 'client/css/espo/'+name+'-iframe.css';
-        var o = {
+
+        let o = {
             options: {
                 yuicompress: true,
             },
-            files: files
+            files: files,
         };
+
         lessData[theme] = o;
     });
 
-    var pkg = grunt.file.readJSON('package.json');
-
     grunt.initConfig({
         pkg: pkg,
 
@@ -135,11 +89,11 @@ module.exports = function (grunt) {
                     mode: 0755,
                     create: [
                         'build/tmp',
-                    ]
-                },
-
+                    ],
+                }
             }
         },
+
         clean: {
             start: ['build/EspoCRM-*'],
             final: ['build/tmp'],
@@ -147,27 +101,48 @@ module.exports = function (grunt) {
             beforeFinal: {
                 src: [
                     'build/tmp/custom/Espo/Custom/*',
+                    'build/tmp/custom/Espo/Modules/*',
                     '!build/tmp/custom/Espo/Custom/.htaccess',
+                    '!build/tmp/custom/Espo/Modules/.htaccess',
                     'build/tmp/install/config.php',
+                    'build/tmp/vendor/*/*/.git',
+                    'build/tmp/custom/Espo/Custom/*',
+                    'build/tmp/client/custom/*',
+                    '!build/tmp/client/custom/modules',
+                    'build/tmp/client/custom/modules/*',
                 ]
             }
         },
+
         less: lessData,
+
         cssmin: {
             themes: {
-                files: cssminFilesData
-            }
+                files: cssminFilesData,
+            },
         },
+
         uglify: {
             options: {
-                mangle: false,
+                mangle: true,
                 sourceMap: true,
-                banner: '/*! <%= pkg.name %> <%= grunt.template.today("yyyy-mm-dd") %> */\n',
+                output: {
+                    comments: /^!/,
+                },
+            },
+            bundle: {
+                options: {
+                    banner: '/*! <%= pkg.name %> <%= grunt.template.today("yyyy-mm-dd") %> */\n',
+                },
+                files: {
+                    'build/tmp/client/espo.min.js': jsFilesToBundle,
+                },
+            },
+            lib: {
+                files: libFilesToMinify,
             },
-            'build/tmp/client/espo.min.js': jsFilesToMinify.map(function (item) {
-                return '' + item;
-            })
         },
+
         copy: {
             options: {
                 mode: true,
@@ -184,11 +159,14 @@ module.exports = function (grunt) {
                     'img/**',
                     'css/**',
                     'sounds/**',
-                    'custom/**'
+                    'custom/**',
                 ],
                 dest: 'build/tmp/client',
             },
             frontendLib: {
+                files: jsFilesToCopy,
+            },
+            frontendCommitedLib: {
                 expand: true,
                 dot: true,
                 cwd: 'client/lib',
@@ -199,14 +177,14 @@ module.exports = function (grunt) {
                 expand: true,
                 dot: true,
                 src: [
-                    'api/**',
                     'application/**',
                     'custom/**',
                     'data/.data',
-                    'install/**',
-                    'portal/**',
                     'vendor/**',
                     'html/**',
+                    'public/**',
+                    'install/**',
+                    'bin/**',
                     'bootstrap.php',
                     'cron.php',
                     'daemon.php',
@@ -217,7 +195,6 @@ module.exports = function (grunt) {
                     'extension.php',
                     'websocket.php',
                     'command.php',
-                    'oauth-callback.php',
                     'index.php',
                     'LICENSE.txt',
                     '.htaccess',
@@ -233,6 +210,7 @@ module.exports = function (grunt) {
                 dest: 'build/EspoCRM-<%= pkg.version %>/',
             },
         },
+
         chmod: {
             php: {
                 options: {
@@ -248,20 +226,20 @@ module.exports = function (grunt) {
                     'build/EspoCRM-<%= pkg.version %>/client/**/*.tpl',
                     'build/EspoCRM-<%= pkg.version %>/**/*.html',
                     'build/EspoCRM-<%= pkg.version %>/**/*.txt',
-                ]
+                ],
             },
             folders: {
                 options: {
                     mode: '755'
                 },
                 src: [
-                    'build/EspoCRM-<%= pkg.version %>/install',
-                    'build/EspoCRM-<%= pkg.version %>/portal',
-                    'build/EspoCRM-<%= pkg.version %>/api',
-                    'build/EspoCRM-<%= pkg.version %>/api/v1',
-                    'build/EspoCRM-<%= pkg.version %>/api/v1/portal-access',
+                    'build/EspoCRM-<%= pkg.version %>/public/install',
+                    'build/EspoCRM-<%= pkg.version %>/public/portal',
+                    'build/EspoCRM-<%= pkg.version %>/public/api',
+                    'build/EspoCRM-<%= pkg.version %>/public/api/v1',
+                    'build/EspoCRM-<%= pkg.version %>/public/api/v1/portal-access',
                     'build/EspoCRM-<%= pkg.version %>',
-                ]
+                ],
             },
             foldersWritable: {
                 options: {
@@ -277,83 +255,125 @@ module.exports = function (grunt) {
                     'build/EspoCRM-<%= pkg.version %>/application/Espo/Modules',
                 ]
             },
+            executable: {
+                options: {
+                    mode: '754'
+                },
+                src: [
+                    'build/EspoCRM-<%= pkg.version %>/bin/*',
+                ],
+            },
         },
+
         replace: {
             version: {
                 options: {
                     patterns: [
                         {
                             match: 'version',
-                            replacement: '<%= pkg.version %>'
+                            replacement: '<%= pkg.version %>',
                         }
                     ]
                 },
                 files: [
                     {
                         src: 'build/tmp/application/Espo/Resources/defaults/config.php',
-                        dest: 'build/tmp/application/Espo/Resources/defaults/config.php'
+                        dest: 'build/tmp/application/Espo/Resources/defaults/config.php',
                     }
-                ]
-            }
+                ],
+            },
+            dev: {
+                options: {
+                    patterns: [
+                        {
+                            match: /\# \{\#dev\}(.*)\{\/dev\}/gs,
+                            replacement: '',
+                        }
+                    ]
+                },
+                files: [
+                    {
+                        src: 'build/tmp/.htaccess',
+                        dest: 'build/tmp/.htaccess',
+                    }
+                ],
+            },
         },
+
     });
 
-    grunt.registerTask("chmod-folders", function() {
-        cp.execSync("find . -type d -exec chmod 755 {} + ", {stdio: 'ignore', cwd: 'build/EspoCRM-' + pkg.version});
+    grunt.registerTask('chmod-folders', () => {
+        cp.execSync(
+            "find . -type d -exec chmod 755 {} + ",
+            {
+                stdio: 'ignore',
+                cwd: 'build/EspoCRM-' + pkg.version,
+            }
+        );
     });
 
-    grunt.registerTask("composer", function() {
-        cp.execSync("composer install --ignore-platform-reqs --no-dev", {stdio: 'ignore'});
+    grunt.registerTask('composer-install', () => {
+        cp.execSync("composer install --no-dev", {stdio: 'ignore'});
     });
 
-    grunt.registerTask("composer-dev", function() {
-        cp.execSync("composer install --ignore-platform-reqs", {stdio: 'ignore'});
+    grunt.registerTask('composer-install-dev', () => {
+        cp.execSync("composer install", {stdio: 'ignore'});
     });
 
-    grunt.registerTask("upgrade", function() {
+    grunt.registerTask('upgrade', () => {
         cp.execSync("node diff --all --vendor", {stdio: 'inherit'});
     });
 
-    grunt.registerTask("unit-tests-run", function() {
+    grunt.registerTask('unit-tests-run', () => {
         cp.execSync("vendor/bin/phpunit ./tests/unit", {stdio: 'inherit'});
     });
 
-    grunt.registerTask("integration-tests-run", function() {
+    grunt.registerTask('integration-tests-run', () => {
         cp.execSync("vendor/bin/phpunit ./tests/integration", {stdio: 'inherit'});
     });
 
-    grunt.registerTask("zip", function() {
-        var fs = require('fs');
+    grunt.registerTask('zip', () => {
+        const archiver = require('archiver');
 
-        var resolve = this.async();
+        let resolve = this.async();
 
-        var folder = 'EspoCRM-' + pkg.version;
+        let folder = 'EspoCRM-' + pkg.version;
 
-        var zipPath = 'build/' + folder +'.zip';
-        if (fs.existsSync(zipPath)) fs.unlinkSync(zipPath);
+        let zipPath = 'build/' + folder +'.zip';
 
-        var archiver = require('archiver');
-        var archive = archiver('zip');
+        if (fs.existsSync(zipPath)) {
+            fs.unlinkSync(zipPath);
+        }
 
-        archive.on('error', function (err) {
+        let archive = archiver('zip');
+
+        archive.on('error', err => {
             grunt.fail.warn(err);
         });
-        var zipOutput = fs.createWriteStream(zipPath);
-        zipOutput.on('close', function () {
+
+        let zipOutput = fs.createWriteStream(zipPath);
+
+        zipOutput.on('close', () => {
             console.log("EspoCRM package has been built.");
+
             resolve();
         });
 
-        archive.directory(currentPath + '/build/' + folder, folder).pipe(zipOutput);
+        archive
+            .directory(currentPath + '/build/' + folder, folder)
+            .pipe(zipOutput)
+            .finalize();
+    });
 
-        archive.finalize();
+    grunt.registerTask('npm-install', () => {
+        cp.execSync("npm install", {stdio: 'ignore'});
     });
 
     grunt.loadNpmTasks('grunt-contrib-clean');
     grunt.loadNpmTasks('grunt-mkdir');
     grunt.loadNpmTasks('grunt-contrib-less');
     grunt.loadNpmTasks('grunt-contrib-cssmin');
-    grunt.loadNpmTasks('grunt-contrib-uglify');
+    grunt.loadNpmTasks('grunt-contrib-uglify-es');
     grunt.loadNpmTasks('grunt-contrib-copy');
     grunt.loadNpmTasks('grunt-replace');
     grunt.loadNpmTasks('grunt-chmod');
@@ -363,10 +383,12 @@ module.exports = function (grunt) {
         'mkdir:tmp',
         'less',
         'cssmin',
-        'uglify',
+        'uglify:bundle',
         'copy:frontendFolders',
         'copy:frontendLib',
+        'copy:frontendCommitedLib',
         'copy:backend',
+        'uglify:lib',
         'replace',
         'clean:beforeFinal',
         'copy:final',
@@ -374,16 +396,22 @@ module.exports = function (grunt) {
         'chmod:php',
         'chmod:folders',
         'chmod:foldersWritable',
+        'chmod:executable',
         'clean:final',
     ]);
 
-    grunt.registerTask('default', [
-        'composer',
+    grunt.registerTask('build', [
+        'composer-install',
+        'npm-install',
         'offline',
     ]);
 
+    grunt.registerTask('default', [
+        'build',
+    ]);
+
     grunt.registerTask('release', [
-        'default',
+        'build',
         'upgrade',
         'zip',
         'clean:release',
@@ -396,7 +424,7 @@ module.exports = function (grunt) {
     ]);
 
     grunt.registerTask('run-unit-tests', [
-        'composer-dev',
+        'composer-install-dev',
         'unit-tests-run',
     ]);
 
@@ -406,12 +434,87 @@ module.exports = function (grunt) {
     ]);
 
     grunt.registerTask('dev', [
-        'composer-dev',
+        'composer-install-dev',
         'less',
     ]);
 
     grunt.registerTask('test', [
-        'composer-dev',
+        'composer-install-dev',
+        'npm-install',
         'offline',
     ]);
 };
+
+function getBundleLibList() {
+    const libs = require('./frontend/libs.json');
+
+    let list = [];
+
+    libs.forEach(item => {
+        if (!item.bundle) {
+            return;
+        }
+
+        if (item.files) {
+            item.files.forEach(item  => {
+                list.push(item.src);
+            });
+
+            return;
+        }
+
+        if (!item.src) {
+            throw new Error("No lib src.");
+        }
+
+        list.push(item.src);
+    });
+
+    return list;
+}
+
+function getCopyLibDataList() {
+    const libs = require('./frontend/libs.json');
+
+    let list = [];
+
+    libs.forEach(item => {
+        if (item.bundle) {
+            return;
+        }
+
+        let minify = item.minify;
+
+        if (item.files) {
+            item.files.forEach(item  => {
+                list.push({
+                    src: item.src,
+                    dest: 'build/tmp/' + (item.dest || 'client/lib/' + item.src.split('/').pop()),
+                    minify: minify,
+                });
+            });
+
+            return;
+        }
+
+        if (!item.src) {
+            throw new Error("No lib src.");
+        }
+
+        list.push({
+            src: item.src,
+            dest: 'build/tmp/' + (item.dest || 'client/lib/' + item.src.split('/').pop()),
+            minify: minify,
+        });
+    });
+
+    return list;
+}
+
+function camelCaseToHyphen(string){
+    if (string === null) {
+        return string;
+    }
+
+    return string.replace(/([a-z])([A-Z])/g, '$1-$2').toLowerCase();
+}

README.md

@@ -8,7 +8,7 @@ It's a web application with a frontend designed as a single page application and
 
 ### Requirements
 
-* PHP 7.2 and later (with pdo, json, gd, openssl, zip, imap, mbstring, curl extensions);
+* PHP 7.3 and later (with pdo, json, gd, openssl, zip, imap, mbstring, curl extensions);
 * MySQL 5.7 (and later), or MariaDB 10.1 (and later).
 
 For more information about server configuration see [this article](https://docs.espocrm.com/administration/server-configuration/).

application/Espo/Acl/Attachment.php

@@ -1,92 +0,0 @@
-<?php
-/************************************************************************
- * This file is part of EspoCRM.
- *
- * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
- * Website: https://www.espocrm.com
- *
- * EspoCRM is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * EspoCRM is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
- *
- * The interactive user interfaces in modified source and object code versions
- * of this program must display Appropriate Legal Notices, as required under
- * Section 5 of the GNU General Public License version 3.
- *
- * In accordance with Section 7(b) of the GNU General Public License version 3,
- * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
- ************************************************************************/
-
-namespace Espo\Acl;
-
-use Espo\Entities\User as EntityUser;
-use Espo\ORM\Entity;
-
-class Attachment extends \Espo\Core\Acl\Acl
-{
-    public function checkEntityRead(EntityUser $user, Entity $entity, $data)
-    {
-        if ($user->isAdmin()) {
-            return true;
-        }
-
-        if ($entity->get('parentType') === 'Settings') {
-            return true;
-        }
-
-        $parent = null;
-        $hasParent = false;
-        if ($entity->get('parentId') && $entity->get('parentType')) {
-            $hasParent = true;
-            $parent = $this->getEntityManager()->getEntity($entity->get('parentType'), $entity->get('parentId'));
-        } else if ($entity->get('relatedId') && $entity->get('relatedType')) {
-            $hasParent = true;
-            $parent = $this->getEntityManager()->getEntity($entity->get('relatedType'), $entity->get('relatedId'));
-        }
-
-        if ($hasParent) {
-            if ($parent) {
-                if ($parent->getEntityType() === 'Note') {
-                    if ($parent->get('parentId') && $parent->get('parentType')) {
-                        $parentOfParent = $this->getEntityManager()->getEntity($parent->get('parentType'), $parent->get('parentId'));
-                        if ($parentOfParent && $this->getAclManager()->checkEntity($user, $parentOfParent)) {
-                            return true;
-                        }
-                    } else {
-                        return true;
-                    }
-                } else {
-                    if ($this->getAclManager()->checkEntity($user, $parent)) {
-                        return true;
-                    }
-                }
-            }
-        } else {
-            return true;
-        }
-
-        if ($this->checkEntity($user, $entity, $data, 'read')) {
-            return true;
-        }
-
-        return false;
-    }
-
-    public function checkIsOwner(EntityUser $user, Entity $entity)
-    {
-        if ($user->id === $entity->get('createdById')) {
-            return true;
-        }
-        return false;
-    }
-}

application/Espo/Acl/EmailAddress.php

@@ -1,64 +0,0 @@
-<?php
-/************************************************************************
- * This file is part of EspoCRM.
- *
- * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
- * Website: https://www.espocrm.com
- *
- * EspoCRM is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * EspoCRM is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
- *
- * The interactive user interfaces in modified source and object code versions
- * of this program must display Appropriate Legal Notices, as required under
- * Section 5 of the GNU General Public License version 3.
- *
- * In accordance with Section 7(b) of the GNU General Public License version 3,
- * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
- ************************************************************************/
-
-namespace Espo\Acl;
-
-use Espo\Entities\User as EntityUser;
-use Espo\ORM\Entity;
-
-class EmailAddress extends \Espo\Core\Acl\Acl
-{
-    public function checkEditInEntity(EntityUser $user, Entity $entity, Entity $excludeEntity)
-    {
-        $id = $entity->id;
-
-        $isFobidden = false;
-
-        $repository = $this->getEntityManager()->getRepository('EmailAddress');
-
-        if (!$user->isAdmin()) {
-            $entityWithSameAddressList = $repository->getEntityListByAddressId($id, $excludeEntity);
-            foreach ($entityWithSameAddressList as $e) {
-                if (!$this->getAclManager()->check($user, $e, 'edit')) {
-                    $isFobidden = true;
-                    if (
-                        $e->getEntityType() === 'User' &&
-                        $e->isPortal() &&
-                        $excludeEntity->getEntityType() === 'Contact' &&
-                        $e->get('contactId') === $excludeEntity->id
-                    ) {
-                        $isFobidden = false;
-                    }
-                    if ($isFobidden) break;
-                }
-            }
-        }
-        return !$isFobidden;
-    }
-}

application/Espo/Acl/Note.php

@@ -1,119 +0,0 @@
-<?php
-/************************************************************************
- * This file is part of EspoCRM.
- *
- * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
- * Website: https://www.espocrm.com
- *
- * EspoCRM is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * EspoCRM is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
- *
- * The interactive user interfaces in modified source and object code versions
- * of this program must display Appropriate Legal Notices, as required under
- * Section 5 of the GNU General Public License version 3.
- *
- * In accordance with Section 7(b) of the GNU General Public License version 3,
- * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
- ************************************************************************/
-
-namespace Espo\Acl;
-
-use Espo\Entities\User as EntityUser;
-use Espo\ORM\Entity;
-
-class Note extends \Espo\Core\Acl\Acl
-{
-    protected $deleteThresholdPeriod = '1 month';
-
-    protected $editThresholdPeriod = '7 days';
-
-    public function checkIsOwner(EntityUser $user, Entity $entity)
-    {
-        if ($entity->get('type') === 'Post' && $user->id === $entity->get('createdById')) {
-            return true;
-        }
-        return false;
-    }
-
-    public function checkEntityCreate(EntityUser $user, Entity $entity, $data)
-    {
-        if ($entity->get('parentId') && $entity->get('parentType')) {
-            $parent = $this->getEntityManager()->getEntity($entity->get('parentType'), $entity->get('parentId'));
-            if ($parent) {
-                if ($this->getAclManager()->checkEntity($user, $parent, 'stream')) {
-                    return true;
-                }
-            }
-            return false;
-        }
-
-        return true;
-    }
-
-    public function checkEntityEdit(EntityUser $user, Entity $entity, $data)
-    {
-        if ($user->isAdmin()) {
-            return true;
-        }
-
-        if ($this->checkEntity($user, $entity, $data, 'edit')) {
-            if ($this->checkIsOwner($user, $entity)) {
-                $createdAt = $entity->get('createdAt');
-                if ($createdAt) {
-                    $noteEditThresholdPeriod = '-' . $this->getConfig()->get('noteEditThresholdPeriod', $this->editThresholdPeriod);
-                    $dt = new \DateTime();
-                    $dt->modify($noteEditThresholdPeriod);
-                    try {
-                        if ($dt->format('U') > (new \DateTime($createdAt))->format('U')) {
-                            return false;
-                        }
-                    } catch (\Exception $e) {
-                        return false;
-                    }
-                }
-            }
-            return true;
-        }
-
-        return false;
-    }
-
-    public function checkEntityDelete(EntityUser $user, Entity $entity, $data)
-    {
-        if ($user->isAdmin()) {
-            return true;
-        }
-
-        if ($this->checkEntity($user, $entity, $data, 'delete')) {
-            if ($this->checkIsOwner($user, $entity)) {
-                $createdAt = $entity->get('createdAt');
-                if ($createdAt) {
-                    $deleteThresholdPeriod = '-' . $this->getConfig()->get('noteDeleteThresholdPeriod', $this->deleteThresholdPeriod);
-                    $dt = new \DateTime();
-                    $dt->modify($deleteThresholdPeriod);
-                    try {
-                        if ($dt->format('U') > (new \DateTime($createdAt))->format('U')) {
-                            return false;
-                        }
-                    } catch (\Exception $e) {
-                        return false;
-                    }
-                }
-            }
-            return true;
-        }
-
-        return false;
-    }
-}

