function hasPermission(permissions: Permission[], module: number, level: number): boolean
function canRead(permissions: Permission[], module: number): boolean       // hasPermission(..., PERMISSIONS.READ)
function canWrite(permissions: Permission[], module: number): boolean      // any of EDIT | CREATE | REMOVE
function getLevel(permissions: Permission[], module: number): number       // combined level for module, or 0
function ownerPermissions(): Permission[]                                   // ALL access across every PERMISSION_MODULES id
function readOnlyPermissions(modules: number[]): Permission[]               // READ-only for the given module ids

hasPermission checks that the module's level is nonzero and that all bits of level are set ((current & level) === level) — so hasPermission(perms, MEMBERS, PERMISSIONS.EDIT | PERMISSIONS.CREATE) requires both bits, not either. canRead/canWriteare the two convenience checks used by the app's sidebar navigation to gate each button, and by every company page to decide what a signed-in staff member can see and do.

interface MeInfo {
  permissions: Permission[];
  member?: Member;
  isStaff: boolean;
}

async function loadPermissions(company: Company, user: User): Promise<MeInfo>

Resolves the signed-in User's effective permissions at company:

1. company.GetUser(user) → the Member row. If none exists, returns { permissions: [], member: undefined, isStaff: false } (with a console.warn).
2. Queries Staff filtered by memberID (limit 1). A Member with no Staff row is not staff and gets no permissions — Role/permissions are strictly a Staff concern, never stored on Member directly.
3. If a Staff row exists, loads every StaffRole grant it holds via staff.roles(), then force-fetches each distinct Role (full data, per the lazy-omission gotcha above) and returns { permissions, member, isStaff: true } where permissions is the bitwise-OR union, per module, of every held role's levels. A Staff row with zero role grants still counts as isStaff: true, just with no permissions. Location scoping on a StaffRoleisn't consulted here — permissions are company-wide once unioned.

async function resolveCompanyEntryRoute(company: Company, user: User): Promise<string>

Calls loadPermissions and returns where to send the user after they pick company: their own Member detail page (/company/{cID}/members/{memberID}) if they're a non-staff member, otherwise the company dashboard (/company/{cID}/dashboard).

static async QueryByResources(
  company: Company,
  resourceType: ResourceType,
  resourceIDs: string[],
): Promise<Map<string, TagAssignment[]>>

Batches tag-assignment lookups for a page of resources into a single query, instead of one GetListOfTagAssignments-style call per resource. This is how list pages (e.g. Members, Classes) populate the tag column efficiently — call it once with all the resource ids currently on-screen rather than N+1 queries.

• Returns a Map pre-seeded with every id in resourceIDs mapped to [], so every input id is guaranteed to be a key in the result — even ones with zero tags.
• If resourceIDs is empty, returns the (empty) pre-seeded map immediately without making a request.
• Otherwise queries TagAssignment with resourceType = <resourceType> AND resourceID in <resourceIDs>, limit: resourceIDs.length * 25 — it assumes up to 25 tags per resource is enough headroom; a resource with more tags than that on one page could be silently truncated.
• Groups the results by each assignment's LazyData.resourceID, skipping any assignment whose resourceID isn't in the pre-seeded map.

const tagsByMember = await TagAssignment.QueryByResources(company, "user", memberIDs);
const tagsForThisMember = tagsByMember.get(member.id) ?? [];