move Parter+Debitor person+contact to related Relationsship (#20)

Co-authored-by: Michael Hoennig <michael@hoennig.de>
Reviewed-on: #20
Reviewed-by: Timotheus Pokorra <timotheus.pokorra@hostsharing.net>

doc/ideas/rbac-schema-f.md

@@ -0,0 +1,82 @@
+*(this is just a scribbled draft, that's why it's still in German)*
+
+### *Schema-F* für Permissions, Rollen und Grants
+
+Permissions, Rollen und Grants werden in den INSERT/UPDATE/DELETE-Triggern von Geschäftsobjekten erzeugt und gelöscht. Das Löschen erfolgt meistens automatisch über das zugehörige RbacObject, die INSERT- und UPDATE-Trigger müssen jedoch in *pl/pgsql* ausprogrammiert werden.
+
+Das folgende Schema soll dabei unterstützen, die richtigen Permissions, Rollen und Grants festzulegen.
+
+An einigen Stellen ist vom *Initiator* die Rede. Als *Initiator* gilt derjenige User, der die Operation (INSERT oder UPDATE) durchführt bzw. dessen primary assumed Rol. (TODO: bisher gibt es nur assumed roles, das Konzept einer primary assumed Role müsste noch eingeführt werden, derzeit nehmen wir dafür immer den `globalAdmin()`. Bevor Kunden aber selbst Objekte anlegen können, muss das geklärt sein.)
+
+#### Typ Root: Objekte, welche nur eine Spezialisierung bzw. Zusatzdaten für andere Objekte bereitstellen (z.B. Partner für Relations vom Typ Partner oder Partner Details für Partner)
+
+Objektorientiert gedacht, enthalten solche Objekte die Zusatzdaten einer Subklasse; die Daten im Partner erweitern also eine Relation vom Typ `partner`.
+
+- Dann muss dieses Objekt zeitlich nach dem Objekt erzeugt werden, auf dass es sich bezieht, also z.B. zeitlich nach der Relation.
+- Es werden Delete (\*), Edit und View Permissions für dieses Objekt erzeugt.
+- Es werden **keine** Rollen für dieses Objekt erzeugt.
+- Statt eigener Rollen werden die o.g. Permissions passenden Rollen des Hauptobjekts zugewiesen (granted) bzw. aus denen entfernt (revoked).
+  - Handelt es sich um Zusatzdaten zum Zwecke der Spezialisierung, dann z.B. so: 
+      - Delete (\*) <-- Owner des Hauptobjektes
+      - Edit <-- **Admin** des Hauptobjektes
+      - View <-- Agent des Hauptobjektes
+  - Handelt es sich um Zusatzdaten, für die sich Edit-Rechte delegieren lassen sollen (wie im Falle der Partner-Details eines Partners), dann z.B. so:
+      - Delete (\*) <-- Owner des Hauptobjektes
+      - Edit <-- **Agent** des Hauptobjektes
+      - View <-- Agent des Hauptobjektes
+- Für die Rollenzuordnung zwischen referenzierten Objekten gilt:
+  - Für Objekte vom Typ Root werden die Rollen des zugehörigen Aggregator-Objektes verwendet. 
+  - Gibt es Referenzen auf hierarchisch verbundene Objekte (z.B. Debitor.refundBankAccount) gilt folgende Faustregel:
+        ***Nach oben absteigen, nach unten halten oder aufsteigen.*** An einem fachlich übergeordneten Objekt wird also eine niedrigere Rolle (z.B. Debitor-admin -> Partner.agent), einem fachlich untergeordneten Objekt eine gleichwertige Rolle (z.B. Partner.admin -> Debitor.admin) zugewiesen oder sogar aufgestiegen (Debitor.admin -> Package.tenant).
+  - Für Referenzen zwischen Objekten, die nicht hierarchisch zueinander stehen (z.B. Debitor und Bankverbindung), wird auf beiden seiten abgestiegen (also Debitor.admin -> BankAccount.referrer und BankAccount.admin -> Debitor.tenant).
+
+Anmerkung: Der Typ-Begriff *Root* bezieht sich auf die Rolle im fachlichen Datenmodell. Im Bezug auf den Teilgraphen eines fachlichen Kontexts ist dies auch eine Wurzel im Sinne der Graphentheorie. Aber in anderen fachlichen Kontexten können auch diese Objekte von anderen Teilgraphen referenziert werden und werden dann zum inneren Knoten.
+
+
+#### Typ Aggregator: Objekte, welche weitere Objekte zusammenfassen (z.B. Relation fasst zwei Persons und einen Contact zusammen)
+
+Solche Objekte verweisen üblicherweise auf Objekte vom Typ Leaf und werden oft von Objekten des Typs Root referenziert.
+
+- Es werden i.d.R. folgende Rollen für diese Objekte erzeugt:
+    - Owner, Admin, Agent, Tenent(, Guest?)
+- Es werden Delete (\*), Edit und View Permissions für dieses Objekt erzeugt.
+- Die Permissions werden den Rollen sinnvoll zugewiesen, z.B.:
+    - Owner -> Delete (\*)
+    - Admin --> Edit
+    - Tenant (oder ggf. Guest) --> View
+-  Außerdem werden folgende Grants erstellt bzw. entzogen:
+    - Initiator --> Owner
+    - Owner --> Admin
+    - Admin --> Referrer
+    - Admins der referenzierten Objekte werden Agent des Aggregators
+    - Tenants des Aggregators werden Referrer der referenzierten Objekte
+
+### Typ Leaf: Handelt es sich um ein Objekt, welches (außer zur Modellierung separater Permissions) keine Unterobjekte enthält (z.B. Person, Customer)?
+
+Solche Objekte werden üblicherweise von Objekten des Typs Aggregator, manchmal auch von Objekten des Typs Root, referenziert.
+
+- Es werden i.d.R. folgende Rollen für diese Objekte erzeugt:
+    - Owner, Admin, Referrer
+- Es werden Delete (\*), Edit und View Permissions für dieses Objekt erzeugt.
+- Die Permissions werden den Rollen sinnvoll zugewiesen, z.B.:
+    - Delete (\*) <-- Owner
+    - Edit <-- Admin
+    - View <-- Referrer
+- Außerdem werden folgende Grants erstellt bzw. entzogen:
+    - Owner --> Admin
+    - Admin --> Referrer
+
+```mermaid
+flowchart LR
+
+subgraph partnerDetails
+    direction TB
+    style partnerDetails fill:#eee
+    
+    perm:partnerDetails.*{{partnerDetails.*}}
+    role:partnerDetails.edit{{partnerDetails.edit}}
+    role:partnerDetails.view{{partnerDetails.view}}
+    
+    
+end
+```