application/Espo/Acl/PhoneNumber.php

@@ -1,65 +0,0 @@
-<?php
-/************************************************************************
- * This file is part of EspoCRM.
- *
- * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
- * Website: https://www.espocrm.com
- *
- * EspoCRM is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * EspoCRM is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
- *
- * The interactive user interfaces in modified source and object code versions
- * of this program must display Appropriate Legal Notices, as required under
- * Section 5 of the GNU General Public License version 3.
- *
- * In accordance with Section 7(b) of the GNU General Public License version 3,
- * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
- ************************************************************************/
-
-namespace Espo\Acl;
-
-use Espo\Entities\User as EntityUser;
-use Espo\ORM\Entity;
-
-class PhoneNumber extends \Espo\Core\Acl\Acl
-{
-    public function checkEditInEntity(EntityUser $user, Entity $entity, Entity $excludeEntity)
-    {
-        $id = $entity->id;
-
-        $isFobidden = false;
-
-        $repository = $this->getEntityManager()->getRepository('PhoneNumber');
-
-        if (!$user->isAdmin()) {
-            $entityWithSameNumberList = $repository->getEntityListByPhoneNumberId($id, $excludeEntity);
-            foreach ($entityWithSameNumberList as $e) {
-                if (!$this->getAclManager()->check($user, $e, 'edit')) {
-                    $isFobidden = true;
-                    if (
-                        $e->getEntityType() === 'User' &&
-                        $e->isPortal() &&
-                        $excludeEntity->getEntityType() === 'Contact' &&
-                        $e->get('contactId') === $excludeEntity->id
-                    ) {
-                        $isFobidden = false;
-                    }
-                    if ($isFobidden) break;
-                }
-            }
-        }
-
-        return !$isFobidden;
-    }
-}

application/Espo/AclPortal/Attachment.php

@@ -1,93 +0,0 @@
-<?php
-/************************************************************************
- * This file is part of EspoCRM.
- *
- * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
- * Website: https://www.espocrm.com
- *
- * EspoCRM is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * EspoCRM is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
- *
- * The interactive user interfaces in modified source and object code versions
- * of this program must display Appropriate Legal Notices, as required under
- * Section 5 of the GNU General Public License version 3.
- *
- * In accordance with Section 7(b) of the GNU General Public License version 3,
- * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
- ************************************************************************/
-
-namespace Espo\AclPortal;
-
-use \Espo\Entities\User as EntityUser;
-use \Espo\ORM\Entity;
-
-class Attachment extends \Espo\Core\AclPortal\Base
-{
-    public function checkEntityRead(EntityUser $user, Entity $entity, $data)
-    {
-        if ($user->isAdmin()) {
-            return true;
-        }
-
-        if ($entity->get('parentType') === 'Settings') {
-            return true;
-        }
-
-        $parent = null;
-        $hasParent = false;
-        if ($entity->get('parentId') && $entity->get('parentType')) {
-            $hasParent = true;
-            $parent = $this->getEntityManager()->getEntity($entity->get('parentType'), $entity->get('parentId'));
-        } else if ($entity->get('relatedId') && $entity->get('relatedType')) {
-            $hasParent = true;
-            $parent = $this->getEntityManager()->getEntity($entity->get('relatedType'), $entity->get('relatedId'));
-        }
-
-        if ($hasParent) {
-            if ($parent) {
-                if ($parent->getEntityType() === 'Note') {
-                    if ($parent->get('parentId') && $parent->get('parentType')) {
-                        $parentOfParent = $this->getEntityManager()->getEntity($parent->get('parentType'), $parent->get('parentId'));
-                        if ($parentOfParent && $this->getAclManager()->checkEntity($user, $parentOfParent)) {
-                            return true;
-                        }
-                    } else {
-                        return true;
-                    }
-                } else {
-                    if ($this->getAclManager()->checkEntity($user, $parent)) {
-                        return true;
-                    }
-                }
-            }
-        } else {
-            return true;
-        }
-
-        if ($this->checkEntity($user, $entity, $data, 'read')) {
-            return true;
-        }
-
-        return false;
-    }
-
-    public function checkIsOwner(EntityUser $user, Entity $entity)
-    {
-        if ($user->id === $entity->get('createdById')) {
-            return true;
-        }
-        return false;
-    }
-}
-

application/Espo/Classes/Acl/ActionHistoryRecord/OwnershipChecker.php

@@ -0,0 +1,46 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Acl\ActionHistoryRecord;
+
+use Espo\Entities\User;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    Acl\OwnershipOwnChecker,
+};
+
+class OwnershipChecker implements OwnershipOwnChecker
+{
+    public function checkOwn(User $user, Entity $entity): bool
+    {
+        return $entity->get('userId') === $user->getId();
+    }
+}

application/Espo/Classes/Acl/Attachment/AccessChecker.php

@@ -0,0 +1,153 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Acl\Attachment;
+
+use Espo\Entities\{
+    User,
+    Note,
+};
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    ORM\EntityManager,
+    AclManager,
+    Acl\ScopeData,
+    Acl\DefaultAccessChecker,
+    Acl\AccessEntityCREDChecker,
+    Acl\Traits\DefaultAccessCheckerDependency,
+};
+
+class AccessChecker implements AccessEntityCREDChecker
+{
+    use DefaultAccessCheckerDependency;
+
+    private $aclManager;
+
+    private $entityManager;
+
+    public function __construct(
+        DefaultAccessChecker $defaultAccessChecker,
+        AclManager $aclManager,
+        EntityManager $entityManager
+    ) {
+        $this->defaultAccessChecker = $defaultAccessChecker;
+        $this->aclManager = $aclManager;
+        $this->entityManager = $entityManager;
+    }
+
+    public function checkEntityRead(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if ($entity->get('parentType') === 'Settings') {
+            return true;
+        }
+
+        $parent = null;
+
+        $hasParent = false;
+
+        if ($entity->get('parentId') && $entity->get('parentType')) {
+            $hasParent = true;
+
+            $parent = $this->entityManager->getEntity($entity->get('parentType'), $entity->get('parentId'));
+        }
+        else if ($entity->get('relatedId') && $entity->get('relatedType')) {
+            $hasParent = true;
+
+            $parent = $this->entityManager->getEntity($entity->get('relatedType'), $entity->get('relatedId'));
+        }
+
+        if (!$parent || !$hasParent) {
+            if ($this->defaultAccessChecker->checkEntityRead($user, $entity, $data)) {
+                return true;
+            }
+
+            return false;
+        }
+
+        if ($parent->getEntityType() === 'Note') {
+            $result = $this->checkEntityReadNoteParent($user, $parent);
+
+            if ($result !== null) {
+                return $result;
+            }
+        }
+        else if ($this->aclManager->checkEntity($user, $parent)) {
+            return true;
+        }
+
+        if ($this->defaultAccessChecker->checkEntityRead($user, $entity, $data)) {
+            return true;
+        }
+
+        return false;
+    }
+
+    private function checkEntityReadNoteParent(User $user, Note $note): ?bool
+    {
+        if ($note->getTargetType() === Note::TARGET_TEAMS) {
+            $intersect = array_intersect(
+                $note->getLinkMultipleIdList('teams'),
+                $user->getLinkMultipleIdList('teams')
+            );
+
+            if (count($intersect)) {
+                return true;
+            }
+
+            return null;
+        }
+
+        if ($note->getTargetType() === Note::TARGET_USERS) {
+            $isRelated = $this->entityManager
+                ->getRDBRepository('Note')
+                ->getRelation($note, 'users')
+                ->isRelated($user);
+
+            if ($isRelated) {
+                return true;
+            }
+
+            return null;
+        }
+
+        if (!$note->getParentId() || !$note->getParentType()) {
+            return null;
+        }
+
+        $parent = $this->entityManager->getEntity($note->getParentType(), $note->getParentId());
+
+        if ($parent && $this->aclManager->checkEntity($user, $parent)) {
+            return true;
+        }
+
+        return null;
+    }
+}

application/Espo/Classes/Acl/Attachment/OwnershipChecker.php

@@ -27,23 +27,26 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Modules\Crm\AclPortal;
+namespace Espo\Classes\Acl\Attachment;
 
 use Espo\Entities\User;
+
 use Espo\ORM\Entity;
 
-use Espo\Core\AclPortal\Acl;
+use Espo\Core\{
+    Acl\OwnershipOwnChecker,
+};
 
-class Account extends Acl
+class OwnershipChecker implements OwnershipOwnChecker
 {
-    public function checkInAccount(User $user, Entity $entity)
+    private const ATTR_CREATED_BY_ID = 'createdById';
+
+    public function checkOwn(User $user, Entity $entity): bool
     {
-        $accountIdList = $user->getLinkMultipleIdList('accounts');
-        if (count($accountIdList)) {
-            if (in_array($entity->id, $accountIdList)) {
-                return true;
-            }
+        if ($user->getId() === $entity->get(self::ATTR_CREATED_BY_ID)) {
+            return true;
         }
+
         return false;
     }
 }

application/Espo/Classes/Acl/AuthToken/AccessChecker.php

@@ -27,26 +27,30 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Acl;
+namespace Espo\Classes\Acl\AuthToken;
 
-use Espo\Entities\User as EntityUser;
-use Espo\ORM\Entity;
+use Espo\Entities\User;
 
-class Import extends \Espo\Core\Acl\Acl
+use Espo\Core\{
+    Acl\ScopeData,
+    Acl\DefaultAccessChecker,
+    Acl\AccessEntityCREDChecker,
+    Acl\Traits\DefaultAccessCheckerDependency,
+};
+
+class AccessChecker implements AccessEntityCREDChecker
 {
-    public function checkEntityRead(EntityUser $user, Entity $entity, $data)
-    {
-        if ($user->isAdmin()) return true;
-        if ($user->id === $entity->get('createdById')) return true;
+    use DefaultAccessCheckerDependency;
 
-        return false;
+    private $defaultAccessChecker;
+
+    public function __construct(DefaultAccessChecker $defaultAccessChecker)
+    {
+        $this->defaultAccessChecker = $defaultAccessChecker;
     }
 
-    public function checkEntityDelete(EntityUser $user, Entity $entity, $data)
+    public function checkCreate(User $user, ScopeData $data): bool
     {
-        if ($user->isAdmin()) return true;
-        if ($user->id === $entity->get('createdById')) return true;
-
         return false;
     }
 }

application/Espo/Classes/Acl/Email/AccessChecker.php

@@ -27,93 +27,101 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Acl;
+namespace Espo\Classes\Acl\Email;
+
+use Espo\Entities\User;
 
-use Espo\Entities\User as EntityUser;
 use Espo\ORM\Entity;
 
-class Email extends \Espo\Core\Acl\Acl
-{
-    protected $ownerUserIdAttribute = 'usersIds';
+use Espo\Core\{
+    Acl\Table,
+    Acl\ScopeData,
+    Acl\DefaultAccessChecker,
+    Acl\AccessEntityCREDSChecker,
+    Acl\Traits\DefaultAccessCheckerDependency,
+};
 
-    public function checkEntityRead(EntityUser $user, Entity $entity, $data)
+class AccessChecker implements AccessEntityCREDSChecker
+{
+    use DefaultAccessCheckerDependency;
+
+    public function __construct(DefaultAccessChecker $defaultAccessChecker)
     {
-        if ($this->checkEntity($user, $entity, $data, 'read')) {
+        $this->defaultAccessChecker = $defaultAccessChecker;
+    }
+
+    public function checkEntityRead(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if ($this->defaultAccessChecker->checkEntityRead($user, $entity, $data)) {
             return true;
         }
 
-        if ($data === false) {
+        if ($data->isFalse()) {
             return false;
         }
-        if (is_object($data)) {
-            if ($data->read === false || $data->read === 'no') {
-                return false;
-            }
+
+        if ($data->getRead() === Table::LEVEL_NO) {
+            return false;
         }
 
         if (!$entity->has('usersIds')) {
             $entity->loadLinkMultipleField('users');
         }
+
         $userIdList = $entity->get('usersIds');
-        if (is_array($userIdList) && in_array($user->id, $userIdList)) {
-            return true;
-        }
-        return false;
-    }
 
-    public function checkIsOwner(EntityUser $user, Entity $entity)
-    {
-        if ($user->id === $entity->get('assignedUserId')) {
-            return true;
-        }
-
-        if ($user->id === $entity->get('createdById')) {
-            return true;
-        }
-
-        if ($entity->hasLinkMultipleId('assignedUsers', $user->id)) {
+        if (is_array($userIdList) && in_array($user->getId(), $userIdList)) {
             return true;
         }
 
         return false;
     }
 
-    public function checkEntityDelete(EntityUser $user, Entity $entity, $data)
+    public function checkEntityDelete(User $user, Entity $entity, ScopeData $data): bool
     {
         if ($user->isAdmin()) {
             return true;
         }
 
-        if ($data === false) {
+        if ($data->isFalse()) {
             return false;
         }
 
-        if ($data->delete === 'own') {
-            if ($user->id === $entity->get('assignedUserId')) {
+        if ($data->getDelete() === Table::LEVEL_OWN) {
+            if ($user->getId() === $entity->get('assignedUserId')) {
                 return true;
             }
 
-            if ($user->id === $entity->get('createdById')) {
+            if ($user->getId() === $entity->get('createdById')) {
                 return true;
             }
 
             $assignedUserIdList = $entity->getLinkMultipleIdList('assignedUsers');
-            if (count($assignedUserIdList) === 1 && $entity->hasLinkMultipleId('assignedUsers', $user->id)) {
+
+            if (
+                count($assignedUserIdList) === 1 &&
+                $entity->hasLinkMultipleId('assignedUsers', $user->getId())
+            ) {
                 return true;
             }
+
             return false;
         }
 
-        if ($this->checkEntity($user, $entity, $data, 'delete')) {
+        if ($this->defaultAccessChecker->checkEntityDelete($user, $entity, $data)) {
             return true;
         }
 
-        if ($data->edit !== 'no' || $data->create !== 'no') {
-            if ($entity->get('createdById') === $user->id) {
-                if ($entity->get('status') !== 'Sent' && $entity->get('status') !== 'Archived') {
-                    return true;
-                }
-            }
+        if ($data->getEdit() === Table::LEVEL_NO && $data->getCreate() === Table::LEVEL_NO) {
+            return false;
+        }
+
+        if ($entity->get('createdById') !== $user->getId()) {
+            return false;
+        }
+
+        if ($entity->get('status') !== 'Sent' && $entity->get('status') !== 'Archived') {
+            return true;
         }
 
         return false;

application/Espo/Classes/Acl/Email/AssignmentChecker.php

@@ -0,0 +1,51 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Acl\Email;
+
+use Espo\Entities\User;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    Acl\DefaultAssignmentChecker,
+};
+
+class AssignmentChecker extends DefaultAssignmentChecker
+{
+    protected function isPermittedAssignedUser(User $user, Entity $entity): bool
+    {
+        return true;
+    }
+
+    protected function isPermittedAssignedUsers(User $user, Entity $entity): bool
+    {
+        return true;
+    }
+}

application/Espo/Classes/Acl/Email/OwnershipChecker.php

@@ -27,46 +27,46 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\AclPortal;
+namespace Espo\Classes\Acl\Email;
 
-use \Espo\Entities\User as EntityUser;
-use \Espo\ORM\Entity;
+use Espo\Entities\User;
 
-class Email extends \Espo\Core\AclPortal\Base
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    Acl\DefaultOwnershipChecker,
+    Acl\OwnershipOwnChecker,
+    Acl\OwnershipTeamChecker,
+};
+
+class OwnershipChecker implements OwnershipOwnChecker, OwnershipTeamChecker
 {
-    protected $ownerUserIdAttribute = 'usersIds';
+    private $defaultOwnershipChecker;
 
-    public function checkEntityRead(EntityUser $user, Entity $entity, $data)
+    public function __construct(DefaultOwnershipChecker $defaultOwnershipChecker)
     {
-        if ($this->checkEntity($user, $entity, $data, 'read')) {
+        $this->defaultOwnershipChecker = $defaultOwnershipChecker;
+    }
+
+    public function checkOwn(User $user, Entity $entity): bool
+    {
+        if ($user->getId() === $entity->get('assignedUserId')) {
             return true;
         }
 
-        if ($data === false) {
-            return false;
-        }
-        if (is_object($data)) {
-            if ($data->read === false || $data->read === 'no') {
-                return false;
-            }
-        }
-
-        if (!$entity->has('usersIds')) {
-            $entity->loadLinkMultipleField('users');
-        }
-        $userIdList = $entity->get('usersIds');
-        if (is_array($userIdList) && in_array($user->id, $userIdList)) {
+        if ($user->getId() === $entity->get('createdById')) {
             return true;
         }
+
+        if ($entity->hasLinkMultipleId('assignedUsers', $user->getId())) {
+            return true;
+        }
+
         return false;
     }
 
-    public function checkIsOwner(EntityUser $user, Entity $entity)
+    public function checkTeam(User $user, Entity $entity): bool
     {
-        if ($user->id === $entity->get('createdById')) {
-            return true;
-        }
-        return false;
+        return $this->defaultOwnershipChecker->checkTeam($user, $entity);
     }
 }
-

application/Espo/Classes/Acl/EmailFilter/OwnershipChecker.php

@@ -27,57 +27,53 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Core\Authentication\TwoFactor\Methods;
+namespace Espo\Classes\Acl\EmailFilter;
 
 use Espo\Entities\User;
 
-use Espo\ORM\EntityManager;
-use Espo\Core\Authentication\TwoFactor\Utils\Totp as TotpUtils;
+use Espo\ORM\Entity;
 
-use StdClass;
+use Espo\Core\{
+    Acl\OwnershipOwnChecker,
+    ORM\EntityManager,
+};
 
-class Totp implements CodeVerify
+class OwnershipChecker implements OwnershipOwnChecker
 {
-    protected $entityManager;
-    protected $totp;
+    private $entityManager;
 
-    public function __construct(EntityManager $entityManager, TotpUtils $totp)
+    public function __construct(EntityManager $entityManager)
     {
         $this->entityManager = $entityManager;
-        $this->totp = $totp;
     }
 
-    public function verifyCode(User $user, string $code) : bool
+    public function checkOwn(User $user, Entity $entity): bool
     {
-        $userData = $this->entityManager
-            ->getRepository('UserData')
-            ->getByUserId($user->id);
-
-        if (!$userData) {
+        if (!$entity->has('parentId') || !$entity->has('parentType')) {
             return false;
         }
 
-        if (!$userData->get('auth2FA')) {
+        $parentType = $entity->get('parentType');
+        $parentId = $entity->get('parentId');
+
+        if (!$parentType || !$parentId) {
             return false;
         }
 
-        if ($userData->get('auth2FAMethod') != 'Totp') {
+        $parent = $this->entityManager->getEntity($parentType, $parentId);
+
+        if (!$parent) {
             return false;
         }
 
-        $secret = $userData->get('auth2FATotpSecret');
-
-        if (!$secret) {
-            return false;
+        if ($parent->getEntityType() === 'User') {
+            return $parent->getId() === $user->getId();
         }
 
-        return $this->totp->verifyCode($secret, $code);
-    }
+        if ($parent->has('assignedUserId') && $parent->get('assignedUserId') === $user->getId()) {
+            return true;
+        }
 