doc/ideas/simplified-grant-structure.md

@@ -0,0 +1,29 @@
+(this is just a scribbled idea, that's why it's still in German)
+
+Ich habe mal wieder vom RBAC-System geträumt 🙈 Ok, im Halbschlaf darüber nachgedacht trifft es wohl besser. Und jetzt frage ich mich, ob wir viel zu kompliziert gedacht haben.
+
+Bislang gingen wir ja davon aus, dass, wenn komplexe Entitäten (z.B. Partner) erzeugt werden, wir wir über den INSERT-Trigger den Rollen der verknüpften Entitäten (z.B. den Rollen der Personendaten des Partners) auch Rechte an den komplexeren Entitäten und umgekehrt geben müssen.
+
+Da die komplexen Entitäten nur mit gewissen verbundenen Entitäten überhaupt sinnvoll nutzbar sind und diese daher über INNSER JOINs mitladen, könnte sonst auch nur jemand diese Entitäten, der auch die SELECT-Permission an den verküpften Entitäten hat.
+
+Vor einigen Wochen hatten wir schon einmal darüber geredet, ob wir dieses Geflecht wirklich komplett durchplanen müssen, also über mehrere Stufen hinweg, oder ob sehr warscheinlich eh dieselben Leuten an den weiter entfernten Entitäten die nötien Rechte haben, weil dahinter dieselben User stehen. Also z.B. dass gewährleistet ist, dass jemand mit ADMIN-Recht an den Personendaten des Partners auch bis in die SEPA-Mandate eines Debitors hineinsehen kann.
+
+Und nun gehe ich noch einen Schritt weiter: Könnte es nicht auch andersherum sein? Also wenn jemand z.B. SELECT-Recht am Partner hat, dass wir davon ausgehen können, dass derjenige auch die Partner-Personen- und Kontaktdaten sehen darf, und zwar implizit durch seine Partner-SELECT-Permission und ohne dass er explizit Rollen für diese Partner-Personen oder Kontaktdaten inne hat?
+
+Im Halbschlaf kam mir nur die Idee, warum wir nicht einfach die komplexen JPA-Entitäten zwar auf die restricted View setzen, wie bisher, aber für die verknüpften Entitäten auf die direkten (bisher "Raw..." genannt) Entitäten gehen. Dann könnte jemand mit einer Rolle, welche die SELECT-Permission auf die komplexe JPA-Entität (z.B.) Partner inne hat, auch die dazugehörige Relation(ship) ["Relation" wurde vor kurzem auf kurz "Relation" umbenannt] und die wiederum dazu gehörigen Personen- und Kontaktdaten lesen, ohne dass in einem INSERT- und UPDATE-Trigger der Partner-Entität die ganzen Grants mit den verknüpften Entäten aufgebaut und aktualisiert werden müssen.
+
+Beim Debitor ist das nämlich selbst mit Generator die Hölle, zumal eben auch Querverbindungen gegranted werden müssen, z.B. von der Debitor-Person zum Sema-Mandat - jedenfalls wenn man nicht Gefahr laufen wollte, dass jemand mit Admin-Rechten an der Partner-Person (also z.B. ein Repräsentant des Partners) die Sepa-Mandate der Debitoren gar nicht mehr sehen kann. Natürlich bräuchte man immer noch die Agent-Rolle am Partner und Debitor (evtl. repräsentiert durch die jeweils zugehörigen Relation - falls dieser Trick überhaupt noch nötig wäre), sowie ein Grant vom Partner-Agent auf den Debitor-Agent und vom Debitor-Agent auf die Sepa-Mandate-Admins, aber eben ohne filigran die ganzen Neben-Entäten (Personen- und Kontaktdaten von Partner und Debitor sowie Bank-Account) in jedem Trigger berücksichtigen zu müssen. Beim Refund-Bank-Account sogar besonders ätzend, weil der optional ist und dadurch zig "if ...refundBankAccountUuid is not null then ..." im Code enstehen (wenn der auch generiert ist).
+
+Mit anderen Worten, um als Repräsentant eines Geschäftspartners auf den Bank-Account der Sepa-Mandate sehen zu dürfen, wird derzeut folgende Grant-Kette durchlaufen (bzw. eben noch nicht, weil es noch nicht funktioniert):
+
+User -> Partner-Holder-Person:Admin -> Partner-Relation:Agent -> Debitor-Relation:Agent -> Sepa-Mandat:Admin -> BankAccount:Admin -> BankAccount:SELECT
+
+Daraus würde:
+
+User -> Partner-Relation:Agent -> Debitor-Relation:Agent -> Sepa-Mandat:Admin -> Sepa-Mandat:SELECT*
+
+(*mit JOIN auf RawBankAccount, also implizitem Leserecht)
+
+Das klingt zunächst nach nur einer marginalen Vereinfachung, die eigentlich Vereinfachung liegt aber im Erzeugen der Grants in den Triggern, denn da sind zudem noch Partner-Anchor-Person, Debitor-Holder- und Anchor-Person, Partner- und Debitor-Contact sowie der RefundBankAccount zu berücksichtigen. Und genau diese Grants würden großteils wegfallen, und durch implizite Persmissions über die JOINs auf die Raw-Tables ersetzt werden. Den refundBankAccound müssten wir dann, analog zu den Sepa-Mandataten, umgedreht modellieren, da den sonst
+
+Man könnte das Ganze auch als "Entwicklung der Rechtestruktur für Hosting-Entitäten auf der obersten Ebene" (Manged Webspace, Managed Server, Cloud Server etc.) sehen, denn die hängen alle unter dem Mega-komplexen Debitor.  

doc/rbac.md

@@ -1,6 +1,6 @@
 ## *hsadmin-ng*'s Role-Based-Access-Management (RBAC)
 
-The requirements of *hsadmin-ng* include table-m row- and column-level-security for read and write access to business-objects.
+The requirements of *hsadmin-ng* include table-, row- and column-level-security for read and write access to business-objects.
 More precisely, any access has to be controlled according to given rules depending on the accessing users, their roles and the accessed business-object.
 Further, roles and business-objects are hierarchical.
 

src/main/java/net/hostsharing/hsadminng/hs/office/bankaccount/HsOfficeBankAccountEntity.java

@@ -33,8 +33,8 @@ import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
 public class HsOfficeBankAccountEntity implements HasUuid, Stringifyable {
 
     private static Stringify<HsOfficeBankAccountEntity> toString = stringify(HsOfficeBankAccountEntity.class, "bankAccount")
+            .withIdProp(HsOfficeBankAccountEntity::getIban)
             .withProp(Fields.holder, HsOfficeBankAccountEntity::getHolder)
-            .withProp(Fields.iban, HsOfficeBankAccountEntity::getIban)
             .withProp(Fields.bic, HsOfficeBankAccountEntity::getBic);
 
     @Id
@@ -59,8 +59,11 @@ public class HsOfficeBankAccountEntity implements HasUuid, Stringifyable {
 
     public static RbacView rbac() {
         return rbacViewFor("bankAccount", HsOfficeBankAccountEntity.class)
-                .withIdentityView(SQL.projection("iban || ':' || holder"))
+                .withIdentityView(SQL.projection("iban"))
                 .withUpdatableColumns("holder", "iban", "bic")
+
+                .toRole("global", GUEST).grantPermission(INSERT)
+
                 .createRole(OWNER, (with) -> {
                     with.owningUser(CREATOR);
                     with.incomingSuperRole(GLOBAL, ADMIN);
@@ -75,6 +78,6 @@ public class HsOfficeBankAccountEntity implements HasUuid, Stringifyable {
     }
 
     public static void main(String[] args) throws IOException {
-        rbac().generateWithBaseFileName("243-hs-office-bankaccount-rbac-generated");
+        rbac().generateWithBaseFileName("243-hs-office-bankaccount-rbac");
     }
 }

src/main/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContactEntity.java

@@ -75,10 +75,11 @@ public class HsOfficeContactEntity implements Stringifyable, HasUuid {
                 })
                 .createSubRole(REFERRER, (with) -> {
                     with.permission(SELECT);
-                });
+                })
+                .toRole(GLOBAL, GUEST).grantPermission(INSERT);
     }
 
     public static void main(String[] args) throws IOException {
-        rbac().generateWithBaseFileName("203-hs-office-contact-rbac-generated");
+        rbac().generateWithBaseFileName("203-hs-office-contact-rbac");
     }
 }

src/main/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionEntity.java

@@ -12,6 +12,7 @@ import org.hibernate.annotations.GenericGenerator;
 import jakarta.persistence.*;
 import java.math.BigDecimal;
 import java.time.LocalDate;
+import java.util.Optional;
 import java.util.UUID;
 
 import static java.util.Optional.ofNullable;
@@ -28,13 +29,12 @@ import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
 public class HsOfficeCoopAssetsTransactionEntity implements Stringifyable, HasUuid {
 
     private static Stringify<HsOfficeCoopAssetsTransactionEntity> stringify = stringify(HsOfficeCoopAssetsTransactionEntity.class)
-            .withProp(HsOfficeCoopAssetsTransactionEntity::getMemberNumber)
+            .withIdProp(HsOfficeCoopAssetsTransactionEntity::getTaggedMemberNumber)
             .withProp(HsOfficeCoopAssetsTransactionEntity::getValueDate)
             .withProp(HsOfficeCoopAssetsTransactionEntity::getTransactionType)
             .withProp(HsOfficeCoopAssetsTransactionEntity::getAssetValue)
             .withProp(HsOfficeCoopAssetsTransactionEntity::getReference)
             .withProp(HsOfficeCoopAssetsTransactionEntity::getComment)
-            .withSeparator(", ")
             .quotedValues(false);
 