-    public function getLoginData(User $user) : StdClass
-    {
-        return (object) [
-            'message' => 'enterTotpCode',
-        ];
+        return false;
     }
 }

application/Espo/Classes/Acl/Import/AccessChecker.php

@@ -0,0 +1,84 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Acl\Import;
+
+use Espo\Entities\User;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    Acl\ScopeData,
+    Acl\AccessEntityReadChecker,
+    Acl\AccessEntityDeleteChecker,
+};
+
+class AccessChecker implements AccessEntityReadChecker, AccessEntityDeleteChecker
+{
+    public function check(User $user, ScopeData $data): bool
+    {
+        return $data->isTrue();
+    }
+
+    public function checkRead(User $user, ScopeData $data): bool
+    {
+        return $data->isTrue();
+    }
+
+    public function checkDelete(User $user, ScopeData $data): bool
+    {
+        return $data->isTrue();
+    }
+
+    public function checkEntityRead(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+
+        if ($user->getId() === $entity->get('createdById')) {
+            return true;
+        }
+
+        return false;
+    }
+
+    public function checkEntityDelete(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+
+        if ($user->getId() === $entity->get('createdById')) {
+            return true;
+        }
+
+        return false;
+    }
+}

application/Espo/Classes/Acl/Note/AccessChecker.php

@@ -0,0 +1,172 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Acl\Note;
+
+use Espo\Entities\User;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    Acl\ScopeData,
+    Acl\DefaultAccessChecker,
+    Acl\AccessEntityCREDChecker,
+    Acl\Traits\DefaultAccessCheckerDependency,
+    AclManager,
+    ORM\EntityManager,
+    Utils\Config,
+};
+
+use DateTime;
+use Exception;
+
+class AccessChecker implements AccessEntityCREDChecker
+{
+    use DefaultAccessCheckerDependency;
+
+    private const EDIT_PERIOD = '7 days';
+
+    private const DELETE_PERIOD = '1 month';
+
+    private $defaultAccessChecker;
+
+    private $aclManager;
+
+    private $entityManager;
+
+    private $config;
+
+    public function __construct(
+        DefaultAccessChecker $defaultAccessChecker,
+        AclManager $aclManager,
+        EntityManager $entityManager,
+        Config $config
+    ) {
+        $this->defaultAccessChecker = $defaultAccessChecker;
+        $this->aclManager = $aclManager;
+        $this->entityManager = $entityManager;
+        $this->config = $config;
+    }
+
+    public function checkEntityCreate(User $user, Entity $entity, ScopeData $data): bool
+    {
+        $parentId = $entity->get('parentId');
+        $parentType = $entity->get('parentType');
+
+        if (!$parentId || !$parentType) {
+            return true;
+        }
+
+        $parent = $this->entityManager->getEntity($parentType, $parentId);
+
+        if ($parent && $this->aclManager->checkEntityStream($user, $parent)) {
+            return true;
+        }
+
+        return false;
+    }
+
+    public function checkEntityEdit(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+
+        if (!$this->defaultAccessChecker->checkEntityEdit($user, $entity, $data)) {
+            return false;
+        }
+
+        if (!$this->aclManager->checkOwnershipOwn($user, $entity)) {
+            return true;
+        }
+
+        $createdAt = $entity->get('createdAt');
+
+        if (!$createdAt) {
+            return true;
+        }
+
+        $noteEditThresholdPeriod =
+            '-' .  $this->config->get('noteEditThresholdPeriod', self::EDIT_PERIOD);
+
+        $dt = new DateTime();
+
+        $dt->modify($noteEditThresholdPeriod);
+
+        try {
+            if ($dt->format('U') > (new DateTime($createdAt))->format('U')) {
+                return false;
+            }
+        }
+        catch (Exception $e) {
+            return false;
+        }
+
+        return true;
+    }
+
+    public function checkEntityDelete(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+
+        if (!$this->defaultAccessChecker->checkEntityDelete($user, $entity, $data)) {
+            return false;
+        }
+
+        if (!$this->aclManager->checkOwnershipOwn($user, $entity)) {
+            return true;
+        }
+
+        $createdAt = $entity->get('createdAt');
+
+        if (!$createdAt) {
+            return true;
+        }
+
+        $deleteThresholdPeriod =
+            '-' . $this->config->get('noteDeleteThresholdPeriod', self::DELETE_PERIOD);
+
+        $dt = new DateTime();
+
+        $dt->modify($deleteThresholdPeriod);
+
+        try {
+            if ($dt->format('U') > (new DateTime($createdAt))->format('U')) {
+                return false;
+            }
+        }
+        catch (Exception $e) {
+            return false;
+        }
+
+        return true;
+    }
+}

application/Espo/Classes/Acl/Note/OwnershipChecker.php

@@ -0,0 +1,51 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Acl\Note;
+
+use Espo\Entities\User;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    Acl\OwnershipOwnChecker,
+};
+
+class OwnershipChecker implements OwnershipOwnChecker
+{
+    public function checkOwn(User $user, Entity $entity): bool
+    {
+
+        if ($entity->get('type') === 'Post' && $user->getId() === $entity->get('createdById')) {
+            return true;
+        }
+
+        return false;
+    }
+}

application/Espo/Classes/Acl/Notification/OwnershipChecker.php

@@ -27,18 +27,24 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Acl;
+namespace Espo\Classes\Acl\Notification;
+
+use Espo\Entities\User;
 
-use Espo\Entities\User as EntityUser;
 use Espo\ORM\Entity;
 
-class Notification extends \Espo\Core\Acl\Acl
+use Espo\Core\{
+    Acl\OwnershipOwnChecker,
+};
+
+class OwnershipChecker implements OwnershipOwnChecker
 {
-    public function checkIsOwner(EntityUser $user, Entity $entity)
+    public function checkOwn(User $user, Entity $entity): bool
     {
-        if ($user->id === $entity->get('userId')) {
+        if ($user->getId() === $entity->get('userId')) {
             return true;
         }
+
         return false;
     }
 }

application/Espo/Classes/Acl/Portal/AccessChecker.php

@@ -27,41 +27,37 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Jobs;
+namespace Espo\Classes\Acl\Portal;
+
+use Espo\Entities\User;
 
 use Espo\Core\{
-    Jobs\Job,
+    Acl\ScopeData,
+    Acl\DefaultAccessChecker,
+    Acl\AccessEntityCREDChecker,
+    Acl\Traits\DefaultAccessCheckerDependency,
+    Acl\Table,
     AclManager,
-    Utils\Config,
-    ORM\EntityManager,
-    Webhook\Sender,
-    Webhook\Queue,
 };
 
-class ProcessWebhookQueue implements Job
+class AccessChecker implements AccessEntityCREDChecker
 {
-    protected $config;
-    protected $entityManager;
-    protected $aclManager;
+    use DefaultAccessCheckerDependency;
 
-    public function __construct(Config $config, EntityManager $entityManager, AclManager $aclManager)
+    private $defaultAccessChecker;
+
+    private $aclManager;
+
+    public function __construct(DefaultAccessChecker $defaultAccessChecker, AclManager $aclManager)
     {
-        $this->config = $config;
-        $this->entityManager = $entityManager;
+        $this->defaultAccessChecker = $defaultAccessChecker;
         $this->aclManager = $aclManager;
     }
 
-    public function run()
+    public function check(User $user, ScopeData $data): bool
     {
-        $sender = new Sender($this->config);
+        $level = $this->aclManager->getPermissionLevel($user, 'portal');
 
-        $webhookQueue = new Queue(
-            $sender,
-            $this->config,
-            $this->entityManager,
-            $this->aclManager
-        );
-
-        $webhookQueue->process();
+        return $level === Table::LEVEL_YES;
     }
 }

application/Espo/Classes/Acl/ScheduledJob/AccessChecker.php

@@ -0,0 +1,89 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Acl\ScheduledJob;
+
+use Espo\Entities\User;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    Acl\ScopeData,
+    Acl\DefaultAccessChecker,
+    Acl\AccessEntityCREDChecker,
+    Acl\Traits\DefaultAccessCheckerDependency,
+};
+
+class AccessChecker implements AccessEntityCREDChecker
+{
+    use DefaultAccessCheckerDependency;
+
+    private $defaultAccessChecker;
+
+    public function __construct(DefaultAccessChecker $defaultAccessChecker)
+    {
+        $this->defaultAccessChecker = $defaultAccessChecker;
+    }
+
+    public function checkEntityCreate(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if ($entity->get('isInternal')) {
+            return false;
+        }
+
+        return $this->defaultAccessChecker->checkEntityCreate($user, $entity, $data);
+    }
+
+    public function checkEntityRead(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if ($entity->get('isInternal')) {
+            return false;
+        }
+
+        return $this->defaultAccessChecker->checkEntityRead($user, $entity, $data);
+    }
+
+    public function checkEntityEdit(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if ($entity->get('isInternal')) {
+            return false;
+        }
+
+        return $this->defaultAccessChecker->checkEntityEdit($user, $entity, $data);
+    }
+
+    public function checkEntityDelete(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if ($entity->get('isInternal')) {
+            return false;
+        }
+
+        return $this->defaultAccessChecker->checkEntityDelete($user, $entity, $data);
+    }
+}

application/Espo/Classes/Acl/Team/OwnershipChecker.php

@@ -27,17 +27,22 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Acl;
+namespace Espo\Classes\Acl\Team;
+
+use Espo\Entities\User;
 
 use Espo\ORM\Entity;
 
-use Espo\Entities\User as UserEntity;
+use Espo\Core\{
+    Acl\OwnershipOwnChecker,
+};
 
-class Team extends \Espo\Core\Acl\Acl
+class OwnershipChecker implements OwnershipOwnChecker
 {
-    public function checkInTeam(UserEntity $user, Entity $entity)
+    public function checkOwn(User $user, Entity $entity): bool
     {
         $userTeamIdList = $user->getLinkMultipleIdList('teams');
-        return in_array($entity->id, $userTeamIdList);
+
+        return in_array($entity->getId(), $userTeamIdList);
     }
 }

application/Espo/Classes/Acl/User/AccessChecker.php

@@ -27,72 +27,103 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Acl;
+namespace Espo\Classes\Acl\User;
+
+use Espo\Entities\User;
 
 use Espo\ORM\Entity;
-use Espo\Entities\User as EntityUser;
 
-class User extends \Espo\Core\Acl\Acl
+use Espo\Core\{
+    Acl\Table,
+    Acl\ScopeData,
+    Acl\DefaultAccessChecker,
+    Acl\AccessEntityCREDSChecker,
+    Acl\Traits\DefaultAccessCheckerDependency,
+    AclManager,
+};
+
+class AccessChecker implements AccessEntityCREDSChecker
 {
-    public function checkIsOwner(EntityUser $user, Entity $entity)
+    use DefaultAccessCheckerDependency;
+
+    private $defaultAccessChecker;
+
+    private $aclManager;
+
+    public function __construct(DefaultAccessChecker $defaultAccessChecker, AclManager $aclManager)
     {
-        return $user->id === $entity->id;
+        $this->defaultAccessChecker = $defaultAccessChecker;
+        $this->aclManager = $aclManager;
     }
 
-    public function checkEntityRead(EntityUser $user, Entity $entity, $data)
+    public function checkEntityCreate(User $user, Entity $entity, ScopeData $data): bool
     {
-        if (!$user->isAdmin() && $entity->isPortal()) {
-            if ($this->getAclManager()->get($user, 'portalPermission') === 'yes') {
+        if (!$user->isAdmin()) {
+            return false;
+        }
+
+        if ($entity->isSuperAdmin() && !$user->isSuperAdmin()) {
+            return false;
+        }
+
+        return $this->defaultAccessChecker->checkEntityCreate($user, $entity, $data);
+    }
+
+    public function checkEntityRead(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if ($entity->isPortal()) {
+            if ($this->aclManager->getPermissionLevel($user, 'portal') === Table::LEVEL_YES) {
                 return true;
             }
-        }
-        return $this->checkEntity($user, $entity, $data, 'read');
-    }
 
-    public function checkEntityCreate(EntityUser $user, Entity $entity, $data)
-    {
-        if (!$user->isAdmin()) {
             return false;
         }
+
         if ($entity->isSuperAdmin() && !$user->isSuperAdmin()) {
             return false;
         }
-        return $this->checkEntity($user, $entity, $data, 'create');
+
+        return $this->defaultAccessChecker->checkEntityRead($user, $entity, $data);
     }
 
-    public function checkEntityDelete(EntityUser $user, Entity $entity, $data)
+    public function checkEntityEdit(User $user, Entity $entity, ScopeData $data): bool
     {
-        if ($entity->id === 'system') {
-            return false;
-        }
-        if (!$user->isAdmin()) {
-            return false;
-        }
         if ($entity->isSystem()) {
             return false;
         }
-        if ($entity->isSuperAdmin() && !$user->isSuperAdmin()) {
-            return false;
-        }
-        return parent::checkEntityDelete($user, $entity, $data);
-    }
 
-    public function checkEntityEdit(EntityUser $user, Entity $entity, $data)
-    {
-        if ($entity->id === 'system') {
-            return false;
-        }
-        if ($entity->isSystem()) {
-            return false;
-        }
         if (!$user->isAdmin()) {
-            if ($user->id !== $entity->id) {
+            if ($user->getId() !== $entity->getId()) {
                 return false;
             }
         }
+
         if ($entity->isSuperAdmin() && !$user->isSuperAdmin()) {
             return false;
         }
-        return $this->checkEntity($user, $entity, $data, 'edit');
+
+        return $this->defaultAccessChecker->checkEntityEdit($user, $entity, $data);
+    }
+
+    public function checkEntityDelete(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if (!$user->isAdmin()) {
+            return false;
+        }
+
+        if ($entity->isSystem()) {
+            return false;
+        }
+
+        if ($entity->isSuperAdmin() && !$user->isSuperAdmin()) {
+            return false;
+        }
+
+        return $this->defaultAccessChecker->checkEntityDelete($user, $entity, $data);
+    }
+
+    public function checkEntityStream(User $user, Entity $entity, ScopeData $data): bool
+    {
+        return $this->aclManager->checkUserPermission($user, $entity, 'user');
     }
 }

application/Espo/Classes/Acl/User/OwnershipChecker.php

@@ -27,30 +27,35 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Modules\Crm\Acl;
+namespace Espo\Classes\Acl\User;
 
-use \Espo\Entities\User;
-use \Espo\ORM\Entity;
+use Espo\Entities\User;
 
-class Meeting extends \Espo\Core\Acl\Base
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    Acl\OwnershipOwnChecker,
+    Acl\OwnershipTeamChecker,
+};
+
+class OwnershipChecker implements OwnershipOwnChecker, OwnershipTeamChecker
 {
-    protected $ownerUserIdAttribute = 'usersIds';
-
-    public function checkEntityRead(User $user, Entity $entity, $data)
+    public function checkOwn(User $user, Entity $entity): bool
     {
-        if ($this->checkEntity($user, $entity, $data, 'read')) {
-            return true;
-        }
+        return $user->getId() === $entity->getId();
+    }
 
-        if (is_object($data)) {
-            if ($data->read === 'own' || $data->read === 'team') {
-                if ($entity->hasLinkMultipleId('users', $user->id)) {
-                    return true;
-                }
-            }
+    public function checkTeam(User $user, Entity $entity): bool
+    {
+        $intersect = array_intersect(
+            $user->getLinkMultipleIdList('teams'),
+            $entity->getLinkMultipleIdList('teams')
+        );
+
+        if (count($intersect)) {
+            return true;
         }
 
         return false;
     }
 }
-

application/Espo/Classes/Acl/Webhook/AccessChecker.php

@@ -0,0 +1,107 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Acl\Webhook;
+
+use Espo\Entities\User;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    Acl\ScopeData,
+    Acl\DefaultAccessChecker,
+    Acl\AccessEntityCREDChecker,
+    Acl\Traits\DefaultAccessCheckerDependency,
+};
+
+class AccessChecker implements AccessEntityCREDChecker
+{
+    use DefaultAccessCheckerDependency;
+
+    private $defaultAccessChecker;
+
+    public function __construct(DefaultAccessChecker $defaultAccessChecker)
+    {
+        $this->defaultAccessChecker = $defaultAccessChecker;
+    }
+
+    public function check(User $user, ScopeData $data): bool
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+
+        if (!$user->isApi()) {
+            return false;
+        }
+
+        if ($data->isFalse()) {
+            return false;
+        }
+
+        return true;
+    }
+
+    public function checkEntityCreate(User $user, Entity $entity, ScopeData $data): bool
+    {
+        return $this->checkEntityInternal($user, $entity, $data);
+    }
+
+    public function checkEntityRead(User $user, Entity $entity, ScopeData $data): bool
+    {
+        return $this->checkEntityInternal($user, $entity, $data);
+    }
+
+    public function checkEntityEdit(User $user, Entity $entity, ScopeData $data): bool
+    {
+        return $this->checkEntityInternal($user, $entity, $data);
+    }
+
+    public function checkEntityDelete(User $user, Entity $entity, ScopeData $data): bool
+    {
+        return $this->checkEntityInternal($user, $entity, $data);
+    }
+
+    private function checkEntityInternal(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+
+        if ($data->isFalse()) {
+            return false;
+        }
+
+        if ($user->isApi() && $user->getId() === $entity->get('userId')) {
+            return true;
+        }
+
+        return false;
+    }
+}

application/Espo/Classes/Acl/Webhook/OwnershipChecker.php

@@ -0,0 +1,46 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Acl\Webhook;
+
+use Espo\Entities\User;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    Acl\OwnershipOwnChecker,
+};
+
+class OwnershipChecker implements OwnershipOwnChecker
+{
+    public function checkOwn(User $user, Entity $entity): bool
+    {
+        return $user->getId() === $entity->get('userId') && $user->isApi();
+    }
+}

application/Espo/Classes/AclPortal/Attachment/AccessChecker.php

@@ -0,0 +1,158 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\AclPortal\Attachment;
+
+use Espo\Entities\{
+    User,
+    Note,
+};
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    ORM\EntityManager,
+    Portal\AclManager,
+    Acl\ScopeData,
+    Acl\AccessEntityCREDChecker,
+    Portal\Acl\DefaultAccessChecker,
+    Portal\Acl\Traits\DefaultAccessCheckerDependency,
+};
+
+class AccessChecker implements AccessEntityCREDChecker
+{
+    use DefaultAccessCheckerDependency;
+
+    private $defaultAccessChecker;
+
+    private $aclManager;
+
+    private $entityManager;
+
+    public function __construct(
+        DefaultAccessChecker $defaultAccessChecker,
+        AclManager $aclManager,
+        EntityManager $entityManager
+    ) {
+        $this->defaultAccessChecker = $defaultAccessChecker;
+        $this->aclManager = $aclManager;
+        $this->entityManager = $entityManager;
+    }
+
+    public function checkEntityRead(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if ($entity->get('parentType') === 'Settings') {
+            return true;
+        }
+
+        $parent = null;
+        $hasParent = false;
+
+        if ($entity->get('parentId') && $entity->get('parentType')) {
+            $hasParent = true;
+
+            $parent = $this->entityManager->getEntity($entity->get('parentType'), $entity->get('parentId'));
+        }
+        else if ($entity->get('relatedId') && $entity->get('relatedType')) {
+            $hasParent = true;
+
+            $parent = $this->entityManager->getEntity($entity->get('relatedType'), $entity->get('relatedId'));
+        }
+
+        if (!$hasParent) {
+            if ($entity->get('createdById') === $user->getId()) {
+                return true;
+            }
+
+            return false;
+        }
+
+        if ($parent->getEntityType() === 'Note') {
+            $result = $this->checkEntityReadNoteParent($user, $parent);
+
+            if ($result !== null) {
+                return $result;
+            }
+        }
+        else if ($this->aclManager->checkEntity($user, $parent)) {
+            return true;
+        }
+
+        if ($this->defaultAccessChecker->checkEntityRead($user, $entity, $data)) {
+            return true;
+        }
+
+        return false;
+    }
+
+    private function checkEntityReadNoteParent(User $user, Note $note): ?bool
+    {
+        if ($note->isInternal()) {
+            return false;
+        }
+
+        if ($note->getTargetType() === Note::TARGET_PORTALS) {
+            $intersect = array_intersect(
+                $note->getLinkMultipleIdList('portals'),
+                $user->getLinkMultipleIdList('portals')
+            );
+
+            if (count($intersect)) {
+                return true;
+            }
+
+            return false;
+        }
+
+        if ($note->getTargetType() === Note::TARGET_USERS) {
+            $isRelated = $this->entityManager
+                ->getRDBRepository('Note')
+                ->getRelation($note, 'users')
+                ->isRelated($user);
+
+            if ($isRelated) {
+                return true;
+            }
+
+            return false;
+        }
+
+        if (!$note->getParentId() || !$note->getParentType()) {
+            return null;
+        }
+
+        $parent = $this->entityManager->getEntity($note->getParentType(), $note->getParentId());
+
+        if ($parent && $this->aclManager->checkEntity($user, $parent)) {
+            return true;
+        }
+
+        return null;
+    }
+}

application/Espo/Classes/AclPortal/Attachment/OwnershipChecker.php

@@ -0,0 +1,52 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\AclPortal\Attachment;
+
+use Espo\Entities\User;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    Acl\OwnershipOwnChecker,
+};
+
+class OwnershipChecker implements OwnershipOwnChecker
+{
+    private const ATTR_CREATED_BY_ID = 'createdById';
+
+    public function checkOwn(User $user, Entity $entity): bool
+    {
+        if ($user->getId() === $entity->get(self::ATTR_CREATED_BY_ID)) {
+            return true;
+        }
+
+        return false;
+    }
+}

application/Espo/Classes/AclPortal/Email/AccessChecker.php

@@ -0,0 +1,83 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\AclPortal\Email;
+
+use Espo\Entities\User;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    Portal\AclManager,
+    Acl\Table,
+    Acl\ScopeData,
+    Acl\AccessEntityCREDSChecker,
+    Portal\Acl\DefaultAccessChecker,
+    Portal\Acl\Traits\DefaultAccessCheckerDependency,
+};
+
+class AccessChecker implements AccessEntityCREDSChecker
+{
+    use DefaultAccessCheckerDependency;
+
+    private $defaultAccessChecker;
+
+    private $aclManager;
+
+    public function __construct(
+        DefaultAccessChecker $defaultAccessChecker,
+        AclManager $aclManager
+    ) {
+        $this->defaultAccessChecker = $defaultAccessChecker;
+        $this->aclManager = $aclManager;
+    }
+
+    public function checkEntityRead(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if ($this->defaultAccessChecker->checkEntityRead($user, $entity, $data)) {
+            return true;
+        }
+
+        if ($data->isFalse()) {
+            return false;
+        }
+
+        if ($data->getRead() === Table::LEVEL_NO) {
+            return false;
+        }
+
+        $userIdList = $entity->getLinkMultipleIdLIst('users');
+
+        if (is_array($userIdList) && in_array($user->getId(), $userIdList)) {
+            return true;
+        }
+
+        return false;
+    }
+}

application/Espo/Classes/AclPortal/Email/OwnershipChecker.php

@@ -27,19 +27,24 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\AclPortal;
+namespace Espo\Classes\AclPortal\Email;
 
-use \Espo\Entities\User as EntityUser;
-use \Espo\ORM\Entity;
+use Espo\Entities\User;
 