     @Id
@@ -76,8 +76,8 @@ public class HsOfficeCoopAssetsTransactionEntity implements Stringifyable, HasUu
     private String comment;
 
 
-    public Integer getMemberNumber() {
-        return ofNullable(membership).map(HsOfficeMembershipEntity::getMemberNumber).orElse(null);
+    public String getTaggedMemberNumber() {
+        return ofNullable(membership).map(HsOfficeMembershipEntity::toShortString).orElse("M-?????");
     }
 
     @Override
@@ -87,6 +87,6 @@ public class HsOfficeCoopAssetsTransactionEntity implements Stringifyable, HasUu
 
     @Override
     public String toShortString() {
-        return "%s%+1.2f".formatted(getMemberNumber(), assetValue);
+        return "%s:%+1.2f".formatted(getTaggedMemberNumber(), Optional.ofNullable(assetValue).orElse(BigDecimal.ZERO));
     }
 }

src/main/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionEntity.java

@@ -31,7 +31,6 @@ public class HsOfficeCoopSharesTransactionEntity implements Stringifyable, HasUu
             .withProp(HsOfficeCoopSharesTransactionEntity::getShareCount)
             .withProp(HsOfficeCoopSharesTransactionEntity::getReference)
             .withProp(HsOfficeCoopSharesTransactionEntity::getComment)
-            .withSeparator(", ")
             .quotedValues(false);
 
     @Id

src/main/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorController.java

@@ -5,7 +5,11 @@ import net.hostsharing.hsadminng.hs.office.generated.api.v1.api.HsOfficeDebitors
 import net.hostsharing.hsadminng.hs.office.generated.api.v1.model.HsOfficeDebitorInsertResource;
 import net.hostsharing.hsadminng.hs.office.generated.api.v1.model.HsOfficeDebitorPatchResource;
 import net.hostsharing.hsadminng.hs.office.generated.api.v1.model.HsOfficeDebitorResource;
+import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationEntity;
+import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationRepository;
 import net.hostsharing.hsadminng.mapper.Mapper;
+import org.apache.commons.lang3.Validate;
+import org.hibernate.Hibernate;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.ResponseEntity;
 import org.springframework.transaction.annotation.Transactional;
@@ -13,10 +17,13 @@ import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.servlet.mvc.method.annotation.MvcUriComponentsBuilder;
 
 import jakarta.persistence.EntityManager;
+import jakarta.persistence.EntityNotFoundException;
 import jakarta.persistence.PersistenceContext;
 import java.util.List;
 import java.util.UUID;
 
+import static net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationType.DEBITOR;
+
 @RestController
 
 public class HsOfficeDebitorController implements HsOfficeDebitorsApi {
@@ -30,6 +37,9 @@ public class HsOfficeDebitorController implements HsOfficeDebitorsApi {
     @Autowired
     private HsOfficeDebitorRepository debitorRepo;
 
+    @Autowired
+    private HsOfficeRelationRepository relRepo;
+
     @PersistenceContext
     private EntityManager em;
 
@@ -53,22 +63,44 @@ public class HsOfficeDebitorController implements HsOfficeDebitorsApi {
     @Override
     @Transactional
     public ResponseEntity<HsOfficeDebitorResource> addDebitor(
-            final String currentUser,
-            final String assumedRoles,
-            final HsOfficeDebitorInsertResource body) {
+            String currentUser,
+            String assumedRoles,
+            HsOfficeDebitorInsertResource body) {
 
         context.define(currentUser, assumedRoles);
 
-        final var entityToSave = mapper.map(body, HsOfficeDebitorEntity.class);
+        Validate.isTrue(body.getDebitorRel() == null || body.getDebitorRelUuid() == null,
+                "ERROR: [400] exactly one of debitorRel and debitorRelUuid must be supplied, but found both");
+        Validate.isTrue(body.getDebitorRel() != null || body.getDebitorRelUuid() != null,
+                "ERROR: [400] exactly one of debitorRel and debitorRelUuid must be supplied, but found none");
+        Validate.isTrue(body.getDebitorRel() == null ||
+                    body.getDebitorRel().getType() == null || DEBITOR.name().equals(body.getDebitorRel().getType()),
+                "ERROR: [400] debitorRel.type must be '"+DEBITOR.name()+"' or null for default");
+        Validate.isTrue(body.getDebitorRel() == null || body.getDebitorRel().getMark() == null,
+                "ERROR: [400] debitorRel.mark must be null");
 
-        final var saved = debitorRepo.save(entityToSave);
+        final var entityToSave = mapper.map(body, HsOfficeDebitorEntity.class);
+        if ( body.getDebitorRel() != null ) {
+            body.getDebitorRel().setType(DEBITOR.name());
+            final var debitorRel = mapper.map(body.getDebitorRel(), HsOfficeRelationEntity.class);
+            entityToSave.setDebitorRel(relRepo.save(debitorRel));
+        } else {
+            final var debitorRelOptional = relRepo.findByUuid(body.getDebitorRelUuid());
+            debitorRelOptional.ifPresentOrElse(
+                    debitorRel -> {entityToSave.setDebitorRel(relRepo.save(debitorRel));},
+                    () -> { throw new EntityNotFoundException("ERROR: [400] debitorRelUuid not found: " + body.getDebitorRelUuid());});
+        }
+
+        final var savedEntity = debitorRepo.save(entityToSave);
+        em.flush();
+        em.refresh(savedEntity);
 
         final var uri =
                 MvcUriComponentsBuilder.fromController(getClass())
                         .path("/api/hs/office/debitors/{id}")
-                        .buildAndExpand(saved.getUuid())
+                        .buildAndExpand(savedEntity.getUuid())
                         .toUri();
-        final var mapped = mapper.map(saved, HsOfficeDebitorResource.class);
+        final var mapped = mapper.map(savedEntity, HsOfficeDebitorResource.class);
         return ResponseEntity.created(uri).body(mapped);
     }
 
@@ -119,6 +151,7 @@ public class HsOfficeDebitorController implements HsOfficeDebitorsApi {
         new HsOfficeDebitorEntityPatcher(em, current).apply(body);
 
         final var saved = debitorRepo.save(current);
+        Hibernate.initialize(saved);
         final var mapped = mapper.map(saved, HsOfficeDebitorResource.class);
         return ResponseEntity.ok(mapped);
     }

src/main/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorEntity.java

@@ -3,7 +3,6 @@ package net.hostsharing.hsadminng.hs.office.debitor;
 import lombok.*;
 import net.hostsharing.hsadminng.errors.DisplayName;
 import net.hostsharing.hsadminng.hs.office.bankaccount.HsOfficeBankAccountEntity;
-import net.hostsharing.hsadminng.hs.office.contact.HsOfficeContactEntity;
 import net.hostsharing.hsadminng.hs.office.partner.HsOfficePartnerEntity;
 import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationEntity;
 import net.hostsharing.hsadminng.persistence.HasUuid;
@@ -12,17 +11,26 @@ import net.hostsharing.hsadminng.rbac.rbacdef.RbacView.SQL;
 import net.hostsharing.hsadminng.stringify.Stringify;
 import net.hostsharing.hsadminng.stringify.Stringifyable;
 import org.hibernate.annotations.GenericGenerator;
+import org.hibernate.annotations.JoinFormula;
+import org.hibernate.annotations.NotFound;
+import org.hibernate.annotations.NotFoundAction;
 
 import jakarta.persistence.*;
 import java.io.IOException;
-import java.util.Optional;
 import java.util.UUID;
 