-class Notification extends \Espo\Core\AclPortal\Base
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    Acl\OwnershipOwnChecker,
+};
+
+class OwnershipChecker implements OwnershipOwnChecker
 {
-    public function checkIsOwner(EntityUser $user, Entity $entity)
+    public function checkOwn(User $user, Entity $entity): bool
     {
-        if ($user->id === $entity->get('userId')) {
+        if ($user->getId() === $entity->get('createdById')) {
             return true;
         }
+
         return false;
     }
 }
-

application/Espo/Classes/AclPortal/Note/AccessChecker.php

@@ -0,0 +1,189 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\AclPortal\Note;
+
+use Espo\Entities\User;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    Portal\AclManager,
+    Acl\ScopeData,
+    Acl\AccessEntityCREDChecker,
+    Portal\Acl\DefaultAccessChecker,
+    Portal\Acl\Traits\DefaultAccessCheckerDependency,
+    ORM\EntityManager,
+    Utils\Config,
+};
+
+use DateTime;
+use Exception;
+
+class AccessChecker implements AccessEntityCREDChecker
+{
+    use DefaultAccessCheckerDependency;
+
+    private const EDIT_PERIOD = '7 days';
+
+    private const DELETE_PERIOD = '1 month';
+
+    private $defaultAccessChecker;
+
+    private $aclManager;
+
+    private $entityManager;
+
+    private $config;
+
+    public function __construct(
+        DefaultAccessChecker $defaultAccessChecker,
+        AclManager $aclManager,
+        EntityManager $entityManager,
+        Config $config
+    ) {
+        $this->defaultAccessChecker = $defaultAccessChecker;
+        $this->aclManager = $aclManager;
+        $this->entityManager = $entityManager;
+        $this->config = $config;
+    }
+
+    public function checkEntityCreate(User $user, Entity $entity, ScopeData $data): bool
+    {
+        $parentId = $entity->get('parentId');
+        $parentType = $entity->get('parentType');
+
+        if (!$parentId || !$parentType) {
+            return $this->defaultAccessChecker->checkEntityCreate($user, $entity, $data);
+        }
+
+        $parent = $this->entityManager->getEntity($parentType, $parentId);
+
+        if ($parent && $this->aclManager->checkEntityStream($user, $parent)) {
+            return true;
+        }
+
+        return $this->defaultAccessChecker->checkEntityCreate($user, $entity, $data);
+    }
+
+    public function checkEntityRead(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if ($entity->get('type') !== 'Post') {
+            return false;
+        }
+
+        if ($entity->get('type') === 'Post' && $entity->get('targetType')) {
+            return false;
+        }
+
+        if (!$entity->get('parentId') || !$entity->get('parentType')) {
+            return false;
+        }
+
+        $parent = $this->entityManager->getEntity($entity->get('parentType'), $entity->get('parentId'));
+
+        if ($parent) {
+            if ($this->aclManager->checkEntityStream($user, $parent)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    public function checkEntityEdit(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if (!$this->defaultAccessChecker->checkEntityEdit($user, $entity, $data)) {
+            return false;
+        }
+
+        if (!$this->aclManager->checkOwnershipOwn($user, $entity)) {
+            return true;
+        }
+
+        $createdAt = $entity->get('createdAt');
+
+        if (!$createdAt) {
+            return true;
+        }
+
+        $noteEditThresholdPeriod =
+            '-' .  $this->config->get('noteEditThresholdPeriod', self::EDIT_PERIOD);
+
+        $dt = new DateTime();
+
+        $dt->modify($noteEditThresholdPeriod);
+
+        try {
+            if ($dt->format('U') > (new DateTime($createdAt))->format('U')) {
+                return false;
+            }
+        }
+        catch (Exception $e) {
+            return false;
+        }
+
+        return true;
+    }
+
+    public function checkEntityDelete(User $user, Entity $entity, ScopeData $data): bool
+    {
+        if (!$this->defaultAccessChecker->checkEntityDelete($user, $entity, $data)) {
+            return false;
+        }
+
+        if (!$this->aclManager->checkOwnershipOwn($user, $entity)) {
+            return true;
+        }
+
+        $createdAt = $entity->get('createdAt');
+
+        if (!$createdAt) {
+            return true;
+        }
+
+        $deleteThresholdPeriod =
+            '-' . $this->config->get('noteDeleteThresholdPeriod', self::DELETE_PERIOD);
+
+        $dt = new DateTime();
+
+        $dt->modify($deleteThresholdPeriod);
+
+        try {
+            if ($dt->format('U') > (new DateTime($createdAt))->format('U')) {
+                return false;
+            }
+        }
+        catch (Exception $e) {
+            return false;
+        }
+
+        return true;
+    }
+}

application/Espo/Classes/AclPortal/Note/OwnershipChecker.php

@@ -0,0 +1,50 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\AclPortal\Note;
+
+use Espo\Entities\User;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    Acl\OwnershipOwnChecker,
+};
+
+class OwnershipChecker implements OwnershipOwnChecker
+{
+    public function checkOwn(User $user, Entity $entity): bool
+    {
+        if ($entity->get('type') === 'Post' && $user->getId() === $entity->get('createdById')) {
+            return true;
+        }
+
+        return false;
+    }
+}

application/Espo/Classes/AclPortal/Notification/OwnershipChecker.php

@@ -27,23 +27,24 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Modules\Crm\AclPortal;
+namespace Espo\Classes\AclPortal\Notification;
 
 use Espo\Entities\User;
+
 use Espo\ORM\Entity;
 
-use Espo\Core\AclPortal\Acl;
+use Espo\Core\{
+    Acl\OwnershipOwnChecker,
+};
 
-class Contact extends Acl
+class OwnershipChecker implements OwnershipOwnChecker
 {
-    public function checkIsOwnContact(User $user, Entity $entity)
+    public function checkOwn(User $user, Entity $entity): bool
     {
-        $contactId = $user->get('contactId');
-        if ($contactId) {
-            if ($entity->id === $contactId) {
-                return true;
-            }
+        if ($user->getId() === $entity->get('userId')) {
+            return true;
         }
+
         return false;
     }
 }

application/Espo/Classes/AclPortal/User/OwnershipChecker.php

@@ -0,0 +1,46 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\AclPortal\User;
+
+use Espo\Entities\User;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    Acl\OwnershipOwnChecker,
+};
+
+class OwnershipChecker implements OwnershipOwnChecker
+{
+    public function checkOwn(User $user, Entity $entity): bool
+    {
+        return $user->getId() === $entity->getId();
+    }
+}

application/Espo/Classes/AddressFormatters/Formatter1.php

@@ -29,14 +29,14 @@
 
 namespace Espo\Classes\AddressFormatters;
 
-use Espo\Core\FieldUtils\Address\{
-    AddressFormatter,
-    AddressValue,
+use Espo\Core\{
+    Field\Address,
+    Field\Address\AddressFormatter,
 };
 
 class Formatter1 implements AddressFormatter
 {
-    public function format(AddressValue $address) : string
+    public function format(Address $address): string
     {
         $result = '';
 

application/Espo/Classes/AddressFormatters/Formatter2.php

@@ -29,14 +29,14 @@
 
 namespace Espo\Classes\AddressFormatters;
 
-use Espo\Core\FieldUtils\Address\{
-    AddressFormatter,
-    AddressValue,
+use Espo\Core\{
+    Field\Address,
+    Field\Address\AddressFormatter,
 };
 
 class Formatter2 implements AddressFormatter
 {
-    public function format(AddressValue $address) : string
+    public function format(Address $address): string
     {
         $result = '';
 

application/Espo/Classes/AddressFormatters/Formatter3.php

@@ -29,14 +29,14 @@
 
 namespace Espo\Classes\AddressFormatters;
 
-use Espo\Core\FieldUtils\Address\{
-    AddressFormatter,
-    AddressValue,
+use Espo\Core\{
+    Field\Address,
+    Field\Address\AddressFormatter,
 };
 
 class Formatter3 implements AddressFormatter
 {
-    public function format(AddressValue $address) : string
+    public function format(Address $address): string
     {
         $result = '';
 

application/Espo/Classes/AddressFormatters/Formatter4.php

@@ -29,14 +29,14 @@
 
 namespace Espo\Classes\AddressFormatters;
 
-use Espo\Core\FieldUtils\Address\{
-    AddressFormatter,
-    AddressValue,
+use Espo\Core\{
+    Field\Address,
+    Field\Address\AddressFormatter,
 };
 
 class Formatter4 implements AddressFormatter
 {
-    public function format(AddressValue $address) : string
+    public function format(Address $address): string
     {
         $result = '';
 

application/Espo/Classes/AppInfo/Binding.php

@@ -30,28 +30,26 @@
 namespace Espo\Classes\AppInfo;
 
 use Espo\Core\{
-    Utils\File\Manager as FileManager,
     Utils\Module,
     Binding\EspoBindingLoader,
     Binding\Binding as BindingItem,
+    Console\Command\Params,
 };
 
 class Binding
 {
-    protected $fileManager;
+    private $module;
 
-    public function __construct(FileManager $fileManager)
+    public function __construct(Module $module)
     {
-        $this->fileManager = $fileManager;
+        $this->module = $module;
     }
 
-    public function process(array $options, array $flagList) : ?string
+    public function process(Params $params): string
     {
         $result = '';
 
-        $bindingLoader = new EspoBindingLoader(
-            new Module($this->fileManager)
-        );
+        $bindingLoader = new EspoBindingLoader($this->module);
 
         $data = $bindingLoader->load();
 
@@ -78,7 +76,7 @@ class Binding
         return $result;
     }
 
-    private function printItem(string $key, BindingItem $binding) : string
+    private function printItem(string $key, BindingItem $binding): string
     {
         $result = '';
 
@@ -94,6 +92,7 @@ class Binding
             BindingItem::CONTAINER_SERVICE => 'Service',
             BindingItem::VALUE => 'Value',
             BindingItem::CALLBACK => 'Callback',
+            BindingItem::FACTORY_CLASS_NAME => 'Factory',
         ][$type];
 
         $result .= $tab . "Type:  {$typeString}\n";

application/Espo/Classes/AppInfo/Container.php

@@ -32,12 +32,14 @@ namespace Espo\Classes\AppInfo;
 use Espo\Core\{
     Container as ContainerService,
     Utils\Metadata,
+    Console\Command\Params,
 };
 
 class Container
 {
-    protected $container;
-    protected $metadata;
+    private $container;
+
+    private $metadata;
 
     public function __construct(ContainerService $container, Metadata $metadata)
     {
@@ -45,9 +47,9 @@ class Container
         $this->metadata = $metadata;
     }
 
-    public function process(array $options, array $flagList) : ?string
+    public function process(Params $params): string
     {
-        $nameOnly = in_array('nameOnly', $flagList);
+        $nameOnly = $params->hasFlag('nameOnly');
 
         $result = '';
 

application/Espo/Classes/AppInfo/Jobs.php

@@ -0,0 +1,68 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\AppInfo;
+
+use Espo\Core\Console\Command\Params;
+use Espo\Core\Utils\ClassFinder;
+use Espo\Core\Job\MetadataProvider;
+
+class Jobs
+{
+    private $classFinder;
+
+    private $metadataProvider;
+
+    public function __construct(ClassFinder $classFinder, MetadataProvider $metadataProvider)
+    {
+        $this->classFinder = $classFinder;
+        $this->metadataProvider = $metadataProvider;
+    }
+
+    public function process(Params $params): string
+    {
+        $result = "Available jobs:\n\n";
+
+        $list = array_map(
+            function ($item) {
+                return ' ' . $item;
+            },
+            array_unique(
+                array_merge(
+                    array_keys($this->classFinder->getMap('Jobs')),
+                    $this->metadataProvider->getScheduledJobNameList()
+                )
+            )
+        );
+
+        asort($list);
+
+        return $result . implode("\n", $list) . "\n";
+    }
+}

application/Espo/Classes/AppParams/TemplateEntityTypeList.php

@@ -31,7 +31,7 @@ namespace Espo\Classes\AppParams;
 
 use Espo\Core\{
     Acl,
-    Select\SelectManagerFactory,
+    Select\SelectBuilderFactory,
     ORM\EntityManager,
 };
 
@@ -41,17 +41,17 @@ use Espo\Core\{
 class TemplateEntityTypeList
 {
     protected $acl;
-    protected $selectManagerFactory;
+    protected $selectBuilderFactory;
     protected $entityManager;
 
-    public function __construct(Acl $acl, SelectManagerFactory $selectManagerFactory, EntityManager $entityManager)
+    public function __construct(Acl $acl, SelectBuilderFactory $selectBuilderFactory, EntityManager $entityManager)
     {
         $this->acl = $acl;
-        $this->selectManagerFactory = $selectManagerFactory;
+        $this->selectBuilderFactory = $selectBuilderFactory;
         $this->entityManager = $entityManager;
     }
 
-    public function get()
+    public function get() : array
     {
         if (!$this->acl->checkScope('Template')) {
             return [];
@@ -59,17 +59,21 @@ class TemplateEntityTypeList
 
         $list = [];
 
-        $selectManager = $this->selectManagerFactory->create('Template');
-
-        $selectParams = $selectManager->getEmptySelectParams();
-        $selectManager->applyAccess($selectParams);
-
-        $templateList = $this->entityManager->getRepository('Template')
+        $query = $this->selectBuilderFactory
+            ->create()
+            ->from('Template')
+            ->withAccessControlFilter()
+            ->buildQueryBuilder()
             ->select(['entityType'])
-            ->groupBy(['entityType'])
-            ->find($selectParams);
+            ->group(['entityType'])
+            ->build();
 
-        foreach ($templateList as $template) {
+        $templateCollection = $this->entityManager
+            ->getRepository('Template')
+            ->clone($query)
+            ->find();
+
+        foreach ($templateCollection as $template) {
             $list[] = $template->get('entityType');
         }
 

application/Espo/Classes/AssignmentNotificators/Email.php

@@ -27,78 +27,93 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Notificators;
-
-use Espo\ORM\Entity;
-
-use Espo\Core\Notificators\DefaultNotificator;
+namespace Espo\Classes\AssignmentNotificators;
 
 use Espo\Services\Email as EmailService;
+use Espo\Services\Stream as StreamService;
+
+use Espo\Core\Notification\AssignmentNotificator;
+use Espo\Core\Notification\AssignmentNotificator\Params;
+use Espo\Core\Notification\UserEnabledChecker;
+use Espo\Core\ServiceFactory;
+use Espo\Core\AclManager;
+
+use Espo\ORM\EntityManager;
+use Espo\ORM\Entity;
 
 use Espo\Entities\User;
+use Espo\Entities\Notification;
 
-use Espo\Core\{
-    ORM\EntityManager,
-    ServiceFactory,
-    AclManager,
-};
+use DateTime;
+use Exception;
 
-class Email extends DefaultNotificator
+class Email implements AssignmentNotificator
 {
-    const DAYS_THRESHOLD = 2;
+    private const DAYS_THRESHOLD = 2;
 
     private $streamService = null;
 
-    protected $user;
-    protected $entityManager;
-    protected $serviceFactory;
-    protected $aclManager;
+    private $user;
+
+    private $entityManager;
+
+    private $serviceFactory;
+
+    private $aclManager;
+
+    private $userChecker;
 
     public function __construct(
         User $user,
         EntityManager $entityManager,
+        UserEnabledChecker $userChecker,
         ServiceFactory $serviceFactory,
         AclManager $aclManager
     ) {
         $this->user = $user;
         $this->entityManager = $entityManager;
+        $this->userChecker = $userChecker;
         $this->serviceFactory = $serviceFactory;
         $this->aclManager = $aclManager;
     }
 
-    protected function getStreamService()
-    {
-        if (empty($this->streamService)) {
-            $this->streamService = $this->serviceFactory->create('Stream');
-        }
-        return $this->streamService;
-    }
-
-    public function process(Entity $entity, array $options = [])
+    public function process(Entity $entity, Params $params): void
     {
         if (!in_array($entity->get('status'), ['Archived', 'Sent', 'Being Imported'])) {
             return;
         }
 
-        if (!empty($options['isJustSent'])) {
+        if ($params->getOption('isJustSent')) {
             $previousUserIdList = [];
-        } else {
+        }
+        else {
             $previousUserIdList = $entity->getFetched('usersIds');
+
             if (!is_array($previousUserIdList)) {
                 $previousUserIdList = [];
             }
         }
 
         $dateSent = $entity->get('dateSent');
-        if (!$dateSent) return;
 
-        $dt = null;
+        if (!$dateSent) {
+            return;
+        }
+
         try {
-            $dt = new \DateTime($dateSent);
-        } catch (\Exception $e) {}
-        if (!$dt) return;
+            $dt = new DateTime($dateSent);
+        }
+        catch (Exception $e) {
+            return;
+        }
 
-        if ($dt->diff(new \DateTime())->days > self::DAYS_THRESHOLD) return;
+        if (!$dt) {
+            return;
+        }
+
+        if ($dt->diff(new DateTime())->days > self::DAYS_THRESHOLD) {
+            return;
+        }
 
         $emailUserIdList = $entity->get('usersIds');
 
@@ -107,14 +122,19 @@ class Email extends DefaultNotificator
         }
 
         $userIdList = [];
+
         foreach ($emailUserIdList as $userId) {
-            if (!in_array($userId, $userIdList) && !in_array($userId, $previousUserIdList) && $userId != $this->user->id) {
+            if (
+                !in_array($userId, $userIdList) &&
+                !in_array($userId, $previousUserIdList) &&
+                $userId !== $this->user->getId()
+            ) {
                 $userIdList[] = $userId;
             }
         }
 
         $data = [
-            'emailId' => $entity->id,
+            'emailId' => $entity->getId(),
             'emailName' => $entity->get('name'),
         ];
 
@@ -125,54 +145,81 @@ class Email extends DefaultNotificator
         if (!$entity->has('to')) {
             $this->entityManager->getRepository('Email')->loadToField($entity);
         }
+
         $person = null;
 
         $from = $entity->get('from');
+
         if ($from) {
-            $person = $this->entityManager->getRepository('EmailAddress')
+            $person = $this->entityManager
+                ->getRepository('EmailAddress')
                 ->getEntityByAddress($from, null, ['User', 'Contact', 'Lead']);
+
             if ($person) {
                 $data['personEntityType'] = $person->getEntityType();
                 $data['personEntityName'] = $person->get('name');
-                $data['personEntityId'] = $person->id;
+                $data['personEntityId'] = $person->getId();
             }
         }
 
         $userIdFrom = null;
-        if ($person && $person->getEntityType() == 'User') {
+
+        if ($person && $person->getEntityType() === 'User') {
             $userIdFrom = $person->id;
         }
 
         if (empty($data['personEntityId'])) {
             $data['fromString'] = EmailService::parseFromName($entity->get('fromString'));
+
             if (empty($data['fromString']) && $from) {
                 $data['fromString'] = $from;
             }
         }
 
         $parent = null;
+
         if ($entity->get('parentId') && $entity->get('parentType')) {
             $parent = $this->entityManager->getEntity($entity->get('parentType'), $entity->get('parentId'));
         }
+
         $account = null;
+
         if ($entity->get('accountId')) {
             $account = $this->entityManager->getEntity('Account', $entity->get('accountId'));
         }
 
         foreach ($userIdList as $userId) {
-            if (!$userId) continue;
-            if ($userIdFrom === $userId) continue;
-            if ($entity->getLinkMultipleColumn('users', 'inTrash', $userId)) continue;
-            if (!$this->isNotificationsEnabledForUser($userId)) return;
+            if (!$userId) {
+                continue;
+            }
 
-            if (!empty($options['isBeingImported']) || !empty($options['isJustSent'])) {
+            if ($userIdFrom === $userId) {
+                continue;
+            }
+
+            if ($entity->getLinkMultipleColumn('users', 'inTrash', $userId)) {
+                continue;
+            }
+
+            if (!$this->userChecker->checkAssignment('Email', $userId)) {
+                continue;
+            }
+
+            if (
+                $params->getOption('isBeingImported') ||
+                $params->getOption('isJustSent')
+            ) {
                 $folderId = $entity->getLinkMultipleColumn('users', 'folderId', $userId);
+
                 if ($folderId) {
                     if (
-                        $this->entityManager->getRepository('EmailFolder')->where([
-                            'id' => $folderId,
-                            'skipNotifications' => true
-                        ])->count()
+                        $this->entityManager
+                            ->getRepository('EmailFolder')
+                            ->where([
+                                'id' => $folderId,
+                                'skipNotifications' => true,
+                            ])
+                            ->count()
                     ) {
                         continue;
                     }
@@ -180,41 +227,70 @@ class Email extends DefaultNotificator
             }
 
             $user = $this->entityManager->getEntity('User', $userId);
-            if (!$user) continue;
-            if ($user->isPortal()) continue;
+
+            if (!$user) {
+                continue;
+            }
+
+            if ($user->isPortal()) {
+                continue;
+            }
+
             if (!$this->aclManager->checkScope($user, 'Email')) {
                 continue;
             }
-            if ($entity->get('status') == 'Archived' || !empty($options['isBeingImported'])) {
-                if ($parent) {
-                    if ($this->getStreamService()->checkIsFollowed($parent, $userId)) {
-                        continue;
-                    }
-                }
-                if ($account) {
-                    if ($this->getStreamService()->checkIsFollowed($account, $userId)) {
-                        continue;
-                    }
-                }
-            }
-            if (
-                $this->entityManager->getRepository('Notification')->where([
-                    'type' => 'EmailReceived',
-                    'userId' => $userId,
-                    'relatedId' => $entity->id,
-                    'relatedType' => 'Email',
-                ])->select(['id'])->findOne()
-            ) continue;
 