+import static jakarta.persistence.CascadeType.DETACH;
+import static jakarta.persistence.CascadeType.MERGE;
+import static jakarta.persistence.CascadeType.PERSIST;
+import static jakarta.persistence.CascadeType.REFRESH;
+import static java.util.Optional.ofNullable;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Column.dependsOnColumn;
+import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Nullable.NOT_NULL;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Nullable.NULLABLE;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Permission.*;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Role.*;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.SQL.directlyFetchedByDependsOnColumn;
+import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.SQL.fetchedBySql;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.rbacViewFor;
 import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
 
@@ -30,7 +38,7 @@ import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
 @Table(name = "hs_office_debitor_rv")
 @Getter
 @Setter
-@Builder
+@Builder(toBuilder = true)
 @NoArgsConstructor
 @AllArgsConstructor
 @DisplayName("Debitor")
@@ -38,15 +46,11 @@ public class HsOfficeDebitorEntity implements HasUuid, Stringifyable {
 
     public static final String DEBITOR_NUMBER_TAG = "D-";
 
-    // TODO: I would rather like to generate something matching this example:
-    //  debitor(1234500: Test AG, tes)
-    // maybe remove withSepararator (always use ', ') and add withBusinessIdProp (with ': ' afterwards)?
     private static Stringify<HsOfficeDebitorEntity> stringify =
             stringify(HsOfficeDebitorEntity.class, "debitor")
-                    .withProp(e -> DEBITOR_NUMBER_TAG + e.getDebitorNumber())
-                    .withProp(HsOfficeDebitorEntity::getPartner)
+                    .withIdProp(HsOfficeDebitorEntity::toShortString)
+                    .withProp(e -> ofNullable(e.getDebitorRel()).map(HsOfficeRelationEntity::toShortString).orElse(null))
                     .withProp(HsOfficeDebitorEntity::getDefaultPrefix)
-                    .withSeparator(": ")
                     .quotedValues(false);
 
     @Id
@@ -55,15 +59,28 @@ public class HsOfficeDebitorEntity implements HasUuid, Stringifyable {
     private UUID uuid;
 
     @ManyToOne
-    @JoinColumn(name = "partneruuid")
+    @JoinFormula(
+        referencedColumnName = "uuid",
+        value = """
+            (
+                SELECT DISTINCT partner.uuid
+                FROM hs_office_partner_rv partner
+                JOIN hs_office_relation_rv dRel
+                    ON dRel.uuid = debitorreluuid AND dRel.type = 'DEBITOR'
+                JOIN hs_office_relation_rv pRel
+                    ON pRel.uuid = partner.partnerRelUuid AND pRel.type = 'PARTNER'
+                WHERE pRel.holderUuid = dRel.anchorUuid
+            )
+            """)
+    @NotFound(action = NotFoundAction.IGNORE)
     private HsOfficePartnerEntity partner;
 
     @Column(name = "debitornumbersuffix", columnDefinition = "numeric(2)")
     private Byte debitorNumberSuffix; // TODO maybe rather as a formatted String?
 
-    @ManyToOne
-    @JoinColumn(name = "billingcontactuuid")
-    private HsOfficeContactEntity billingContact; // TODO: migrate to billingPerson
+    @ManyToOne(cascade = { PERSIST, MERGE, REFRESH, DETACH }, optional = false)
+    @JoinColumn(name = "debitorreluuid", nullable = false)
+    private HsOfficeRelationEntity debitorRel;
 
     @Column(name = "billable", nullable = false)
     private Boolean billable; // not a primitive because otherwise the default would be false
@@ -88,14 +105,16 @@ public class HsOfficeDebitorEntity implements HasUuid, Stringifyable {
     private String defaultPrefix;
 
     private String getDebitorNumberString() {
-        if (partner == null || partner.getPartnerNumber() == null || debitorNumberSuffix == null) {
-            return null;
-        }
-        return partner.getPartnerNumber() + String.format("%02d", debitorNumberSuffix);
+        return ofNullable(partner)
+                .filter(partner -> debitorNumberSuffix != null)
+                .map(HsOfficePartnerEntity::getPartnerNumber)
+                .map(Object::toString)
+                .map(partnerNumber -> partnerNumber + String.format("%02d", debitorNumberSuffix))
+                .orElse(null);
     }
 
     public Integer getDebitorNumber() {
-        return Optional.ofNullable(getDebitorNumberString()).map(Integer::parseInt).orElse(null);
+        return ofNullable(getDebitorNumberString()).map(Integer::parseInt).orElse(null);
     }
 
     @Override
@@ -111,28 +130,28 @@ public class HsOfficeDebitorEntity implements HasUuid, Stringifyable {
     public static RbacView rbac() {
         return rbacViewFor("debitor", HsOfficeDebitorEntity.class)
                 .withIdentityView(SQL.query("""
-                            SELECT debitor.uuid,
-                                        'D-' || (SELECT partner.partnerNumber
-                                                FROM hs_office_partner partner
-                                                JOIN hs_office_relation partnerRel
-                                                    ON partnerRel.uuid = partner.partnerRelUUid AND partnerRel.type = 'PARTNER'
-                                                JOIN hs_office_relation debitorRel
-                                                    ON debitorRel.anchorUuid = partnerRel.holderUuid AND partnerRel.type = 'DEBITOR'
-                                                WHERE debitorRel.uuid = debitor.debitorRelUuid)
-                                             || to_char(debitorNumberSuffix, 'fm00')
-                                from hs_office_debitor as debitor
+                        SELECT debitor.uuid AS uuid,
+                                    'D-' || (SELECT partner.partnerNumber
+                                            FROM hs_office_partner partner
+                                            JOIN hs_office_relation partnerRel
+                                                ON partnerRel.uuid = partner.partnerRelUUid AND partnerRel.type = 'PARTNER'
+                                            JOIN hs_office_relation debitorRel
+                                                ON debitorRel.anchorUuid = partnerRel.holderUuid AND debitorRel.type = 'DEBITOR'
+                                            WHERE debitorRel.uuid = debitor.debitorRelUuid)
+                                         || to_char(debitorNumberSuffix, 'fm00') as idName
+                        FROM hs_office_debitor AS debitor
                         """))
+                .withRestrictedViewOrderBy(SQL.projection("defaultPrefix"))
                 .withUpdatableColumns(
-                        "debitorRel",
+                        "debitorRelUuid",
                         "billable",
-                        "debitorUuid",
                         "refundBankAccountUuid",
                         "vatId",
                         "vatCountryCode",
                         "vatBusiness",
                         "vatReverseCharge",
                         "defaultPrefix" /* TODO: do we want that updatable? */)
-                .createPermission(INSERT).grantedTo("global", ADMIN)
+                .toRole("global", ADMIN).grantPermission(INSERT)
 
                 .importRootEntityAliasProxy("debitorRel", HsOfficeRelationEntity.class,
                         directlyFetchedByDependsOnColumn(),
@@ -149,9 +168,16 @@ public class HsOfficeDebitorEntity implements HasUuid, Stringifyable {
                 .toRole("debitorRel", AGENT).grantRole("refundBankAccount", REFERRER)
 