-            $notification = $this->entityManager->getEntity('Notification');
-            $notification->set([
-                'type' => 'EmailReceived',
+            $isArchivedOrBeingImported =
+                $entity->get('status') === 'Archived' ||
+                $params->getOption('isBeingImported');
+
+            if (
+                $isArchivedOrBeingImported &&
+                $parent &&
+                $this->getStreamService()->checkIsFollowed($parent, $userId)
+            ) {
+                continue;
+            }
+
+            if (
+                $isArchivedOrBeingImported &&
+                $account &&
+                $this->getStreamService()->checkIsFollowed($account, $userId)
+            ) {
+                continue;
+            }
+
+            $existing = $this->entityManager
+                ->getRepository(Notification::ENTITY_TYPE)
+                ->where([
+                    'type' => Notification::TYPE_EMAIL_RECEIVED,
+                    'userId' => $userId,
+                    'relatedId' => $entity->getId(),
+                    'relatedType' => 'Email',
+                ])
+                ->select(['id'])
+                ->findOne();
+
+            if ($existing) {
+                continue;
+            }
+
+            $this->entityManager->createEntity(Notification::ENTITY_TYPE, [
+                'type' => Notification::TYPE_EMAIL_RECEIVED,
                 'userId' => $userId,
                 'data' => $data,
-                'relatedId' => $entity->id,
+                'relatedId' => $entity->getId(),
                 'relatedType' => 'Email',
             ]);
-            $this->entityManager->saveEntity($notification);
         }
     }
+
+    private function getStreamService(): StreamService
+    {
+        if (empty($this->streamService)) {
+            $this->streamService = $this->serviceFactory->create('Stream');
+        }
+
+        return $this->streamService;
+    }
 }

application/Espo/Classes/Cleanup/Reminders.php

@@ -29,17 +29,19 @@
 
 namespace Espo\Classes\Cleanup;
 
-use Espo\Core\{
-    Utils\Config,
-    ORM\EntityManager,
-};
+use Espo\Core\Cleanup\Cleanup;
+use Espo\Core\Utils\Config;
+use Espo\ORM\EntityManager;
 
 use DateTime;
 
-class Reminders
+class Reminders implements Cleanup
 {
-    protected $config;
-    protected $entityManager;
+    private $config;
+
+    private $entityManager;
+
+    private $cleanupRemindersPeriod = '15 days';
 
     public function __construct(Config $config, EntityManager $entityManager)
     {
@@ -47,9 +49,7 @@ class Reminders
         $this->entityManager = $entityManager;
     }
 
-    protected $cleanupRemindersPeriod = '15 days';
-
-    public function process()
+    public function process(): void
     {
         $period = '-' . $this->config->get('cleanupRemindersPeriod', $this->cleanupRemindersPeriod);
 
@@ -57,7 +57,8 @@ class Reminders
 
         $dt->modify($period);
 
-        $delete = $this->entityManager->getQueryBuilder()
+        $delete = $this->entityManager
+            ->getQueryBuilder()
             ->delete()
             ->from('Reminder')
             ->where([

application/Espo/Classes/Cleanup/TwoFactorCodes.php

@@ -0,0 +1,77 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Cleanup;
+
+use Espo\Core\Cleanup\Cleanup;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\DateTime as DateTimeUtil;
+
+use Espo\ORM\EntityManager;
+
+use Espo\Entities\TwoFactorCode;
+
+use DateTime;
+
+class TwoFactorCodes implements Cleanup
+{
+    private const PERIOD = '5 days';
+
+    private $config;
+
+    private $entityManager;
+
+    public function __construct(Config $config, EntityManager $entityManager)
+    {
+        $this->config = $config;
+        $this->entityManager = $entityManager;
+    }
+
+    public function process(): void
+    {
+        $period = '-' . $this->config->get('cleanupTwoFactorCodesPeriod', self::PERIOD);
+
+        $from = (new DateTime())
+            ->modify($period)
+            ->format(DateTimeUtil::SYSTEM_DATE_TIME_FORMAT);
+
+        $query = $this->entityManager
+            ->getQueryBuilder()
+            ->delete()
+            ->from(TwoFactorCode::ENTITY_TYPE)
+            ->where([
+                'createdAt<' => $from,
+            ])
+            ->build();
+
+        $this->entityManager
+            ->getQueryExecutor()
+            ->execute($query);
+    }
+}

application/Espo/Classes/Cleanup/WebhookQueue.php

@@ -29,19 +29,19 @@
 
 namespace Espo\Classes\Cleanup;
 
-use Espo\Core\{
-    Utils\Config,
-    ORM\EntityManager,
-};
+use Espo\Core\Cleanup\Cleanup;
+use Espo\Core\Utils\Config;
+use Espo\ORM\EntityManager;
 
 use DateTime;
 
-class WebhookQueue
+class WebhookQueue implements Cleanup
 {
-    protected $cleanupWebhookQueuePeriod = '10 days';
+    private $cleanupWebhookQueuePeriod = '10 days';
 
-    protected $config;
-    protected $entityManager;
+    private $config;
+
+    private $entityManager;
 
     public function __construct(Config $config, EntityManager $entityManager)
     {
@@ -49,7 +49,7 @@ class WebhookQueue
         $this->entityManager = $entityManager;
     }
 
-    public function process()
+    public function process(): void
     {
         $period = '-' . $this->config->get('cleanupWebhookQueuePeriod', $this->cleanupWebhookQueuePeriod);
 
@@ -58,7 +58,8 @@ class WebhookQueue
         $datetime->modify($period);
         $from = $datetime->format('Y-m-d H:i:s');
 
-        $query = $this->entityManager->getQueryBuilder()
+        $query1 = $this->entityManager
+            ->getQueryBuilder()
             ->delete()
             ->from('WebhookQueueItem')
             ->where([
@@ -70,9 +71,10 @@ class WebhookQueue
             ])
             ->build();
 
-        $this->entityManager->getQueryExecutor()->execute($query);
+        $this->entityManager->getQueryExecutor()->execute($query1);
 
-        $query = $this->entityManager->getQueryBuilder()
+        $query2 = $this->entityManager
+            ->getQueryBuilder()
             ->delete()
             ->from('WebhookEventQueueItem')
             ->where([
@@ -84,6 +86,6 @@ class WebhookQueue
             ])
             ->build();
 
-        $this->entityManager->getQueryExecutor()->execute($query);
+        $this->entityManager->getQueryExecutor()->execute($query2);
     }
 }

application/Espo/Classes/ConsoleCommands/Import.php

@@ -29,42 +29,43 @@
 
 namespace Espo\Classes\ConsoleCommands;
 
+use Espo\Tools\Import\Service;
+
 use Espo\Core\{
-    ServiceFactory,
-    Console\Commands\Command,
+    Console\Command,
+    Console\Command\Params,
+    Console\IO,
 };
 
 use Throwable;
 
 class Import implements Command
 {
-    protected $serviceFactory;
+    private $service;
 
-    public function __construct(ServiceFactory $serviceFactory)
+    public function __construct(Service $service)
     {
-        $this->serviceFactory = $serviceFactory;
+        $this->service = $service;
     }
 
-    public function run(array $options, array $flagList)
+    public function run(Params $params, IO $io) : void
     {
-        $id = $options['id'] ?? null;
-        $filePath = $options['file'] ?? null;
-        $paramsId = $options['paramsId'] ?? null;
+        $id = $params->getOption('id');
+        $filePath = $params->getOption('file');
+        $paramsId = $params->getOption('paramsId');
 
-        $service = $this->serviceFactory->create('Import');
-
-        $forceResume = in_array('resume', $flagList);
-        $revert = in_array('revert', $flagList);
+        $forceResume = $params->hasFlag('resume');
+        $revert = $params->hasFlag('revert');
 
         if (!$id && $filePath) {
             if (!$paramsId) {
-                $this->out("You need to specify --params-id option.\n");
+                $io->writeLine("You need to specify --params-id option.");
 
                 return;
             }
 
             if (!file_exists($filePath)) {
-                $this->out("File not found.\n");
+                $io->writeLine("File not found.");
 
                 return;
             }
@@ -72,67 +73,60 @@ class Import implements Command
             $contents = file_get_contents($filePath);
 
             try {
-                $result = $service->importFileWithParamsId($contents, $paramsId);
+                $result = $this->service->importContentsWithParamsId($contents, $paramsId);
 
-                $resultId = $result->id;
-                $countCreated = $result->countCreated;
-                $countUpdated = $result->countUpdated;
+                $resultId = $result->getId();
+                $countCreated = $result->getCountCreated();
+                $countUpdated = $result->getCountUpdated();
             }
             catch (Throwable $e) {
-                $this->out("Error occured: ".$e->getMessage()."\n");
+                $io->writeLine("Error occurred: ". $e->getMessage() . "");
 
                 return;
             }
 
-            $this->out("Finished. Import ID: {$resultId}. Created: {$countCreated}. Updated: {$countUpdated}.\n");
+            $io->writeLine("Finished. Import ID: {$resultId}. Created: {$countCreated}. Updated: {$countUpdated}.");
 
             return;
         }
 
         if ($id && $revert) {
-            $this->out("Reverting import...\n");
+            $io->writeLine("Reverting import...");
 
             try {
-                $service->revert($id);
+                $this->service->revert($id);
             }
             catch (Throwable $e) {
-                $this->out("Error occured: " . $e->getMessage() . "\n");
+                $io->writeLine("Error occurred: " . $e->getMessage() . "");
 
                 return;
             }
 
-            $this->out("Finished.\n");
+            $io->writeLine("Finished.");
 
             return;
         }
 
         if ($id) {
-            $this->out("Running import, this may take a while...\n");
+            $io->writeLine("Running import, this may take a while...");
 
             try {
-                $result = $service->importById($id, true, $forceResume);
+                $result = $this->service->importById($id, true, $forceResume);
             }
             catch (Throwable $e) {
-                $this->out("Error occured: " . $e->getMessage() . "\n");
+                $io->writeLine("Error occurred: " . $e->getMessage() . "");
 
                 return;
             }
 
-            $countCreated = $result->countCreated;
-            $countUpdated = $result->countUpdated;
+            $countCreated = $result->getCountCreated();
+            $countUpdated = $result->getCountUpdated();
 
-            $this->out("Finished. Created: {$countCreated}. Updated: {$countUpdated}.\n");
+            $io->writeLine("Finished. Created: {$countCreated}. Updated: {$countUpdated}.");
 
             return;
         }
 
-        $this->out("Not enough params passed.\n");
-
-        return;
-    }
-
-    protected function out($string)
-    {
-        fwrite(\STDOUT, $string);
+        $io->writeLine("Not enough params passed.");
     }
 }

application/Espo/Classes/DefaultLayouts/DefaultSidePanelType.php

@@ -40,7 +40,7 @@ class DefaultSidePanelType
         $this->metadata = $metadata;
     }
 
-    public function get(string $scope) : array
+    public function get(string $scope): array
     {
         $list = [];
 

application/Espo/Classes/DuplicateWhereBuilders/Company.php

@@ -0,0 +1,104 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\DuplicateWhereBuilders;
+
+use Espo\Core\Duplicate\WhereBuilder;
+
+use Espo\ORM\{
+    Query\Part\Condition as Cond,
+    Query\Part\WhereItem,
+    Query\Part\Where\OrGroup,
+    Entity,
+};
+
+class Company implements WhereBuilder
+{
+    public function build(Entity $entity): ?WhereItem
+    {
+        $orBuilder = OrGroup::createBuilder();
+
+        $toCheck = false;
+
+        if ($entity->get('name')) {
+            $orBuilder->add(
+                Cond::equal(
+                    Cond::column('name'),
+                    $entity->get('name')
+                ),
+            );
+
+            $toCheck = true;
+        }
+
+        if (
+            ($entity->get('emailAddress') || $entity->get('emailAddressData')) &&
+            (
+                $entity->isNew() ||
+                $entity->isAttributeChanged('emailAddress') ||
+                $entity->isAttributeChanged('emailAddressData')
+            )
+        ) {
+            foreach ($this->getEmailAddressList($entity) as $emailAddress) {
+                $orBuilder->add(
+                    Cond::equal(
+                        Cond::column('emailAddress'),
+                        $emailAddress
+                    )
+                );
+
+                $toCheck = true;
+            }
+        }
+
+        if (!$toCheck) {
+            return null;
+        }
+
+        return $orBuilder->build();
+    }
+
+    private function getEmailAddressList(Entity $entity): array
+    {
+        if ($entity->get('emailAddressData')) {
+            /* @var $eaGroup EmailAddressGroup */
+            $eaGroup = $entity->getValueObject('emailAddress');
+
+            return $eaGroup->getAddressList();
+        }
+
+        if ($entity->get('emailAddress')) {
+            return [
+                $entity->get('emailAddress')
+            ];
+        }
+
+        return [];
+    }
+}

application/Espo/Classes/DuplicateWhereBuilders/Person.php

@@ -0,0 +1,113 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\DuplicateWhereBuilders;
+
+use Espo\Core\{
+    Duplicate\WhereBuilder,
+    Field\EmailAddressGroup,
+};
+
+use Espo\ORM\{
+    Query\Part\Condition as Cond,
+    Query\Part\WhereItem,
+    Query\Part\Where\OrGroup,
+    Entity,
+};
+
+class Person implements WhereBuilder
+{
+    public function build(Entity $entity): ?WhereItem
+    {
+        $orBuilder = OrGroup::createBuilder();
+
+        $toCheck = false;
+
+        if ($entity->get('firstName') || $entity->get('lastName')) {
+            $orBuilder->add(
+                Cond::and(
+                    Cond::equal(
+                        Cond::column('firstName'),
+                        $entity->get('firstName')
+                    ),
+                    Cond::equal(
+                        Cond::column('lastName'),
+                        $entity->get('lastName')
+                    )
+                )
+            );
+
+            $toCheck = true;
+        }
+
+        if (
+            ($entity->get('emailAddress') || $entity->get('emailAddressData')) &&
+            (
+                $entity->isNew() ||
+                $entity->isAttributeChanged('emailAddress') ||
+                $entity->isAttributeChanged('emailAddressData')
+            )
+        ) {
+            foreach ($this->getEmailAddressList($entity) as $emailAddress) {
+                $orBuilder->add(
+                    Cond::equal(
+                        Cond::column('emailAddress'),
+                        $emailAddress
+                    )
+                );
+
+                $toCheck = true;
+            }
+        }
+
+        if (!$toCheck) {
+            return null;
+        }
+
+        return $orBuilder->build();
+    }
+
+    private function getEmailAddressList(Entity $entity): array
+    {
+        if ($entity->get('emailAddressData')) {
+            /* @var $eaGroup EmailAddressGroup */
+            $eaGroup = $entity->getValueObject('emailAddress');
+
+            return $eaGroup->getAddressList();
+        }
+
+        if ($entity->get('emailAddress')) {
+            return [
+                $entity->get('emailAddress')
+            ];
+        }
+
+        return [];
+    }
+}

application/Espo/Classes/FieldProcessing/Email/AddressDataLoader.php

@@ -0,0 +1,63 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldProcessing\Email;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    FieldProcessing\Loader,
+    FieldProcessing\Loader\Params,
+    ORM\EntityManager,
+};
+
+use Espo\Repositories\Email as EmailRepository;
+
+class AddressDataLoader implements Loader
+{
+    private $entityManager;
+
+    public function __construct(EntityManager $entityManager)
+    {
+        $this->entityManager = $entityManager;
+    }
+
+    public function process(Entity $entity, Params $params): void
+    {
+        /* @var $repository EmailRepository */
+        $repository = $this->entityManager->getRepository('Email');
+
+        $repository->loadFromField($entity);
+        $repository->loadToField($entity);
+        $repository->loadCcField($entity);
+        $repository->loadBccField($entity);
+        $repository->loadReplyToField($entity);
+        $repository->loadNameHash($entity);
+    }
+}

application/Espo/Classes/FieldProcessing/Email/IcsDataLoader.php

@@ -0,0 +1,205 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldProcessing\Email;
+
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+use Espo\Repositories\EmailAddress as EmailAddressRepository;
+use Espo\Entities\EmailAddress;
+use Espo\Entities\Email;
+
+use Espo\Core\{
+    FieldProcessing\Loader,
+    FieldProcessing\Loader\Params,
+    Mail\Event\Event as EspoEvent,
+    Mail\Event\EventFactory,
+    Utils\Log,
+};
+
+use ICal\ICal;
+use ICal\Event;
+
+use Throwable;
+
+class IcsDataLoader implements Loader
+{
+    private $entityManager;
+
+    private $log;
+
+    private $entityTypeLinkMap = [
+        'User' => 'users',
+        'Contact' => 'contacts',
+        'Lead' => 'leads',
+    ];
+
+    public function __construct(EntityManager $entityManager, Log $log)
+    {
+        $this->entityManager = $entityManager;
+        $this->log = $log;
+    }
+
+    public function process(Entity $entity, Params $params): void
+    {
+        $icsContents = $entity->get('icsContents');
+
+        if ($icsContents === null) {
+            return;
+        }
+
+        $ical = new ICal();
+
+        $ical->initString($icsContents);
+
+        /* @var $event Event */
+        $event = $ical->events()[0] ?? null;
+
+        if ($event === null) {
+            return;
+        }
+
+        if ($event->status === 'CANCELLED') {
+            return;
+        }
+
+        $espoEvent = EventFactory::createFromU01jmg3Ical($ical);
+
+        $valueMap = (object) [
+            'sourceEmailId' => $entity->getId(),
+        ];
+
+        try {
+            $valueMap->name = $espoEvent->getName();
+            $valueMap->description = $espoEvent->getDescription();
+            $valueMap->dateStart = $espoEvent->getDateStart();
+            $valueMap->dateEnd = $espoEvent->getDateEnd();
+            $valueMap->location = $espoEvent->getLocation();
+            $valueMap->isAllDay = $espoEvent->isAllDay();
+
+            if ($espoEvent->isAllDay()) {
+                $valueMap->dateStartDate = $espoEvent->getDateStart();
+                $valueMap->dateEndDate = $espoEvent->getDateEnd();
+            }
+        }
+        catch (Throwable $e) {
+            $this->log->warning("Error while converting ICS event '" . $entity->getId() . "': " . $e->getMessage());
+
+            return;
+        }
+
+        /* @var $emailAddressRepository EmailAddressRepository */
+        $emailAddressRepository = $this->entityManager->getRepository(EmailAddress::ENTITY_TYPE);
+
+        $attendeeEmailAddressList = $espoEvent->getAttendeeEmailAddressList();
+
+        $organizerEmailAddress = $espoEvent->getOrganizerEmailAddress();
+
+        if ($organizerEmailAddress) {
+            $attendeeEmailAddressList[] = $organizerEmailAddress;
+        }
+
+        foreach ($attendeeEmailAddressList as $address) {
+            $personEntity = $emailAddressRepository->getEntityByAddress($address);
+
+            if (!$personEntity) {
+                continue;
+            }
+
+            $link = $this->entityTypeLinkMap[$personEntity->getEntityType()] ?? null;
+
+            if (!$link) {
+                continue;
+            }
+
+            $idsAttribute = $link . 'Ids';
+            $namesAttribute = $link . 'Names';
+
+            $idList = $valueMap->$idsAttribute ?? [];
+            $nameMap = $valueMap->$namesAttribute ?? (object) [];
+
+            $idList[] = $personEntity->getId();
+            $nameMap->{$personEntity->getId()} = $personEntity->get('name');
+
+            $valueMap->$idsAttribute = $idList;
+            $valueMap->$namesAttribute = $nameMap;
+        }
+
+        $eventData = (object) [
+            'valueMap' => $valueMap,
+            'uid' => $espoEvent->getUid(),
+            'createdEvent' => null,
+        ];
+
+        $this->loadCreatedEvent($entity, $espoEvent, $eventData);
+
+        $entity->set('icsEventData', $eventData);
+
+        $entity->set('icsEventDateStart', $espoEvent->getDateStart());
+
+        if ($espoEvent->isAllDay()) {
+            $entity->set('icsEventDateStartDate', $espoEvent->getDateStart());
+        }
+    }
+
+    private function loadCreatedEvent(Entity $entity, EspoEvent $espoEvent, object $eventData): void
+    {
+        $emailSameEvent = $this->entityManager
+            ->getRDBRepository(Email::ENTITY_TYPE)
+            ->where([
+                'icsEventUid' => $espoEvent->getUid(),
+                'id!=' => $entity->getId()
+            ])
+            ->findOne();
+
+        if (!$emailSameEvent) {
+            return;
+        }
+
+        if (
+            !$emailSameEvent->get('createdEventId') ||
+            !$emailSameEvent->get('createdEventType')
+        ) {
+            return;
+        }
+
+        $createdEvent = $this->entityManager
+            ->getEntity($emailSameEvent->get('createdEventType'), $emailSameEvent->get('createdEventId'));
+
+        if (!$createdEvent) {
+            return;
+        }
+
+        $eventData->createdEvent = (object) [
+            'id' => $createdEvent->getId(),
+            'entityType' => $emailSameEvent->getEntityType(),
+            'name' => $createdEvent->get('name'),
+        ];
+    }
+}