                 .importEntityAlias("partnerRel", HsOfficeRelationEntity.class,
-                        dependsOnColumn("partnerRelUuid"),
-                        directlyFetchedByDependsOnColumn(),
-                        NULLABLE)
+                        dependsOnColumn("debitorRelUuid"),
+                        fetchedBySql("""
+                                SELECT ${columns}
+                                    FROM hs_office_relation AS partnerRel
+                                    JOIN hs_office_relation AS debitorRel
+                                        ON debitorRel.type = 'DEBITOR' AND debitorRel.anchorUuid = partnerRel.holderUuid
+                                    WHERE partnerRel.type = 'PARTNER'
+                                        AND ${REF}.debitorRelUuid = debitorRel.uuid
+                                """),
+                        NOT_NULL)
                 .toRole("partnerRel", ADMIN).grantRole("debitorRel", ADMIN)
                 .toRole("partnerRel", AGENT).grantRole("debitorRel", AGENT)
                 .toRole("debitorRel", AGENT).grantRole("partnerRel", TENANT)
@@ -162,6 +188,6 @@ public class HsOfficeDebitorEntity implements HasUuid, Stringifyable {
     }
 
     public static void main(String[] args) throws IOException {
-        rbac().generateWithBaseFileName("273-hs-office-debitor-rbac-generated");
+        rbac().generateWithBaseFileName("273-hs-office-debitor-rbac");
     }
 }

src/main/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorEntityPatcher.java

@@ -1,8 +1,8 @@
 package net.hostsharing.hsadminng.hs.office.debitor;
 
 import net.hostsharing.hsadminng.hs.office.bankaccount.HsOfficeBankAccountEntity;
-import net.hostsharing.hsadminng.hs.office.contact.HsOfficeContactEntity;
 import net.hostsharing.hsadminng.hs.office.generated.api.v1.model.HsOfficeDebitorPatchResource;
+import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationEntity;
 import net.hostsharing.hsadminng.mapper.EntityPatcher;
 import net.hostsharing.hsadminng.mapper.OptionalFromJson;
 
@@ -23,9 +23,9 @@ class HsOfficeDebitorEntityPatcher implements EntityPatcher<HsOfficeDebitorPatch
 
     @Override
     public void apply(final HsOfficeDebitorPatchResource resource) {
-        OptionalFromJson.of(resource.getBillingContactUuid()).ifPresent(newValue -> {
-            verifyNotNull(newValue, "billingContact");
-            entity.setBillingContact(em.getReference(HsOfficeContactEntity.class, newValue));
+        OptionalFromJson.of(resource.getDebitorRelUuid()).ifPresent(newValue -> {
+            verifyNotNull(newValue, "debitorRel");
+            entity.setDebitorRel(em.getReference(HsOfficeRelationEntity.class, newValue));
         });
         Optional.ofNullable(resource.getBillable()).ifPresent(entity::setBillable);
         OptionalFromJson.of(resource.getVatId()).ifPresent(entity::setVatId);

src/main/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorRepository.java

@@ -13,7 +13,10 @@ public interface HsOfficeDebitorRepository extends Repository<HsOfficeDebitorEnt
 
     @Query("""
             SELECT debitor FROM HsOfficeDebitorEntity debitor
-                WHERE cast(debitor.partner.partnerNumber as integer) = :partnerNumber
+            JOIN HsOfficePartnerEntity partner
+                    ON partner.partnerRel.holder = debitor.debitorRel.anchor
+                        AND partner.partnerRel.type = 'PARTNER' AND debitor.debitorRel.type = 'DEBITOR'
+                WHERE cast(partner.partnerNumber as integer) = :partnerNumber
                   AND cast(debitor.debitorNumberSuffix as integer) = :debitorNumberSuffix
                """)
      List<HsOfficeDebitorEntity> findDebitorByDebitorNumber(int partnerNumber, byte debitorNumberSuffix);
@@ -24,9 +27,15 @@ public interface HsOfficeDebitorRepository extends Repository<HsOfficeDebitorEnt
 
     @Query("""
             SELECT debitor FROM HsOfficeDebitorEntity debitor
-                JOIN HsOfficePartnerEntity partner ON partner.uuid = debitor.partner.uuid
-                JOIN HsOfficePersonEntity person ON person.uuid = partner.person.uuid
-                JOIN HsOfficeContactEntity contact ON contact.uuid = debitor.billingContact.uuid
+                JOIN HsOfficePartnerEntity partner
+                    ON partner.partnerRel.holder = debitor.debitorRel.anchor
+                        AND partner.partnerRel.type = 'PARTNER' AND debitor.debitorRel.type = 'DEBITOR'
+                JOIN HsOfficePersonEntity person
+                    ON person.uuid = partner.partnerRel.holder.uuid
+                        OR person.uuid = debitor.debitorRel.holder.uuid
+                JOIN HsOfficeContactEntity contact
+                    ON contact.uuid = debitor.debitorRel.contact.uuid 
+                        OR contact.uuid = partner.partnerRel.contact.uuid
                 WHERE :name is null
                     OR partner.details.birthName like concat(cast(:name as text), '%')
                     OR person.tradeName like concat(cast(:name as text), '%')

src/main/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipController.java

@@ -12,8 +12,6 @@ import org.springframework.transaction.annotation.Transactional;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.servlet.mvc.method.annotation.MvcUriComponentsBuilder;
 
-import jakarta.persistence.EntityManager;
-import jakarta.persistence.PersistenceContext;
 import jakarta.validation.Valid;
 import java.util.List;
 import java.util.UUID;
@@ -32,9 +30,6 @@ public class HsOfficeMembershipController implements HsOfficeMembershipsApi {
     @Autowired
     private HsOfficeMembershipRepository membershipRepo;
 
-    @PersistenceContext
-    private EntityManager em;
-
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<HsOfficeMembershipResource>> listMemberships(
@@ -121,7 +116,7 @@ public class HsOfficeMembershipController implements HsOfficeMembershipsApi {
 
         final var current = membershipRepo.findByUuid(membershipUuid).orElseThrow();
 
-        new HsOfficeMembershipEntityPatcher(em, mapper, current).apply(body);
+        new HsOfficeMembershipEntityPatcher(mapper, current).apply(body);
 
         final var saved = membershipRepo.save(current);
         final var mapped = mapper.map(saved, HsOfficeMembershipResource.class, SEPA_MANDATE_ENTITY_TO_RESOURCE_POSTMAPPER);

src/main/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipEntity.java

@@ -4,20 +4,30 @@ import com.vladmihalcea.hibernate.type.range.PostgreSQLRangeType;
 import com.vladmihalcea.hibernate.type.range.Range;
 import lombok.*;
 import net.hostsharing.hsadminng.errors.DisplayName;
-import net.hostsharing.hsadminng.hs.office.debitor.HsOfficeDebitorEntity;
+import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationEntity;
 import net.hostsharing.hsadminng.persistence.HasUuid;
 import net.hostsharing.hsadminng.hs.office.partner.HsOfficePartnerEntity;
+import net.hostsharing.hsadminng.rbac.rbacdef.RbacView;
+import net.hostsharing.hsadminng.rbac.rbacdef.RbacView.SQL;
 import net.hostsharing.hsadminng.stringify.Stringify;
 import net.hostsharing.hsadminng.stringify.Stringifyable;
-import org.hibernate.annotations.Fetch;
-import org.hibernate.annotations.FetchMode;
 import org.hibernate.annotations.Type;
 
 import jakarta.persistence.*;
+import java.io.IOException;
 import java.time.LocalDate;
 import java.util.UUID;
 
 import static net.hostsharing.hsadminng.mapper.PostgresDateRange.*;
+import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Column.dependsOnColumn;
+import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Nullable.NOT_NULL;
+import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Permission.*;
+import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Permission.SELECT;
+import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.RbacUserReference.UserRole.CREATOR;
+import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Role.*;
+import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Role.REFERRER;
+import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.SQL.fetchedBySql;
+import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.rbacViewFor;
 import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
 