application/Espo/Classes/FieldProcessing/Email/StringDataLoader.php

@@ -0,0 +1,122 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldProcessing\Email;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    FieldProcessing\Loader,
+    FieldProcessing\Loader\Params,
+    ORM\EntityManager,
+};
+
+use Espo\Entities\Email;
+use Espo\Entities\User;
+
+class StringDataLoader implements Loader
+{
+    private $entityManager;
+
+    private $user;
+
+    private $fromEmailAddressNameCache = [];
+
+    public function __construct(EntityManager $entityManager, User $user)
+    {
+        $this->entityManager = $entityManager;
+        $this->user = $user;
+    }
+
+    public function process(Entity $entity, Params $params): void
+    {
+        $userEmailAdddressIdList = [];
+
+        $emailAddressCollection = $this->entityManager
+            ->getRDBRepository('User')
+            ->getRelation($this->user, 'emailAddresses')
+            ->select(['id'])
+            ->find();
+
+        foreach ($emailAddressCollection as $emailAddress) {
+            $userEmailAdddressIdList[] = $emailAddress->getId();
+        }
+
+        if (
+            in_array($entity->get('fromEmailAddressId'), $userEmailAdddressIdList) ||
+            $entity->get('createdById') === $this->user->getId() && $entity->get('status') === Email::STATUS_SENT
+        ) {
+            $entity->loadLinkMultipleField('toEmailAddresses');
+
+            $idList = $entity->get('toEmailAddressesIds');
+            $names = $entity->get('toEmailAddressesNames');
+
+            if (empty($idList)) {
+                return;
+            }
+
+            $list = [];
+
+            foreach ($idList as $emailAddressId) {
+                $person = $this->entityManager
+                    ->getRepository('EmailAddress')
+                    ->getEntityByAddressId($emailAddressId, null, true);
+
+                $list[] = $person ? $person->get('name') : $names->$emailAddressId;
+            }
+
+            $entity->set('personStringData', 'To: ' . implode(', ', $list));
+
+            return;
+        }
+
+        $fromEmailAddressId = $entity->get('fromEmailAddressId');
+
+        if (!$fromEmailAddressId) {
+            return;
+        }
+
+        if (!array_key_exists($fromEmailAddressId, $this->fromEmailAddressNameCache)) {
+            $person = $this->entityManager
+                ->getRepository('EmailAddress')
+                ->getEntityByAddressId($fromEmailAddressId, null, true);
+
+            $fromName = $person ? $person->get('name') : null;
+
+            $this->fromEmailAddressNameCache[$fromEmailAddressId] = $fromName;
+        }
+
+        $fromName =
+            $this->fromEmailAddressNameCache[$fromEmailAddressId] ??
+            $entity->get('fromName') ??
+            $entity->get('fromEmailAddressName');
+
+        $entity->set('personStringData', $fromName);
+    }
+}

application/Espo/Classes/FieldProcessing/Email/UserColumnsLoader.php

@@ -0,0 +1,80 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldProcessing\Email;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    FieldProcessing\Loader,
+    FieldProcessing\Loader\Params,
+    ORM\EntityManager,
+};
+
+use Espo\Entities\User;
+
+class UserColumnsLoader implements Loader
+{
+    private $entityManager;
+
+    private $user;
+
+    public function __construct(EntityManager $entityManager, User $user)
+    {
+        $this->entityManager = $entityManager;
+        $this->user = $user;
+    }
+
+    public function process(Entity $entity, Params $params): void
+    {
+        $emailUser = $this->entityManager
+            ->getRepository('EmailUser')
+            ->select(['isRead', 'isImportant', 'inTrash'])
+            ->where([
+                'deleted' => false,
+                'userId' => $this->user->getId(),
+                'emailId' => $entity->getId(),
+            ])
+            ->findOne();
+
+        if (!$emailUser) {
+            $entity->set('isRead', null);
+            $entity->clear('isImportant');
+            $entity->clear('inTrash');
+
+            return;
+        }
+
+        $entity->set([
+            'isRead' => $emailUser->get('isRead'),
+            'isImportant' => $emailUser->get('isImportant'),
+            'inTrash' => $emailUser->get('inTrash'),
+        ]);
+    }
+}

application/Espo/Classes/FieldProcessing/Import/CountsLoader.php

@@ -0,0 +1,66 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldProcessing\Import;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    FieldProcessing\Loader,
+    FieldProcessing\Loader\Params,
+    ORM\EntityManager,
+};
+
+use Espo\Repositories\Import as ImportRepository;
+
+class CountsLoader implements Loader
+{
+    private $entityManager;
+
+    public function __construct(EntityManager $entityManager)
+    {
+        $this->entityManager = $entityManager;
+    }
+
+    public function process(Entity $entity, Params $params): void
+    {
+        /* @var $repository ImportRepository */
+        $repository = $this->entityManager->getRepository('Import');
+
+        $importedCount = $repository->countResultRecords($entity, 'imported');
+        $duplicateCount = $repository->countResultRecords($entity, 'duplicates');
+        $updatedCount = $repository->countResultRecords($entity, 'updated');
+
+        $entity->set([
+            'importedCount' => $importedCount,
+            'duplicateCount' => $duplicateCount,
+            'updatedCount' => $updatedCount,
+        ]);
+    }
+}

application/Espo/Classes/FieldProcessing/Note/AttachmentsLoader.php

@@ -0,0 +1,48 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldProcessing\Note;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    FieldProcessing\Loader,
+    FieldProcessing\Loader\Params,
+};
+
+use Espo\Entities\Note;
+
+class AttachmentsLoader implements Loader
+{
+    public function process(Entity $entity, Params $params): void
+    {
+        /* @var $entity Note */
+        $entity->loadAttachments();
+    }
+}

application/Espo/Classes/FieldProcessing/Portal/UrlLoader.php

@@ -0,0 +1,55 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldProcessing\Portal;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    FieldProcessing\Loader,
+    FieldProcessing\Loader\Params,
+    ORM\EntityManager,
+};
+
+class UrlLoader implements Loader
+{
+    private $entityManager;
+
+    public function __construct(EntityManager $entityManager)
+    {
+        $this->entityManager = $entityManager;
+    }
+
+    public function process(Entity $entity, Params $params): void
+    {
+        $this->entityManager
+            ->getRepository('Portal')
+            ->loadUrlField($entity);
+    }
+}

application/Espo/Classes/FieldProcessing/User/LastAccessLoader.php

@@ -0,0 +1,112 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldProcessing\User;
+
+use Espo\ORM\Entity;
+
+use Espo\Core\{
+    FieldProcessing\Loader,
+    FieldProcessing\Loader\Params,
+    ORM\EntityManager,
+    Acl,
+    Acl\Table,
+};
+
+use DateTime;
+use Exception;
+
+class LastAccessLoader implements Loader
+{
+    private $entityManager;
+
+    private $acl;
+
+    public function __construct(EntityManager $entityManager, Acl $acl)
+    {
+        $this->entityManager = $entityManager;
+        $this->acl = $acl;
+    }
+
+    public function process(Entity $entity, Params $params): void
+    {
+        $forbiddenFieldList = $this->acl
+            ->getScopeForbiddenFieldList($entity->getEntityType(), Table::ACTION_READ);
+
+        if (in_array('lastAccess', $forbiddenFieldList)) {
+            return;
+        }
+
+        $authToken = $this->entityManager
+            ->getRDBRepository('AuthToken')
+            ->select(['id', 'lastAccess'])
+            ->where([
+                'userId' => $entity->getId(),
+            ])
+            ->order('lastAccess', 'DESC')
+            ->findOne();
+
+        $lastAccess = null;
+
+        if ($authToken) {
+            $lastAccess = $authToken->get('lastAccess');
+        }
+
+        $dt = null;
+
+        if ($lastAccess) {
+            try {
+                $dt = new DateTime($lastAccess);
+            }
+            catch (Exception $e) {}
+        }
+
+        $where = [
+            'userId' => $entity->getId(),
+            'isDenied' => false,
+        ];
+
+        if ($dt) {
+            $where['requestTime>'] = $dt->format('U');
+        }
+
+        $authLogRecord = $this->entityManager
+            ->getRDBRepository('AuthLogRecord')
+            ->select(['id', 'createdAt'])
+            ->where($where)
+            ->order('requestTime', true)
+            ->findOne();
+
+        if ($authLogRecord) {
+            $lastAccess = $authLogRecord->get('createdAt');
+        }
+
+        $entity->set('lastAccess', $lastAccess);
+    }
+}

application/Espo/Classes/FieldValidators/ArrayType.php

@@ -31,22 +31,31 @@ namespace Espo\Classes\FieldValidators;
 
 use Espo\ORM\Entity;
 
-class ArrayType extends BaseType
+use StdClass;
+
+class ArrayType
 {
-    public function checkRequired(Entity $entity, string $field, $validationValue, $data) : bool
+    public function checkRequired(Entity $entity, string $field): bool
     {
         return $this->isNotEmpty($entity, $field);
     }
 
-    public function checkMaxCount(Entity $entity, string $field, $validationValue, $data) : bool
+    public function checkMaxCount(Entity $entity, string $field, int $validationValue): bool
     {
-        if (!$this->isNotEmpty($entity, $field)) return true;
+        if (!$this->isNotEmpty($entity, $field)) {
+            return true;
+        }
+
         $list = $entity->get($field);
-        if (count($list) > $validationValue) return false;
+
+        if (count($list) > $validationValue) {
+            return false;
+        }
+
         return true;
     }
 
-    public function checkArray(Entity $entity, string $field, $validationValue, $data) : bool
+    public function rawCheckArray(StdClass $data, string $field): bool
     {
         if (isset($data->$field) && $data->$field !== null && !is_array($data->$field)) {
             return false;
@@ -55,12 +64,22 @@ class ArrayType extends BaseType
         return true;
     }
 
-    protected function isNotEmpty(Entity $entity, $field)
+    protected function isNotEmpty(Entity $entity, string $field): bool
     {
-        if (!$entity->has($field) || $entity->get($field) === null) return false;
+        if (!$entity->has($field) || $entity->get($field) === null) {
+            return false;
+        }
+
         $list = $entity->get($field);
-        if (!is_array($list)) return false;
-        if (count($list)) return true;
+
+        if (!is_array($list)) {
+            return false;
+        }
+
+        if (count($list)) {
+            return true;
+        }
+
         return false;
     }
 }

application/Espo/Classes/FieldValidators/CurrencyType.php

@@ -33,7 +33,7 @@ use Espo\ORM\Entity;
 
 class CurrencyType extends FloatType
 {
-    protected function isNotEmpty(Entity $entity, $field)
+    protected function isNotEmpty(Entity $entity, string $field): bool
     {
         return
             $entity->has($field) && $entity->get($field) !== null &&

application/Espo/Classes/FieldValidators/DateType.php

@@ -31,14 +31,14 @@ namespace Espo\Classes\FieldValidators;
 
 use Espo\ORM\Entity;
 
-class DateType extends BaseType
+class DateType
 {
-    public function checkRequired(Entity $entity, string $field, $validationValue, $data) : bool
+    public function checkRequired(Entity $entity, string $field): bool
     {
         return $this->isNotEmpty($entity, $field);
     }
 
-    protected function isNotEmpty(Entity $entity, $field)
+    protected function isNotEmpty(Entity $entity, string $field): bool
     {
         return $entity->has($field) && $entity->get($field) !== null;
     }

application/Espo/Classes/FieldValidators/DatetimeOptionalType.php

@@ -33,15 +33,21 @@ use Espo\ORM\Entity;
 
 class DatetimeOptionalType extends DatetimeType
 {
-    public function checkRequired(Entity $entity, string $field, $validationValue, $data) : bool
+    public function checkRequired(Entity $entity, string $field): bool
     {
         return $this->isNotEmpty($entity, $field);
     }
 
-    protected function isNotEmpty(Entity $entity, $field)
+    protected function isNotEmpty(Entity $entity, string $field): bool
     {
-        if ($entity->has($field) && $entity->get($field) !== null) return true;
-        if ($entity->has($field . 'Date') && $entity->get($field . 'Date') !== null) return true;
+        if ($entity->has($field) && $entity->get($field) !== null) {
+            return true;
+        }
+
+        if ($entity->has($field . 'Date') && $entity->get($field . 'Date') !== null) {
+            return true;
+        }
+
         return false;
     }
 }

application/Espo/Classes/FieldValidators/EmailType.php

@@ -31,46 +31,61 @@ namespace Espo\Classes\FieldValidators;
 
 use Espo\ORM\Entity;
 
-class EmailType extends BaseType
+class EmailType
 {
-    public function checkRequired(Entity $entity, string $field, $validationValue, $data) : bool
+    public function checkRequired(Entity $entity, string $field): bool
     {
-        if ($this->isNotEmpty($entity, $field)) return true;
+        if ($this->isNotEmpty($entity, $field)) {
+            return true;
+        }
 
         $dataList = $entity->get($field . 'Data');
-        if (!is_array($dataList)) return false;
+
+        if (!is_array($dataList)) {
+            return false;
+        }
 
         foreach ($dataList as $item) {
-            if (!empty($item->emailAddress)) return true;
+            if (!empty($item->emailAddress)) {
+                return true;
+            }
         }
 
         return false;
     }
 
-    public function checkEmailAddress(Entity $entity, string $field, $validationValue, $data) : bool
+    public function checkEmailAddress(Entity $entity, string $field): bool
     {
         if ($this->isNotEmpty($entity, $field)) {
             $address = $entity->get($field);
+
             if (!filter_var($address, FILTER_VALIDATE_EMAIL)) {
                 return false;
             }
         }
 
         $dataList = $entity->get($field . 'Data');
-        if (is_array($dataList)) {
-            foreach ($dataList as $item) {
-                if (empty($item->emailAddress)) continue;
-                $address = $item->emailAddress;
-                if (!filter_var($address, FILTER_VALIDATE_EMAIL)) {
-                    return false;
-                }
+
+        if (!is_array($dataList)) {
+            return true;
+        }
+
+        foreach ($dataList as $item) {
+            if (empty($item->emailAddress)) {
+                continue;
+            }
+
+            $address = $item->emailAddress;
+
+            if (!filter_var($address, FILTER_VALIDATE_EMAIL)) {
+                return false;
             }
         }
 
         return true;
     }
 
-    protected function isNotEmpty(Entity $entity, $field)
+    protected function isNotEmpty(Entity $entity, string $field): bool
     {
         return $entity->has($field) && $entity->get($field) !== '' && $entity->get($field) !== null;
     }

application/Espo/Classes/FieldValidators/EnumType.php

@@ -31,14 +31,14 @@ namespace Espo\Classes\FieldValidators;
 
 use Espo\ORM\Entity;
 
-class EnumType extends BaseType
+class EnumType
 {
-    public function checkRequired(Entity $entity, string $field, $validationValue, $data) : bool
+    public function checkRequired(Entity $entity, string $field): bool
     {
         return $this->isNotEmpty($entity, $field);
     }
 
-    protected function isNotEmpty(Entity $entity, $field)
+    protected function isNotEmpty(Entity $entity, string $field): bool
     {
         return $entity->has($field) && $entity->get($field) !== null;
     }

application/Espo/Classes/FieldValidators/IntType.php

@@ -31,28 +31,40 @@ namespace Espo\Classes\FieldValidators;
 
 use Espo\ORM\Entity;
 
-class IntType extends BaseType
+class IntType
 {
-    public function checkRequired(Entity $entity, string $field, $validationValue, $data) : bool
+    public function checkRequired(Entity $entity, string $field): bool
     {
         return $this->isNotEmpty($entity, $field);
     }
 
-    public function checkMax(Entity $entity, string $field, $validationValue, $data) : bool
+    public function checkMax(Entity $entity, string $field, $validationValue): bool
     {
-        if (!$this->isNotEmpty($entity, $field)) return true;
-        if ($entity->get($field) > $validationValue) return false;
+        if (!$this->isNotEmpty($entity, $field)) {
+            return true;
+        }
+
+        if ($entity->get($field) > $validationValue) {
+            return false;
+        }
+
         return true;
     }
 
-    public function checkMin(Entity $entity, string $field, $validationValue, $data) : bool
+    public function checkMin(Entity $entity, string $field, $validationValue): bool
     {
-        if (!$this->isNotEmpty($entity, $field)) return true;
-        if ($entity->get($field) < $validationValue) return false;
+        if (!$this->isNotEmpty($entity, $field)) {
+            return true;
+        }
+
+        if ($entity->get($field) < $validationValue) {
+            return false;
+        }
+
         return true;
     }
 
-    protected function isNotEmpty(Entity $entity, $field)
+    protected function isNotEmpty(Entity $entity, string $field): bool
     {
         return $entity->has($field) && $entity->get($field) !== null;
     }

application/Espo/Classes/FieldValidators/JsonArrayType.php

@@ -31,21 +31,35 @@ namespace Espo\Classes\FieldValidators;
 
 use Espo\ORM\Entity;
 
-class JsonArrayType extends BaseType
-{
-    public function checkArray(Entity $entity, string $field, $validationValue, $data) : bool
-    {
-        if (!$entity->has($field) || $entity->get($field) === null) return true;
+use StdClass;
 
-        return is_array($entity->get($field));
+class JsonArrayType
+{
+    public function rawCheckArray(StdClass $data, string $field): bool
+    {
+        if (isset($data->$field) && $data->$field !== null && !is_array($data->$field)) {
+            return false;
+        }
+
+        return true;
     }
 
-    protected function isNotEmpty(Entity $entity, $field)
+    protected function isNotEmpty(Entity $entity, string $field): bool
     {
-        if (!$entity->has($field) || $entity->get($field) === null) return false;
+        if (!$entity->has($field) || $entity->get($field) === null) {
+            return false;
+        }
+
         $list = $entity->get($field);
-        if (!is_array($list)) return false;
-        if (count($list)) return true;
+
+        if (!is_array($list)) {
+            return false;
+        }
+
+        if (count($list)) {
+            return true;
+        }
+
         return false;
     }
 }

application/Espo/Classes/FieldValidators/LinkMultipleType.php

@@ -31,9 +31,9 @@ namespace Espo\Classes\FieldValidators;
 
 use Espo\ORM\Entity;
 
-class LinkMultipleType extends BaseType
+class LinkMultipleType
 {
-    public function checkRequired(Entity $entity, string $field, $validationValue, $data) : bool
+    public function checkRequired(Entity $entity, string $field): bool
     {
         return count($entity->getLinkMultipleIdList($field)) > 0;
     }

application/Espo/Classes/FieldValidators/LinkParentType.php

@@ -31,14 +31,18 @@ namespace Espo\Classes\FieldValidators;
 
 use Espo\ORM\Entity;
 
-class LinkParentType extends BaseType
+class LinkParentType
 {
-    public function checkRequired(Entity $entity, string $field, $validationValue, $data) : bool
+    public function checkRequired(Entity $entity, string $field): bool
     {
         $idAttribute = $field . 'Id';
         $typeAttribute = $field . 'Type';
 
-        if (!$entity->has($idAttribute) || $entity->get($idAttribute) === '' || $entity->get($idAttribute) === null) {
+        if (
+            !$entity->has($idAttribute) ||
+            $entity->get($idAttribute) === '' ||
+            $entity->get($idAttribute) === null
+        ) {
             return false;
         }
 

application/Espo/Classes/FieldValidators/LinkType.php

@@ -31,9 +31,9 @@ namespace Espo\Classes\FieldValidators;
 
 use Espo\ORM\Entity;
 
-class LinkType extends BaseType
+class LinkType
 {
-    public function checkRequired(Entity $entity, string $field, $validationValue, $data) : bool
+    public function checkRequired(Entity $entity, string $field): bool
     {
         $idAttribute = $field . 'Id';
 

application/Espo/Classes/FieldValidators/PersonNameType.php

@@ -31,21 +31,41 @@ namespace Espo\Classes\FieldValidators;
 
 use Espo\ORM\Entity;
 
-class PersonNameType extends BaseType
+use Espo\Core\{
+    Utils\FieldUtil,
+};
+
+class PersonNameType
 {
-    public function checkRequired(Entity $entity, string $field, $validationValue, $data) : bool
+    private $fieldUtil;
+
+    public function __construct(FieldUtil $fieldUtil)
+    {
+        $this->fieldUtil = $fieldUtil;
+    }
+
+    public function checkRequired(Entity $entity, string $field): bool
     {
         $isEmpty = true;
-        foreach ($this->getActualAttributeList($entity, $field) as $attribute) {
+
+        $attributeList = $this->fieldUtil->getActualAttributeList($entity->getEntityType(), $field);
+
+        foreach ($attributeList as $attribute) {
             if ($attribute === 'salutation' . ucfirst($field)) {
                 continue;
             }
+
             if ($entity->has($attribute) && $entity->get($attribute) !== '') {
                 $isEmpty = false;
+
                 break;
             }
         }
-        if ($isEmpty) return false;
+
+        if ($isEmpty) {
+            return false;
+        }
+
         return true;
     }
 }

application/Espo/Classes/FieldValidators/PhoneType.php

@@ -31,23 +31,30 @@ namespace Espo\Classes\FieldValidators;
 
 use Espo\ORM\Entity;
 