 @Entity
@@ -35,10 +45,8 @@ public class HsOfficeMembershipEntity implements HasUuid, Stringifyable {
     private static Stringify<HsOfficeMembershipEntity> stringify = stringify(HsOfficeMembershipEntity.class)
             .withProp(e -> MEMBER_NUMBER_TAG + e.getMemberNumber())
             .withProp(e -> e.getPartner().toShortString())
-            .withProp(e -> e.getMainDebitor().toShortString())
             .withProp(e -> e.getValidity().asString())
             .withProp(HsOfficeMembershipEntity::getReasonForTermination)
-            .withSeparator(", ")
             .quotedValues(false);
 
     @Id
@@ -49,11 +57,6 @@ public class HsOfficeMembershipEntity implements HasUuid, Stringifyable {
     @JoinColumn(name = "partneruuid")
     private HsOfficePartnerEntity partner;
 
-    @ManyToOne
-    @Fetch(FetchMode.JOIN)
-    @JoinColumn(name = "maindebitoruuid")
-    private HsOfficeDebitorEntity mainDebitor;
-
     @Column(name = "membernumbersuffix", length = 2)
     private String memberNumberSuffix;
 
@@ -114,4 +117,45 @@ public class HsOfficeMembershipEntity implements HasUuid, Stringifyable {
             setReasonForTermination(HsOfficeReasonForTermination.NONE);
         }
     }
+
+    public static RbacView rbac() {
+        return rbacViewFor("membership", HsOfficeMembershipEntity.class)
+                .withIdentityView(SQL.query("""
+                        SELECT m.uuid AS uuid,
+                                'M-' || p.partnerNumber || m.memberNumberSuffix as idName
+                        FROM hs_office_membership AS m
+                        JOIN hs_office_partner AS p ON p.uuid = m.partnerUuid
+                        """))
+                .withRestrictedViewOrderBy(SQL.projection("validity"))
+                .withUpdatableColumns("validity", "membershipFeeBillable", "reasonForTermination")
+
+                .importEntityAlias("partnerRel", HsOfficeRelationEntity.class,
+                        dependsOnColumn("partnerUuid"),
+                        fetchedBySql("""
+                                SELECT ${columns}
+                                    FROM hs_office_partner AS partner
+                                    JOIN hs_office_relation AS partnerRel ON partnerRel.uuid = partner.partnerRelUuid
+                                    WHERE partner.uuid = ${REF}.partnerUuid
+                                """),
+                        NOT_NULL)
+                .toRole("global", ADMIN).grantPermission(INSERT)
+
+                .createRole(OWNER, (with) -> {
+                    with.owningUser(CREATOR);
+                    with.incomingSuperRole("partnerRel", ADMIN);
+                    with.permission(DELETE);
+                })
+                .createSubRole(ADMIN, (with) -> {
+                    with.incomingSuperRole("partnerRel", AGENT);
+                    with.permission(UPDATE);
+                })
+                .createSubRole(REFERRER, (with) -> {
+                    with.outgoingSubRole("partnerRel", TENANT);
+                    with.permission(SELECT);
+                });
+    }
+
+    public static void main(String[] args) throws IOException {
+        rbac().generateWithBaseFileName("303-hs-office-membership-rbac");
+    }
 }

src/main/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipEntityPatcher.java

@@ -1,37 +1,26 @@
 package net.hostsharing.hsadminng.hs.office.membership;
 
-import net.hostsharing.hsadminng.hs.office.debitor.HsOfficeDebitorEntity;
 import net.hostsharing.hsadminng.hs.office.generated.api.v1.model.HsOfficeMembershipPatchResource;
 import net.hostsharing.hsadminng.mapper.EntityPatcher;
 import net.hostsharing.hsadminng.mapper.Mapper;
 import net.hostsharing.hsadminng.mapper.OptionalFromJson;
 
-import jakarta.persistence.EntityManager;
 import java.util.Optional;
-import java.util.UUID;
 
 public class HsOfficeMembershipEntityPatcher implements EntityPatcher<HsOfficeMembershipPatchResource> {
 
-    private final EntityManager em;
     private final Mapper mapper;
     private final HsOfficeMembershipEntity entity;
 
     public HsOfficeMembershipEntityPatcher(
-            final EntityManager em,
             final Mapper mapper,
             final HsOfficeMembershipEntity entity) {
-        this.em = em;
         this.mapper = mapper;
         this.entity = entity;
     }
 
     @Override
     public void apply(final HsOfficeMembershipPatchResource resource) {
-        OptionalFromJson.of(resource.getMainDebitorUuid())
-                .ifPresent(newValue -> {
-                    verifyNotNull(newValue, "debitor");
-                    entity.setMainDebitor(em.getReference(HsOfficeDebitorEntity.class, newValue));
-                });
         OptionalFromJson.of(resource.getValidTo()).ifPresent(
                 entity::setValidTo);
         Optional.ofNullable(resource.getReasonForTermination())
@@ -40,10 +29,4 @@ public class HsOfficeMembershipEntityPatcher implements EntityPatcher<HsOfficeMe
         OptionalFromJson.of(resource.getMembershipFeeBillable()).ifPresent(
                 entity::setMembershipFeeBillable);
     }
-
-    private void verifyNotNull(final UUID newValue, final String propertyName) {
-        if (newValue == null) {
-            throw new IllegalArgumentException("property '" + propertyName + "' must not be null");
-        }
-    }
 }

src/main/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerController.java

@@ -110,9 +110,7 @@ public class HsOfficePartnerController implements HsOfficePartnersApi {
             return ResponseEntity.notFound().build();
         }
 
-        if (partnerRepo.deleteByUuid(partnerUuid) != 1  ||
-                // TODO: move to after delete trigger in partner
-                relationRepo.deleteByUuid(partnerToDelete.get().getPartnerRel().getUuid()) != 1 ) {
+        if (partnerRepo.deleteByUuid(partnerUuid) != 1) {
             return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
         }
 
@@ -142,8 +140,6 @@ public class HsOfficePartnerController implements HsOfficePartnersApi {
         final var entityToSave = new HsOfficePartnerEntity();
         entityToSave.setPartnerNumber(body.getPartnerNumber());
         entityToSave.setPartnerRel(persistPartnerRel(body.getPartnerRel()));
-        entityToSave.setContact(ref(HsOfficeContactEntity.class, body.getContactUuid()));
-        entityToSave.setPerson(ref(HsOfficePersonEntity.class, body.getPersonUuid()));
         entityToSave.setDetails(mapper.map(body.getDetails(), HsOfficePartnerDetailsEntity.class));
         return entityToSave;
     }

src/main/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerDetailsEntity.java

@@ -2,7 +2,6 @@ package net.hostsharing.hsadminng.hs.office.partner;
 
 import lombok.*;
 import net.hostsharing.hsadminng.errors.DisplayName;
-import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationEntity;
 import net.hostsharing.hsadminng.persistence.HasUuid;
 import net.hostsharing.hsadminng.rbac.rbacdef.RbacView;
 import net.hostsharing.hsadminng.rbac.rbacdef.RbacView.SQL;
@@ -14,10 +13,8 @@ import java.io.IOException;
 import java.time.LocalDate;
 import java.util.UUID;
 
-import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Column.dependsOnColumn;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Permission.*;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Role.*;
-import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.SQL.fetchedBySql;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.rbacViewFor;
 import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
 
@@ -40,7 +37,6 @@ public class HsOfficePartnerDetailsEntity implements HasUuid, Stringifyable {
             .withProp(HsOfficePartnerDetailsEntity::getBirthday)
             .withProp(HsOfficePartnerDetailsEntity::getBirthName)
             .withProp(HsOfficePartnerDetailsEntity::getDateOfDeath)
-            .withSeparator(", ")
             .quotedValues(false);
 