-class PhoneType extends BaseType
+class PhoneType
 {
-    public function checkRequired(Entity $entity, string $field, $validationValue, $data) : bool
+    public function checkRequired(Entity $entity, string $field): bool
     {
-        if ($this->isNotEmpty($entity, $field)) return true;
+        if ($this->isNotEmpty($entity, $field)) {
+            return true;
+        }
 
         $dataList = $entity->get($field . 'Data');
-        if (!is_array($dataList)) return false;
+
+        if (!is_array($dataList)) {
+            return false;
+        }
 
         foreach ($dataList as $item) {
-            if (!empty($item->phoneNumber)) return true;
+            if (!empty($item->phoneNumber)) {
+                return true;
+            }
         }
 
         return false;
     }
 
-    protected function isNotEmpty(Entity $entity, $field)
+    protected function isNotEmpty(Entity $entity, string $field): bool
     {
         return $entity->has($field) && $entity->get($field) !== '' && $entity->get($field) !== null;
     }

application/Espo/Classes/FieldValidators/VarcharType.php

@@ -31,25 +31,27 @@ namespace Espo\Classes\FieldValidators;
 
 use Espo\ORM\Entity;
 
-class VarcharType extends BaseType
+class VarcharType
 {
-    public function checkRequired(Entity $entity, string $field, $validationValue, $data) : bool
+    public function checkRequired(Entity $entity, string $field): bool
     {
         return $this->isNotEmpty($entity, $field);
     }
 
-    public function checkMaxLength(Entity $entity, string $field, $validationValue, $data) : bool
+    public function checkMaxLength(Entity $entity, string $field, int $validationValue): bool
     {
         if ($this->isNotEmpty($entity, $field)) {
             $value = $entity->get($field);
+
             if (mb_strlen($value) > $validationValue) {
                 return false;
             }
         }
+
         return true;
     }
 
-    protected function isNotEmpty(Entity $entity, $field)
+    protected function isNotEmpty(Entity $entity, string $field): bool
     {
         return $entity->has($field) && $entity->get($field) !== '' && $entity->get($field) !== null;
     }

application/Espo/Classes/JobPreparators/CheckEmailAccounts.php

@@ -0,0 +1,109 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\JobPreparators;
+
+use Espo\Core\Utils\DateTime;
+use Espo\Core\Job\Job\Status;
+use Espo\Core\Job\Preparator;
+use Espo\Core\Job\Preparator\Data;
+
+use Espo\ORM\EntityManager;
+
+use Espo\Entities\Job as JobEntity;
+
+use DateTimeImmutable;
+
+class CheckEmailAccounts implements Preparator
+{
+    private $entityManager;
+
+    public function __construct(EntityManager $entityManager)
+    {
+        $this->entityManager = $entityManager;
+    }
+
+    public function prepare(Data $data, DateTimeImmutable $executeTime): void
+    {
+        $collection = $this->entityManager
+            ->getRDBRepository('EmailAccount')
+            ->join('assignedUser', 'assignedUserAdditional')
+            ->where([
+                'status' => 'Active',
+                'useImap' => true,
+                'assignedUserAdditional.isActive' => true,
+            ])
+            ->find();
+
+        foreach ($collection as $entity) {
+            $running = $this->entityManager
+                ->getRDBRepository(JobEntity::ENTITY_TYPE)
+                ->where([
+                    'scheduledJobId' => $data->getId(),
+                    'status' => [
+                        Status::RUNNING,
+                        Status::READY,
+                    ],
+                    'targetType' => 'EmailAccount',
+                    'targetId' => $entity->getId(),
+                ])
+                ->findOne();
+
+            if ($running) {
+                continue;
+            }
+
+            $countPending = $this->entityManager
+                ->getRDBRepository(JobEntity::ENTITY_TYPE)
+                ->where([
+                    'scheduledJobId' => $data->getId(),
+                    'status' => Status::PENDING,
+                    'targetType' => 'EmailAccount',
+                    'targetId' => $entity->getId(),
+                ])
+                ->count();
+
+            if ($countPending > 1) {
+                continue;
+            }
+
+            $jobEntity = $this->entityManager->getEntity(JobEntity::ENTITY_TYPE);
+
+            $jobEntity->set([
+                'name' => $data->getName(),
+                'scheduledJobId' => $data->getId(),
+                'executeTime' => $executeTime->format(DateTime::SYSTEM_DATE_TIME_FORMAT),
+                'targetType' => 'EmailAccount',
+                'targetId' => $entity->getId(),
+            ]);
+
+            $this->entityManager->saveEntity($jobEntity);
+        }
+    }
+}

application/Espo/Classes/JobPreparators/CheckInboundEmails.php

@@ -0,0 +1,107 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\JobPreparators;
+
+use Espo\Core\Utils\DateTime;
+use Espo\Core\Job\Job\Status;
+use Espo\Core\Job\Preparator;
+use Espo\Core\Job\Preparator\Data;
+
+use Espo\ORM\EntityManager;
+
+use Espo\Entities\Job as JobEntity;
+
+use DateTimeImmutable;
+
+class CheckInboundEmails implements Preparator
+{
+    private $entityManager;
+
+    public function __construct(EntityManager $entityManager)
+    {
+        $this->entityManager = $entityManager;
+    }
+
+    public function prepare(Data $data, DateTimeImmutable $executeTime): void
+    {
+        $collection = $this->entityManager
+            ->getRDBRepository('InboundEmail')
+            ->where([
+                'status' => 'Active',
+                'useImap' => true,
+            ])
+            ->find();
+
+        foreach ($collection as $entity) {
+            $running = $this->entityManager
+                ->getRDBRepository(JobEntity::ENTITY_TYPE)
+                ->where([
+                    'scheduledJobId' => $data->getId(),
+                    'status' => [
+                        Status::RUNNING,
+                        Status::READY,
+                    ],
+                    'targetType' => 'InboundEmail',
+                    'targetId' => $entity->getId(),
+                ])
+                ->findOne();
+
+            if ($running) {
+                continue;
+            }
+
+            $countPending = $this->entityManager
+                ->getRDBRepository(JobEntity::ENTITY_TYPE)
+                ->where([
+                    'scheduledJobId' => $data->getId(),
+                    'status' => Status::PENDING,
+                    'targetType' => 'InboundEmail',
+                    'targetId' => $entity->getId(),
+                ])
+                ->count();
+
+            if ($countPending > 1) {
+                continue;
+            }
+
+            $jobEntity = $this->entityManager->getEntity(JobEntity::ENTITY_TYPE);
+
+            $jobEntity->set([
+                'name' => $data->getName(),
+                'scheduledJobId' => $data->getId(),
+                'executeTime' => $executeTime->format(DateTime::SYSTEM_DATE_TIME_FORMAT),
+                'targetType' => 'InboundEmail',
+                'targetId' => $entity->getId(),
+            ]);
+
+            $this->entityManager->saveEntity($jobEntity);
+        }
+    }
+}

application/Espo/Classes/Jobs/AuthTokenControl.php

@@ -27,18 +27,21 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Jobs;
+namespace Espo\Classes\Jobs;
 
 use Espo\Core\{
     Utils\Config,
     ORM\EntityManager,
-    Jobs\Job,
+    Job\JobDataLess,
 };
 
-class AuthTokenControl implements Job
+use DateTime;
+
+class AuthTokenControl implements JobDataLess
 {
-    protected $config;
-    protected $entityManager;
+    private $config;
+
+    private $entityManager;
 
     public function __construct(Config $config, EntityManager $entityManager)
     {
@@ -46,7 +49,7 @@ class AuthTokenControl implements Job
         $this->entityManager = $entityManager;
     }
 
-    public function run()
+    public function run(): void
     {
         $authTokenLifetime = $this->config->get('authTokenLifetime');
         $authTokenMaxIdleTime = $this->config->get('authTokenMaxIdleTime');
@@ -55,30 +58,39 @@ class AuthTokenControl implements Job
             return;
         }
 
-        $whereClause = array(
-            'isActive' => true
-        );
+        $whereClause = [
+            'isActive' => true,
+        ];
 
         if ($authTokenLifetime) {
-            $dt = new \DateTime();
+            $dt = new DateTime();
+
             $dt->modify('-' . $authTokenLifetime . ' hours');
+
             $authTokenLifetimeThreshold = $dt->format('Y-m-d H:i:s');
 
             $whereClause['createdAt<'] = $authTokenLifetimeThreshold;
         }
 
         if ($authTokenMaxIdleTime) {
-            $dt = new \DateTime();
+            $dt = new DateTime();
+
             $dt->modify('-' . $authTokenMaxIdleTime . ' hours');
+
             $authTokenMaxIdleTimeThreshold = $dt->format('Y-m-d H:i:s');
 
             $whereClause['lastAccess<'] = $authTokenMaxIdleTimeThreshold;
         }
 
-        $tokenList = $this->entityManager->getRepository('AuthToken')->where($whereClause)->limit(0, 500)->find();
+        $tokenList = $this->entityManager
+            ->getRepository('AuthToken')
+            ->where($whereClause)
+            ->limit(0, 500)
+            ->find();
 
         foreach ($tokenList as $token) {
             $token->set('isActive', false);
+
             $this->entityManager->saveEntity($token);
         }
     }

application/Espo/Classes/Jobs/CheckEmailAccounts.php

@@ -0,0 +1,83 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Jobs;
+
+use Espo\Core\Exceptions\Error;
+
+use Espo\Services\EmailAccount as Service;
+
+use Espo\Core\{
+    Job\Job,
+    Job\Job\Data,
+    ORM\EntityManager,
+};
+
+use Throwable;
+
+class CheckEmailAccounts implements Job
+{
+    private $service;
+
+    private $entityManager;
+
+    public function __construct(Service $service, EntityManager $entityManager)
+    {
+        $this->service = $service;
+        $this->entityManager = $entityManager;
+    }
+
+    public function run(Data $data): void
+    {
+        $targetId = $data->getTargetId();
+
+        if (!$targetId) {
+            throw new Error("No target.");
+        }
+
+        $entity = $this->entityManager->getEntity('EmailAccount', $targetId);
+
+        if (!$entity) {
+            throw new Error("Job CheckEmailAccounts '{$targetId}': EmailAccount does not exist.", -1);
+        }
+
+        if ($entity->get('status') !== 'Active') {
+            throw new Error("Job CheckEmailAccounts '{$targetId}': EmailAccount is not active.", -1);
+        }
+
+        try {
+            $this->service->fetchFromMailServer($entity);
+        }
+        catch (Throwable $e) {
+            throw new Error(
+                'Job CheckEmailAccounts ' . $entity->getId() . ': [' . $e->getCode() . '] ' .$e->getMessage()
+            );
+        }
+    }
+}

application/Espo/Classes/Jobs/CheckInboundEmails.php

@@ -0,0 +1,83 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Jobs;
+
+use Espo\Core\Exceptions\Error;
+
+use Espo\Services\InboundEmail as Service;
+
+use Espo\Core\{
+    Job\Job,
+    Job\Job\Data,
+    ORM\EntityManager,
+};
+
+use Throwable;
+
+class CheckInboundEmails implements Job
+{
+    private $service;
+
+    private $entityManager;
+
+    public function __construct(Service $service, EntityManager $entityManager)
+    {
+        $this->service = $service;
+        $this->entityManager = $entityManager;
+    }
+
+    public function run(Data $data): void
+    {
+        $targetId = $data->getTargetId();
+
+        if (!$targetId) {
+            throw new Error("No target.");
+        }
+
+        $entity = $this->entityManager->getEntity('InboundEmail', $targetId);
+
+        if (!$entity) {
+            throw new Error("Job CheckInboundEmails '{$targetId}': InboundEmail does not exist.", -1);
+        }
+
+        if ($entity->get('status') !== 'Active') {
+            throw new Error("Job CheckInboundEmails '{$targetId}': InboundEmail is not active.", -1);
+        }
+
+        try {
+            $this->service->fetchFromMailServer($entity);
+        }
+        catch (Throwable $e) {
+            throw new Error(
+                'Job CheckInboundEmails ' . $entity->getId() . ': [' . $e->getCode() . '] ' .$e->getMessage()
+            );
+        }
+    }
+}

application/Espo/Classes/Jobs/CheckNewExtensionVersion.php

@@ -27,16 +27,17 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Jobs;
-
-use Espo\Core\Exceptions;
+namespace Espo\Classes\Jobs;
 
 class CheckNewExtensionVersion extends CheckNewVersion
 {
-    public function run()
+    public function run(): void
     {
-        if (!$this->config->get('adminNotifications') || !$this->config->get('adminNotificationsNewExtensionVersion')) {
-            return true;
+        if (
+            !$this->config->get('adminNotifications') ||
+            !$this->config->get('adminNotificationsNewExtensionVersion')
+        ) {
+            return;
         }
 
         $job = $this->entityManager->getEntity('Job');
@@ -48,7 +49,5 @@ class CheckNewExtensionVersion extends CheckNewVersion
         ]);
 
         $this->entityManager->saveEntity($job);
-
-        return true;
     }
-}
+}

application/Espo/Classes/Jobs/CheckNewVersion.php

@@ -27,20 +27,21 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Jobs;
+namespace Espo\Classes\Jobs;
 
 use Espo\Core\{
     Utils\Config,
     ORM\EntityManager,
-    Jobs\Job,
+    Job\JobDataLess,
 };
 
 use DateTime;
 use DateTimeZone;
 
-class CheckNewVersion implements Job
+class CheckNewVersion implements JobDataLess
 {
     protected $config;
+
     protected $entityManager;
 
     public function __construct(Config $config, EntityManager $entityManager)
@@ -49,13 +50,14 @@ class CheckNewVersion implements Job
         $this->entityManager = $entityManager;
     }
 
-    public function run()
+    public function run(): void
     {
         if (!$this->config->get('adminNotifications') || !$this->config->get('adminNotificationsNewVersion')) {
-            return true;
+            return;
         }
 
         $job = $this->entityManager->getEntity('Job');
+
         $job->set([
             'name' => 'Check for New Version (job)',
             'serviceName' => 'AdminNotifications',
@@ -65,7 +67,7 @@ class CheckNewVersion implements Job
 
         $this->entityManager->saveEntity($job);
 
-        return true;
+        return;
     }
 
     protected function getRunTime()
@@ -77,6 +79,7 @@ class CheckNewVersion implements Job
         $time = $nextDay->format('Y-m-d') . ' ' . $hour . ':' . $minute . ':00';
 
         $timeZone = $this->config->get('timeZone');
+
         if (empty($timeZone)) {
             $timeZone = 'UTC';
         }
@@ -88,6 +91,7 @@ class CheckNewVersion implements Job
 
     /**
      * For backward compatibility.
+     * @deprecated
      */
     protected function getEntityManager()
     {

application/Espo/Classes/Jobs/Cleanup.php

@@ -27,19 +27,19 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Jobs;
+namespace Espo\Classes\Jobs;
 
-use Espo\Core\Exceptions;
+use Espo\Core\Record\ServiceContainer;
 
 use Espo\Core\{
     Utils\Config,
     ORM\EntityManager,
-    Jobs\Job,
+    Job\JobDataLess,
     Utils\Metadata,
     Utils\File\Manager as FileManager,
     InjectableFactory,
-    Select\SelectManagerFactory,
-    ServiceFactory,
+    Select\SelectBuilderFactory,
+    Utils\Log,
 };
 
 use Espo\ORM\Entity;
@@ -49,25 +49,41 @@ use SplFileInfo;
 use Exception;
 use Throwable;
 
-class Cleanup implements Job
+class Cleanup implements JobDataLess
 {
-    protected $cleanupJobPeriod = '10 days';
-    protected $cleanupActionHistoryPeriod = '15 days';
-    protected $cleanupAuthTokenPeriod = '1 month';
-    protected $cleanupAuthLogPeriod = '2 months';
-    protected $cleanupNotificationsPeriod = '2 months';
-    protected $cleanupAttachmentsPeriod = '15 days';
-    protected $cleanupAttachmentsFromPeriod = '3 months';
-    protected $cleanupBackupPeriod = '2 month';
-    protected $cleanupDeletedRecordsPeriod = '3 months';
+    private $cleanupJobPeriod = '10 days';
 
-    protected $config;
-    protected $entityManager;
-    protected $metedata;
-    protected $fileManager;
-    protected $injectableFactory;
-    protected $selectManagerFactory;
-    protected $serviceFactory;
+    private $cleanupActionHistoryPeriod = '15 days';
+
+    private $cleanupAuthTokenPeriod = '1 month';
+
+    private $cleanupAuthLogPeriod = '2 months';
+
+    private $cleanupNotificationsPeriod = '2 months';
+
+    private $cleanupAttachmentsPeriod = '15 days';
+
+    private $cleanupAttachmentsFromPeriod = '3 months';
+
+    private $cleanupBackupPeriod = '2 month';
+
+    private $cleanupDeletedRecordsPeriod = '3 months';
+
+    private $config;
+
+    private $entityManager;
+
+    private $metadata;
+
+    private $fileManager;
+
+    private $injectableFactory;
+
+    private $selectBuilderFactory;
+
+    private $recordServiceContainer;
+
+    private $log;
 
     public function __construct(
         Config $config,
@@ -75,19 +91,21 @@ class Cleanup implements Job
         Metadata $metadata,
         FileManager $fileManager,
         InjectableFactory $injectableFactory,
-        SelectManagerFactory $selectManagerFactory,
-        ServiceFactory $serviceFactory
+        SelectBuilderFactory $selectBuilderFactory,
+        ServiceContainer $recordServiceContainer,
+        Log $log
     ) {
         $this->config = $config;
         $this->entityManager = $entityManager;
         $this->metadata = $metadata;
         $this->fileManager = $fileManager;
         $this->injectableFactory = $injectableFactory;
-        $this->selectManagerFactory = $selectManagerFactory;
-        $this->serviceFactory = $serviceFactory;
+        $this->selectBuilderFactory = $selectBuilderFactory;
+        $this->recordServiceContainer = $recordServiceContainer;
+        $this->log = $log;
     }
 
-    public function run()
+    public function run(): void
     {
         $this->cleanupJobs();
         $this->cleanupScheduledJobLog();
@@ -115,15 +133,16 @@ class Cleanup implements Job
         foreach ($items as $name => $item) {
             try {
                 $className = $item['className'];
+
                 $injectableFactory->create($className)->process();
             }
             catch (Throwable $e) {
-                $GLOBALS['log']->error("Cleanup: {$name}: " . $e->getMessage());
+                $this->log->error("Cleanup: {$name}: " . $e->getMessage());
             }
         }
     }
 
-    protected function cleanupJobs()
+    private function cleanupJobs(): void
     {
         $delete = $this->entityManager->getQueryBuilder()->delete()
             ->from('Job')
@@ -147,9 +166,11 @@ class Cleanup implements Job
         $this->entityManager->getQueryExecutor()->execute($delete);
     }
 
-    protected function cleanupUniqueIds()
+    private function cleanupUniqueIds(): void
     {
-        $delete = $this->entityManager->getQueryBuilder()->delete()
+        $delete = $this->entityManager
+            ->getQueryBuilder()
+            ->delete()
             ->from('UniqueId')
             ->where([
                 'terminateAt!=' => null,
@@ -160,7 +181,7 @@ class Cleanup implements Job
         $this->entityManager->getQueryExecutor()->execute($delete);
     }
 
-    protected function cleanupScheduledJobLog()
+    private function cleanupScheduledJobLog(): void
     {
         $scheduledJobList = $this->entityManager->getRepository('ScheduledJob')
             ->select(['id'])
@@ -187,7 +208,9 @@ class Cleanup implements Job
                 $ignoreIdList[] = $logRecord->get('id');
             }
 
-            $delete = $this->entityManager->getQueryBuilder()->delete()
+            $delete = $this->entityManager
+                ->getQueryBuilder()
+                ->delete()
                 ->from('ScheduledJobLogRecord')
                 ->where([
                     'scheduledJobId' => $scheduledJobId,
@@ -200,7 +223,7 @@ class Cleanup implements Job
         }
     }
 
-    protected function cleanupActionHistory()
+    private function cleanupActionHistory(): void
     {
         $period = '-' . $this->config->get('cleanupActionHistoryPeriod', $this->cleanupActionHistoryPeriod);
 
@@ -218,14 +241,16 @@ class Cleanup implements Job
         $this->entityManager->getQueryExecutor()->execute($delete);
     }
 
-    protected function cleanupAuthToken()
+    private function cleanupAuthToken(): void
     {
         $period = '-' . $this->config->get('cleanupAuthTokenPeriod', $this->cleanupAuthTokenPeriod);
 
         $datetime = new DateTime();
         $datetime->modify($period);
 
-        $delete = $this->entityManager->getQueryBuilder()->delete()
+        $delete = $this->entityManager
+            ->getQueryBuilder()
+            ->delete()
             ->from('AuthToken')
             ->where([
                 'DATE:modifiedAt<' => $datetime->format('Y-m-d'),
@@ -236,7 +261,7 @@ class Cleanup implements Job
         $this->entityManager->getQueryExecutor()->execute($delete);
     }
 
-    protected function cleanupAuthLog()
+    private function cleanupAuthLog(): void
     {
         $period = '-' . $this->config->get('cleanupAuthLogPeriod', $this->cleanupAuthLogPeriod);
 
@@ -244,7 +269,9 @@ class Cleanup implements Job
 
         $datetime->modify($period);
 
-        $delete = $this->entityManager->getQueryBuilder()->delete()
+        $delete = $this->entityManager
+            ->getQueryBuilder()
+            ->delete()
             ->from('AuthLogRecord')
             ->where([
                 'DATE:createdAt<' => $datetime->format('Y-m-d'),
@@ -254,21 +281,18 @@ class Cleanup implements Job
         $this->entityManager->getQueryExecutor()->execute($delete);
     }
 
-    protected function getCleanupJobFromDate()
+    private function getCleanupJobFromDate(): string
     {
         $period = '-' . $this->config->get('cleanupJobPeriod', $this->cleanupJobPeriod);
 
         $datetime = new DateTime();
-
         $datetime->modify($period);
 
         return $datetime->format('Y-m-d');
     }
 
-    protected function cleanupAttachments()
+    private function cleanupAttachments(): void
     {
-        $pdo = $this->entityManager->getPDO();
-
         $period = '-' . $this->config->get('cleanupAttachmentsPeriod', $this->cleanupAttachmentsPeriod);
 
         $datetime = new DateTime();
@@ -293,17 +317,22 @@ class Cleanup implements Job
         }
 
         if ($this->config->get('cleanupOrphanAttachments')) {
-            $selectManager = $this->selectManagerFactory->create('Attachment');
+            $orphanQueryBuilder = $this->selectBuilderFactory
+                ->create()
+                ->from('Attachment')
+                ->withPrimaryFilter('orphan')
+                ->buildQueryBuilder();
 
-            $selectParams = $selectManager->getEmptySelectParams();
-            $selectManager->applyFilter('orphan', $selectParams);
-
-            $selectParams['whereClause'][] = [
+            $orphanQueryBuilder->where([
                 'createdAt<' => $datetime->format('Y-m-d H:i:s'),
                 'createdAt>' => '2018-01-01 00:00:00',
-            ];
+            ]);
 
-            $collection = $this->entityManager->getRepository('Attachment')->limit(0, 5000)->find($selectParams);
+            $collection = $this->entityManager
+                ->getRepository('Attachment')
+                ->clone($orphanQueryBuilder->build())
+                ->limit(0, 5000)
+                ->find();
 
             foreach ($collection as $entity) {
                 $this->entityManager->removeEntity($entity);
@@ -418,7 +447,7 @@ class Cleanup implements Job
         $this->entityManager->getQueryExecutor()->execute($delete);
     }
 
-    protected function cleanupEmails()
+    private function cleanupEmails(): void
     {
         $dateBefore = date('Y-m-d H:i:s', time() - 3600 * 24 * 20);
 
@@ -474,7 +503,7 @@ class Cleanup implements Job
         }
     }
 
-    protected function cleanupNotifications()
+    private function cleanupNotifications(): void
     {
         $period = '-' . $this->config->get('cleanupNotificationsPeriod', $this->cleanupNotificationsPeriod);
 
@@ -492,7 +521,7 @@ class Cleanup implements Job
         }
     }
 
-    protected function cleanupUpgradeBackups()
+    private function cleanupUpgradeBackups(): void
     {
         $path = 'data/.backup/upgrades';
 
@@ -514,7 +543,7 @@ class Cleanup implements Job
         }
     }
 
-    protected function cleanupDeletedEntity(Entity $entity)
+    private function cleanupDeletedEntity(Entity $entity): void
     {
         $scope = $entity->getEntityType();
 
@@ -574,7 +603,7 @@ class Cleanup implements Job
                 $this->entityManager->getQueryExecutor()->execute($delete);
             }
             catch (Exception $e) {
-                $GLOBALS['log']->error("Cleanup: " . $e->getMessage());
+                $this->log->error("Cleanup: " . $e->getMessage());
             }
         }
 
@@ -637,7 +666,7 @@ class Cleanup implements Job
         }
     }
 
-    protected function cleanupDeletedRecords()
+    private function cleanupDeletedRecords(): void
     {
         if (!$this->config->get('cleanupDeletedRecords')) {
             return;
@@ -647,8 +676,6 @@ class Cleanup implements Job
 
         $datetime = new DateTime($period);
 
-        $serviceFactory = $this->serviceFactory;
-
         $scopeList = array_keys($this->metadata->get(['scopes']));
 
         foreach ($scopeList as $scope) {
@@ -677,14 +704,11 @@ class Cleanup implements Job
             if (!method_exists($repository, 'deleteFromDb')) continue;
 
             $hasCleanupMethod = false;
-            $service = null;
 
-            if ($serviceFactory->checkExists($scope)) {
-                $service = $serviceFactory->create($scope);
+            $service = $this->recordServiceContainer->get($scope);
 
-                if (method_exists($service, 'cleanup')) {
-                    $hasCleanupMethod = true;
-                }
+            if (method_exists($service, 'cleanup')) {
+                $hasCleanupMethod = true;
             }
 
             $whereClause = [
@@ -693,8 +717,8 @@ class Cleanup implements Job
 
             if ($this->metadata->get(['entityDefs', $scope, 'fields', 'modifiedAt'])) {
                 $whereClause['modifiedAt<'] = $datetime->format('Y-m-d H:i:s');
-            } else
-            if ($this->metadata->get(['entityDefs', $scope, 'fields', 'createdAt'])) {
+            }
+            else if ($this->metadata->get(['entityDefs', $scope, 'fields', 'createdAt'])) {
                 $whereClause['createdAt<'] = $datetime->format('Y-m-d H:i:s');
             }
 
@@ -716,7 +740,7 @@ class Cleanup implements Job
                         $service->cleanup($entity->id);
                     }
                     catch (Throwable $e) {
-                        $GLOBALS['log']->error("Cleanup job: Cleanup scope {$scope}: " . $e->getMessage());
+                        $this->log->error("Cleanup job: Cleanup scope {$scope}: " . $e->getMessage());
                     }
                 }
 

application/Espo/Classes/Jobs/Dummy.php

@@ -27,15 +27,11 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Jobs;
+namespace Espo\Classes\Jobs;
 
-use Espo\Core\{
-    Jobs\Job,
-};
+use Espo\Core\Job\JobDataLess;
 
-class Dummy implements Job
+class Dummy implements JobDataLess
 {
-    public function run()
-    {
-    }
+    public function run(): void {}
 }

application/Espo/Classes/Jobs/ProcessWebhookQueue.php

@@ -0,0 +1,50 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Jobs;
+
+use Espo\Core\{
+    Job\JobDataLess,
+    Webhook\Queue,
+};
+
+class ProcessWebhookQueue implements JobDataLess
+{
+    private $queue;
+
+    public function __construct(Queue $queue)
+    {
+        $this->queue = $queue;
+    }
+
+    public function run(): void
+    {
+        $this->queue->process();
+    }
+}

application/Espo/Classes/Jobs/SendEmailNotifications.php

@@ -27,25 +27,23 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Jobs;
+namespace Espo\Classes\Jobs;
 
-use Espo\Core\{
-    ServiceFactory,
-    Jobs\Job,
-};
+use Espo\Core\Job\JobDataLess;
 
-class SendEmailNotifications implements Job
+use Espo\Tools\EmailNotification\Processor;
+
+class SendEmailNotifications implements JobDataLess
 {
-    protected $serviceFactory;
+    private $processor;
 
-    public function __construct(ServiceFactory $serviceFactory)
+    public function __construct(Processor $processor)
     {
-        $this->serviceFactory = $serviceFactory;
+        $this->processor = $processor;
     }
 
-    public function run()
+    public function run(): void
     {
-        $service = $this->serviceFactory->create('EmailNotification');
-        $service->process();
+        $this->processor->process();
     }
 }

application/Espo/Classes/MassAction/User/MassDelete.php

@@ -0,0 +1,113 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\MassAction\User;
+
+use Espo\Core\{
+    MassAction\Actions\MassDelete as MassDeleteOriginal,
+    MassAction\QueryBuilder,
+    MassAction\Params,
+    MassAction\Result,
+    MassAction\Data,
+    MassAction\MassAction,
+    Acl,
+    ORM\EntityManager,
+    Exceptions\Forbidden,
+};
+
+use Espo\{
+    Entities\User,
+    ORM\Entity,
+};
+
+class MassDelete implements MassAction
+{
+    protected $massDeleteOriginal;
+
+    protected $queryBuilder;
+
+    protected $entityManager;
+
+    protected $acl;
+
+    protected $user;
+
+    public function __construct(
+        MassDeleteOriginal $massDeleteOriginal,
+        QueryBuilder $queryBuilder,
+        EntityManager $entityManager,
+        Acl $acl,
+        User $user
+    ) {
+        $this->massDeleteOriginal = $massDeleteOriginal;
+        $this->queryBuilder = $queryBuilder;
+        $this->entityManager = $entityManager;
+        $this->acl = $acl;
+        $this->user = $user;
+    }
+
+    public function process(Params $params, Data $data): Result
+    {
+        $entityType = $params->getEntityType();
+
+        if (!$this->acl->check($entityType, 'delete')) {
+            throw new Forbidden("No delete access for '{$entityType}'.");
+        }
+
+        if (!$params->hasIds() && $this->acl->get('massUpdatePermission') !== 'yes') {
+            throw new Forbidden("No mass-update permission.");
+        }
+
+        $query = $this->queryBuilder->build($params);
+
+        $collection = $this->entityManager
+            ->getRepository('User')
+            ->clone($query)
+            ->sth()
+            ->select(['id'])
+            ->find();
+
+        foreach ($collection as $entity) {
+            $this->checkEntity($entity, $data);
+        }
+
+        return $this->massDeleteOriginal->process($params, $data);
+    }
+
+    protected function checkEntity(Entity $entity): void
+    {
+        if ($entity->id === 'system') {
+            throw new Forbidden("Can't delete 'system' user.");
+        }
+
+        if ($entity->id === $this->user->id) {
+            throw new Forbidden("Can't delete own user.");
+        }
+    }
+}

application/Espo/Classes/MassAction/User/MassUpdate.php

@@ -0,0 +1,180 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\MassAction\User;
+
+use Espo\Core\{
+    MassAction\Actions\MassUpdate as MassUpdateOriginal,
+    MassAction\QueryBuilder,
+    MassAction\Params,
+    MassAction\Result,
+    MassAction\Data,
+    MassAction\MassAction,
+    Utils\File\Manager as FileManager,
+    DataManager,
+    Acl,
+    ORM\EntityManager,
+    Exceptions\Forbidden,
+};
+
+use Espo\{
+    Entities\User,
+    ORM\Entity,
+};
+
+class MassUpdate implements MassAction
+{
+    protected $massUpdateOriginal;
+
+    protected $queryBuilder;
+
+    protected $entityManager;
+
+    protected $acl;
+
+    protected $user;
+
+    protected $fileManager;
+
+    protected $dataManager;
+
+    public function __construct(
+        MassUpdateOriginal $massUpdateOriginal,
+        QueryBuilder $queryBuilder,
+        EntityManager $entityManager,
+        Acl $acl,
+        User $user,
+        FileManager $fileManager,
+        DataManager $dataMaanger
+    ) {
+        $this->massUpdateOriginal = $massUpdateOriginal;
+        $this->queryBuilder = $queryBuilder;
+        $this->entityManager = $entityManager;
+        $this->acl = $acl;
+        $this->user = $user;
+        $this->fileManager = $fileManager;
+        $this->dataManager = $dataMaanger;
+    }
+
+    public function process(Params $params, Data $data): Result
+    {
+        $entityType = $params->getEntityType();
+
+        if (!$this->acl->check($entityType, 'edit')) {
+            throw new Forbidden("No edit access for '{$entityType}'.");
+        }
+
+        if ($this->acl->get('massUpdatePermission') !== 'yes') {
+            throw new Forbidden("No mass-update permission.");
+        }
+
+        if (
+            $data->has('type') ||
+            $data->has('password') ||
+            $data->has('emailAddress') ||
+            $data->has('isAdmin') ||
+            $data->has('isSuperAdmin') ||
+            $data->has('isPortalUser')
+        ) {
+            throw new Forbidden("Not allowed fields.");
+        }
+
+        $query = $this->queryBuilder->build($params);
+
+        $collection = $this->entityManager
+            ->getRepository('User')
+            ->clone($query)
+            ->sth()
+            ->select(['id'])
+            ->find();
+
+        foreach ($collection as $entity) {
+            $this->checkEntity($entity, $data);
+        }
+
+        $result = $this->massUpdateOriginal->process($params, $data);
+
+        $this->afterProcess($result, $data);
+
+        return $result;
+    }
+
+    protected function checkEntity(Entity $entity, Data $data): void
+    {
+        if ($entity->id === 'system') {
+            throw new Forbidden("Can't update 'system' user.");
+        }
+
+        if ($entity->id === $this->user->id) {
+            if ($data->has('isActive')) {
+                throw new Forbidden("Can't change 'isActive' field for own user.");
+            }
+        }
+    }
+
+    protected function afterProcess(Result $result, Data $dataWrapped): void
+    {
+        $data = $dataWrapped->getRaw();
+
+        if (
+            property_exists($data, 'rolesIds') ||
+            property_exists($data, 'teamsIds') ||
+            property_exists($data, 'type') ||
+            property_exists($data, 'portalRolesIds') ||
+            property_exists($data, 'portalsIds')
+        ) {
+            foreach ($result->getIds() as $id) {
+                $this->clearRoleCache($id);
+            }
+
+            $this->dataManager->updateCacheTimestamp();
+        }
+
+        if (
+            property_exists($data, 'portalRolesIds') ||
+            property_exists($data, 'portalsIds') ||
+            property_exists($data, 'contactId') ||
+            property_exists($data, 'accountsIds')
+        ) {
+            $this->clearPortalRolesCache();
+
+            $this->dataManager->updateCacheTimestamp();
+        }
+    }
+
+    protected function clearRoleCache(string $id): void
+    {
+        $this->fileManager->removeFile('data/cache/application/acl/' . $id . '.php');
+    }
+
+    protected function clearPortalRolesCache(): void
+    {
+        $this->fileManager->removeInDir('data/cache/application/aclPortal');
+    }
+}

application/Espo/Classes/RecordHooks/Team/BeforeLinkUserCheck.php

@@ -27,29 +27,34 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Modules\Crm\AclPortal;
+namespace Espo\Classes\RecordHooks\Team;
+
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\LinkHook;
 
-use Espo\Entities\User as EntityUser;
 use Espo\ORM\Entity;
 
-use Espo\Core\AclPortal\Acl;
+use Espo\Entities\User;
 
-class KnowledgeBaseArticle extends Acl
+class BeforeLinkUserCheck implements LinkHook
 {
-    public function checkEntityRead(EntityUser $user, Entity $entity, $data)
+    public function process(Entity $entity, string $link, Entity $foreignEntity): void
     {
-        if (!$this->checkEntity($user, $entity, $data, 'read')) {
-            return false;
+        if ($link !== 'users') {
+            return;
         }
 
-        if ($entity->get('status') !== 'Published') return false;
+        $this->processUserCheck($foreignEntity);
+    }
 
-        $portalIdList = $entity->getLinkMultipleIdList('portals');
-
-        if ($user->get('portalId') && !in_array($user->get('portalId'), $portalIdList)) {
-            return false;
+    private function processUserCheck(User $user): void
+    {
+        if ($user->isPortal()) {
+            throw new Forbidden("Can't add portal users to team.");
         }
 
-        return true;
+        if ($user->isSystem()) {
+            throw new Forbidden("Can't add system users to team.");
+        }
     }
 }

application/Espo/Classes/Select/ActionHistoryRecord/AccessControlFilters/OnlyOwn.php

@@ -0,0 +1,53 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Select\ActionHistoryRecord\AccessControlFilters;
+
+use Espo\{
+    Core\Select\AccessControl\Filter,
+    ORM\Query\SelectBuilder as QueryBuilder,
+    Entities\User,
+};
+
+class OnlyOwn implements Filter
+{
+    private $user;
+
+    public function __construct(User $user)
+    {
+        $this->user = $user;
+    }
+
+    public function apply(QueryBuilder $queryBuilder): void
+    {
+        $queryBuilder->where([
+            'userId' => $this->user->getId(),
+        ]);
+    }
+}

application/Espo/Classes/Select/ActionHistoryRecord/BoolFilters/OnlyMy.php

@@ -0,0 +1,57 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Select\ActionHistoryRecord\BoolFilters;
+
+use Espo\{
+    Core\Select\Bool\Filter,
+    ORM\Query\SelectBuilder as QueryBuilder,
+    ORM\Query\Part\WhereClause,
+    ORM\Query\Part\Where\OrGroupBuilder,
+    Entities\User,
+};
+
+class OnlyMy implements Filter
+{
+    private $user;
+
+    public function __construct(User $user)
+    {
+        $this->user = $user;
+    }
+
+    public function apply(QueryBuilder $queryBuilder, OrGroupBuilder $orGroupBuilder): void
+    {
+        $item = WhereClause::fromRaw([
+            'userId' => $this->user->getId(),
+        ]);
+
+        $orGroupBuilder->add($item);
+    }
+}

application/Espo/Classes/Select/Attachment/PrimaryFilters/Orphan.php

@@ -27,13 +27,16 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\SelectManagers;
+namespace Espo\Classes\Select\Attachment\PrimaryFilters;
 
-class Attachment extends \Espo\Core\Select\SelectManager
+use Espo\Core\Select\Primary\Filter;
+use Espo\ORM\Query\SelectBuilder;
+
+class Orphan implements Filter
 {
-    protected function filterOrphan(&$result)
+    public function apply(SelectBuilder $queryBuilder): void
     {
-        $result['whereClause'][] = [
+        $queryBuilder->where([
             'role' => ['Attachment', 'Inline Attachment'],
             [
                 'OR' => [
@@ -56,13 +59,17 @@ class Attachment extends \Espo\Core\Select\SelectManager
                 ],
             ],
             'attachmentChild.id' => null,
-        ];
+        ]);
 
-        $this->addLeftJoin(['Attachment', 'attachmentChild', [
-            'attachmentChild.sourceId:' => 'attachment.id',
-            'attachmentChild.deleted' => false
-        ]], $result);
+        $queryBuilder->leftJoin(
+            'Attachment',
+            'attachmentChild',
+            [
+                'attachmentChild.sourceId:' => 'attachment.id',
+                'attachmentChild.deleted' => false,
+            ]
+        );
 
-        $this->setDistinct(true, $result);
+        $queryBuilder->distinct();
     }
 }

application/Espo/Classes/Select/AuthLogRecord/PrimaryFilters/Accepted.php

@@ -0,0 +1,43 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Select\AuthLogRecord\PrimaryFilters;
+
+use Espo\Core\Select\Primary\Filter;
+use Espo\ORM\Query\SelectBuilder;
+
+class Accepted implements Filter
+{
+    public function apply(SelectBuilder $queryBuilder): void
+    {
+        $queryBuilder->where([
+            'isDenied' => false,
+        ]);
+    }
+}

application/Espo/Classes/Select/AuthLogRecord/PrimaryFilters/Denied.php

@@ -0,0 +1,43 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Select\AuthLogRecord\PrimaryFilters;
+
+use Espo\Core\Select\Primary\Filter;
+use Espo\ORM\Query\SelectBuilder;
+
+class Denied implements Filter
+{
+    public function apply(SelectBuilder $queryBuilder): void
+    {
+        $queryBuilder->where([
+            'isDenied' => true,
+        ]);
+    }
+}

application/Espo/Classes/Select/AuthToken/PrimaryFilters/Active.php

@@ -27,16 +27,17 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Core\Di;
+namespace Espo\Classes\Select\AuthToken\PrimaryFilters;
 
-use Espo\Core\Utils\FieldValidatorManager;
+use Espo\Core\Select\Primary\Filter;
+use Espo\ORM\Query\SelectBuilder;
 
-trait FieldValidatorManagerSetter
+class Active implements Filter
 {
-    protected $fieldValidatorManager;
-
-    public function setFieldValidatorManager(FieldValidatorManager $fieldValidatorManager)
+    public function apply(SelectBuilder $queryBuilder): void
     {
-        $this->fieldValidatorManager = $fieldValidatorManager;
+        $queryBuilder->where([
+            'isActive' => true,
+        ]);
     }
 }

application/Espo/Classes/Select/AuthToken/PrimaryFilters/Inactive.php

@@ -0,0 +1,43 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2021 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Select\AuthToken\PrimaryFilters;
+
+use Espo\Core\Select\Primary\Filter;
+use Espo\ORM\Query\SelectBuilder;
+
+class Inactive implements Filter
+{
+    public function apply(SelectBuilder $queryBuilder): void
+    {
+        $queryBuilder->where([
+            'isActive' => false,
+        ]);
+    }
+}