     @Id
@@ -72,11 +68,12 @@ public class HsOfficePartnerDetailsEntity implements HasUuid, Stringifyable {
     public static RbacView rbac() {
         return rbacViewFor("partnerDetails", HsOfficePartnerDetailsEntity.class)
                 .withIdentityView(SQL.query("""
-                        SELECT partner_iv.idName || '-details'
+                        SELECT partnerDetails.uuid as uuid, partner_iv.idName || '-details' as idName
                             FROM hs_office_partner_details AS partnerDetails
                             JOIN hs_office_partner partner ON partner.detailsUuid = partnerDetails.uuid
                             JOIN hs_office_partner_iv partner_iv ON partner_iv.uuid = partner.uuid
                         """))
+                .withRestrictedViewOrderBy(SQL.expression("uuid"))
                 .withUpdatableColumns(
                         "registrationOffice",
                         "registrationNumber",
@@ -84,17 +81,7 @@ public class HsOfficePartnerDetailsEntity implements HasUuid, Stringifyable {
                         "birthName",
                         "birthday",
                         "dateOfDeath")
-                .createPermission(INSERT).grantedTo("global", ADMIN)
-
-                .importRootEntityAliasProxy("partnerRel", HsOfficeRelationEntity.class,
-                        fetchedBySql("""
-                            SELECT ${columns}
-                                FROM hs_office_relation AS partnerRel
-                                JOIN hs_office_partner AS partner
-                                    ON partner.detailsUuid = ${ref}.uuid
-                                WHERE partnerRel.uuid = partner.partnerRelUuid
-                            """),
-                        dependsOnColumn("partnerRelUuid"))
+                .toRole("global", ADMIN).grantPermission(INSERT)
 
                 // The grants are defined in HsOfficePartnerEntity.rbac()
                 // because they have to be changed when its partnerRel changes,
@@ -103,6 +90,6 @@ public class HsOfficePartnerDetailsEntity implements HasUuid, Stringifyable {
     }
 
     public static void main(String[] args) throws IOException {
-        rbac().generateWithBaseFileName("234-hs-office-partner-details-rbac-generated");
+        rbac().generateWithBaseFileName("234-hs-office-partner-details-rbac");
     }
 }

src/main/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerEntity.java

@@ -1,10 +1,14 @@
 package net.hostsharing.hsadminng.hs.office.partner;
 
-import lombok.*;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
 import net.hostsharing.hsadminng.errors.DisplayName;
 import net.hostsharing.hsadminng.hs.office.contact.HsOfficeContactEntity;
-import net.hostsharing.hsadminng.persistence.HasUuid;
 import net.hostsharing.hsadminng.hs.office.person.HsOfficePersonEntity;
+import net.hostsharing.hsadminng.persistence.HasUuid;
 import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationEntity;
 import net.hostsharing.hsadminng.rbac.rbacdef.RbacView;
 import net.hostsharing.hsadminng.rbac.rbacdef.RbacView.SQL;
@@ -13,17 +17,24 @@ import net.hostsharing.hsadminng.stringify.Stringifyable;
 import org.hibernate.annotations.NotFound;
 import org.hibernate.annotations.NotFoundAction;
 
-import jakarta.persistence.*;
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.Id;
+import jakarta.persistence.JoinColumn;
+import jakarta.persistence.ManyToOne;
+import jakarta.persistence.Table;
 import java.io.IOException;
-import java.util.Optional;
 import java.util.UUID;
 
+import static jakarta.persistence.CascadeType.*;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Column.dependsOnColumn;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Permission.*;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Permission.SELECT;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Role.*;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.SQL.directlyFetchedByDependsOnColumn;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.rbacViewFor;
+import static java.util.Optional.ofNullable;
 import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
 
 @Entity
@@ -36,10 +47,18 @@ import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
 @DisplayName("Partner")
 public class HsOfficePartnerEntity implements Stringifyable, HasUuid {
 
+    public static final String PARTNER_NUMBER_TAG = "P-";
+
     private static Stringify<HsOfficePartnerEntity> stringify = stringify(HsOfficePartnerEntity.class, "partner")
-            .withProp(HsOfficePartnerEntity::getPerson)
-            .withProp(HsOfficePartnerEntity::getContact)
-            .withSeparator(": ")
+            .withIdProp(HsOfficePartnerEntity::toShortString)
+            .withProp(p -> ofNullable(p.getPartnerRel())
+                    .map(HsOfficeRelationEntity::getHolder)
+                    .map(HsOfficePersonEntity::toShortString)
+                    .orElse(null))
+            .withProp(p -> ofNullable(p.getPartnerRel())
+                    .map(HsOfficeRelationEntity::getContact)
+                    .map(HsOfficeContactEntity::toShortString)
+                    .orElse(null))
             .quotedValues(false);
 
     @Id
@@ -49,25 +68,19 @@ public class HsOfficePartnerEntity implements Stringifyable, HasUuid {
     @Column(name = "partnernumber", columnDefinition = "numeric(5) not null")
     private Integer partnerNumber;
 
-    @ManyToOne
+    @ManyToOne(cascade = { PERSIST, MERGE, REFRESH, DETACH }, optional = false)
     @JoinColumn(name = "partnerreluuid", nullable = false)
     private HsOfficeRelationEntity partnerRel;
 
-    // TODO: remove, is replaced by partnerRel
-    @ManyToOne
-    @JoinColumn(name = "personuuid", nullable = false)
-    private HsOfficePersonEntity person;
-
-    // TODO: remove, is replaced by partnerRel
-    @ManyToOne
-    @JoinColumn(name = "contactuuid", nullable = false)
-    private HsOfficeContactEntity contact;
-
-    @ManyToOne(cascade = { CascadeType.PERSIST, CascadeType.MERGE, CascadeType.DETACH }, optional = true)
+    @ManyToOne(cascade = { PERSIST, MERGE, REFRESH, DETACH }, optional = true)
     @JoinColumn(name = "detailsuuid")
     @NotFound(action = NotFoundAction.IGNORE)
     private HsOfficePartnerDetailsEntity details;
 
+    public String getTaggedPartnerNumber() {
+        return PARTNER_NUMBER_TAG + partnerNumber;
+    }
+
     @Override
     public String toString() {
         return stringify.apply(this);
@@ -75,22 +88,14 @@ public class HsOfficePartnerEntity implements Stringifyable, HasUuid {
 
     @Override
     public String toShortString() {
-        return Optional.ofNullable(person).map(HsOfficePersonEntity::toShortString).orElse("<person=null>");
+        return getTaggedPartnerNumber();
     }
 
     public static RbacView rbac() {
         return rbacViewFor("partner", HsOfficePartnerEntity.class)
-                .withIdentityView(SQL.query("""
-                        SELECT partner.partnerNumber
-                            || ':' || (SELECT idName FROM hs_office_person_iv p WHERE p.uuid = partner.personUuid)
-                            || '-' || (SELECT idName FROM hs_office_contact_iv c WHERE c.uuid = partner.contactUuid)
-                            FROM hs_office_partner AS partner
-                        """))
-                .withUpdatableColumns(
-                        "partnerRelUuid",
-                        "personUuid",
-                        "contactUuid")
-                .createPermission(INSERT).grantedTo("global", ADMIN)
+                .withIdentityView(SQL.projection("'P-' || partnerNumber"))
+                .withUpdatableColumns("partnerRelUuid")
+                .toRole("global", ADMIN).grantPermission(INSERT)
 
                 .importRootEntityAliasProxy("partnerRel", HsOfficeRelationEntity.class,
                         directlyFetchedByDependsOnColumn(),
@@ -108,6 +113,6 @@ public class HsOfficePartnerEntity implements Stringifyable, HasUuid {
     }
 
     public static void main(String[] args) throws IOException {
-        rbac().generateWithBaseFileName("233-hs-office-partner-rbac-generated");
+        rbac().generateWithBaseFileName("233-hs-office-partner-rbac");
     }
 }

src/main/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerEntityPatcher.java

@@ -1,13 +1,11 @@
 package net.hostsharing.hsadminng.hs.office.partner;
 
-import net.hostsharing.hsadminng.hs.office.contact.HsOfficeContactEntity;
 import net.hostsharing.hsadminng.hs.office.generated.api.v1.model.HsOfficePartnerPatchResource;
-import net.hostsharing.hsadminng.hs.office.person.HsOfficePersonEntity;
+import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationEntity;
 import net.hostsharing.hsadminng.mapper.EntityPatcher;
 import net.hostsharing.hsadminng.mapper.OptionalFromJson;
 
 import jakarta.persistence.EntityManager;
-import java.util.UUID;
 
 class HsOfficePartnerEntityPatcher implements EntityPatcher<HsOfficePartnerPatchResource> {
     private final EntityManager em;
@@ -21,19 +19,15 @@ class HsOfficePartnerEntityPatcher implements EntityPatcher<HsOfficePartnerPatch
 
     @Override
     public void apply(final HsOfficePartnerPatchResource resource) {
-        OptionalFromJson.of(resource.getContactUuid()).ifPresent(newValue -> {
-            verifyNotNull(newValue, "contact");
-            entity.setContact(em.getReference(HsOfficeContactEntity.class, newValue));
-        });
-        OptionalFromJson.of(resource.getPersonUuid()).ifPresent(newValue -> {
-            verifyNotNull(newValue, "person");
-            entity.setPerson(em.getReference(HsOfficePersonEntity.class, newValue));
+        OptionalFromJson.of(resource.getPartnerRelUuid()).ifPresent(newValue -> {
+            verifyNotNull(newValue, "partnerRel");
+            entity.setPartnerRel(em.getReference(HsOfficeRelationEntity.class, newValue));
         });
 
         new HsOfficePartnerDetailsEntityPatcher(em, entity.getDetails()).apply(resource.getDetails());
     }
 
-    private void verifyNotNull(final UUID newValue, final String propertyName) {
+    private void verifyNotNull(final Object newValue, final String propertyName) {
         if (newValue == null) {
             throw new IllegalArgumentException("property '" + propertyName + "' must not be null");
         }

src/main/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerRepository.java

@@ -11,10 +11,13 @@ public interface HsOfficePartnerRepository extends Repository<HsOfficePartnerEnt
 
     Optional<HsOfficePartnerEntity> findByUuid(UUID id);
 
+    List<HsOfficePartnerEntity> findAll(); // TODO: move to a repo in test sources
+
     @Query("""
             SELECT partner FROM HsOfficePartnerEntity partner
-                JOIN HsOfficeContactEntity contact ON contact.uuid = partner.contact.uuid
-                JOIN HsOfficePersonEntity person ON person.uuid = partner.person.uuid
+                JOIN HsOfficeRelationEntity rel ON rel.uuid = partner.partnerRel.uuid
+                JOIN HsOfficeContactEntity contact ON contact.uuid = rel.contact.uuid
+                JOIN HsOfficePersonEntity person ON person.uuid = rel.holder.uuid
                 WHERE :name is null
                     OR partner.details.birthName like concat(cast(:name as text), '%')
                     OR contact.label like concat(cast(:name as text), '%')

src/main/java/net/hostsharing/hsadminng/hs/office/person/HsOfficePersonEntity.java

@@ -69,6 +69,8 @@ public class HsOfficePersonEntity implements HasUuid, Stringifyable {
         return rbacViewFor("person", HsOfficePersonEntity.class)
                 .withIdentityView(SQL.projection("concat(tradeName, familyName, givenName)"))
                 .withUpdatableColumns("personType", "tradeName", "givenName", "familyName")
+                .toRole("global", GUEST).grantPermission(INSERT)
+
                 .createRole(OWNER, (with) -> {
                     with.permission(DELETE);
                     with.owningUser(CREATOR);
@@ -84,6 +86,6 @@ public class HsOfficePersonEntity implements HasUuid, Stringifyable {
 
 
     public static void main(String[] args) throws IOException {
-        rbac().generateWithBaseFileName("213-hs-office-person-rbac-generated");
+        rbac().generateWithBaseFileName("213-hs-office-person-rbac");
     }
 }

src/main/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationEntity.java

@@ -16,7 +16,7 @@ import java.util.UUID;
 
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Column.dependsOnColumn;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.GLOBAL;
-import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Nullable.NULLABLE;
+import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Nullable.NOT_NULL;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Permission.*;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.RbacUserReference.UserRole.CREATOR;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Role.*;
@@ -92,22 +92,26 @@ public class HsOfficeRelationEntity implements HasUuid, Stringifyable {
                 .importEntityAlias("anchorPerson", HsOfficePersonEntity.class,
                         dependsOnColumn("anchorUuid"),
                         directlyFetchedByDependsOnColumn(),
-                        NULLABLE)
+                        NOT_NULL)
                 .importEntityAlias("holderPerson", HsOfficePersonEntity.class,
                         dependsOnColumn("holderUuid"),
                         directlyFetchedByDependsOnColumn(),
-                        NULLABLE)
+                        NOT_NULL)
                 .importEntityAlias("contact", HsOfficeContactEntity.class,
                         dependsOnColumn("contactUuid"),
                         directlyFetchedByDependsOnColumn(),
-                        NULLABLE)
+                        NOT_NULL)
                 .createRole(OWNER, (with) -> {
                     with.owningUser(CREATOR);
                     with.incomingSuperRole(GLOBAL, ADMIN);
+                    // TODO: if type=REPRESENTATIIVE
+                    // with.incomingSuperRole("holderPerson", ADMIN);
                     with.permission(DELETE);
                 })
                 .createSubRole(ADMIN, (with) -> {
                     with.incomingSuperRole("anchorPerson", ADMIN);
+                    // TODO: if type=REPRESENTATIIVE
+                    // with.outgoingSuperRole("anchorPerson", OWNER);
                     with.permission(UPDATE);
                 })
                 .createSubRole(AGENT, (with) -> {
@@ -120,10 +124,12 @@ public class HsOfficeRelationEntity implements HasUuid, Stringifyable {
                     with.outgoingSubRole("holderPerson", REFERRER);
                     with.outgoingSubRole("contact", REFERRER);
                     with.permission(SELECT);
-                });
+                })
+
+                .toRole("anchorPerson", ADMIN).grantPermission(INSERT);
     }
 
     public static void main(String[] args) throws IOException {
-        rbac().generateWithBaseFileName("223-hs-office-relation-rbac-generated");
+        rbac().generateWithBaseFileName("223-hs-office-relation-rbac");
     }
 }

src/main/java/net/hostsharing/hsadminng/hs/office/sepamandate/HsOfficeSepaMandateController.java

@@ -132,6 +132,7 @@ public class HsOfficeSepaMandateController implements HsOfficeSepaMandatesApi {
         if (entity.getValidity().hasUpperBound()) {
             resource.setValidTo(entity.getValidity().upper().minusDays(1));
         }
+        resource.getDebitor().setDebitorNumber(entity.getDebitor().getDebitorNumber());
     };
 
     final BiConsumer<HsOfficeSepaMandateInsertResource, HsOfficeSepaMandateEntity> SEPA_MANDATE_RESOURCE_TO_ENTITY_POSTMAPPER = (resource, entity) -> {

src/main/java/net/hostsharing/hsadminng/hs/office/sepamandate/HsOfficeSepaMandateEntity.java

@@ -21,6 +21,7 @@ import java.util.UUID;
 import static net.hostsharing.hsadminng.mapper.PostgresDateRange.*;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Column.dependsOnColumn;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.GLOBAL;
+import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Nullable.NOT_NULL;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Permission.*;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.RbacUserReference.UserRole.CREATOR;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Role.*;
@@ -43,7 +44,6 @@ public class HsOfficeSepaMandateEntity implements Stringifyable, HasUuid {
             .withProp(HsOfficeSepaMandateEntity::getReference)
             .withProp(HsOfficeSepaMandateEntity::getAgreement)
             .withProp(e -> e.getValidity().asString())
-            .withSeparator(", ")
             .quotedValues(false);
 
     @Id