@critical-path/core 0.27.0 → 0.29.0

package/dist/engine/index.js

@@ -5,7 +5,7 @@ import { validateTransition, getAllowedNextStatuses, getAllowedPreviousStatuses,
 import { extractMentions } from '../utils/mentions.js';
 import { DomainEventBus } from '../domain/events.js';
 import { validateAttachmentUrl } from '../domain/entities.js';
-import { validateCustomFieldValues } from '../domain/custom-fields.js';
+import { validateCustomFieldValues, validateCustomFieldDefinitions } from '../domain/custom-fields.js';
 import { detectDependencyCycle, CircularDependencyError } from '../domain/graph.js';
 import { ValidationError, NotFoundError, ForbiddenError } from '../domain/errors.js';
 import { WebhookDispatcher, assertWebhookUrl } from '../webhooks/dispatcher.js';
@@ -45,9 +45,9 @@ export class CriticalPathEngine {
                 this.plugins.register(plugin);
             }
         }
-        if (config.initialData) {
-            this.ready = this.seedInitialData(config.initialData);
-        }
+        this.ready = this.initialize(config);
+        // Callers that never await `ready` should not crash on an unhandled rejection; awaiting it still throws.
+        this.ready.catch(() => { });
     }
     /**
      * Returns a view of this engine that attributes every mutation to `actor`: activity log
@@ -160,6 +160,14 @@ export class CriticalPathEngine {
         const { tenantId: _ignored, ...rest } = updates;
         return rest;
     }
+    async initialize(config) {
+        if (config.initialData) {
+            await this.seedInitialData(config.initialData);
+        }
+        for (const plugin of this.plugins.getPlugins()) {
+            await plugin.init?.(this);
+        }
+    }
     async seedInitialData(data) {
         if (data.workflows) {
             for (const wf of data.workflows) {
@@ -328,6 +336,7 @@ export class CriticalPathEngine {
     }
     async createProject(project) {
         await this.requireWorkspaceAccess('project.create');
+        validateCustomFieldDefinitions(project.customFieldDefinitions, this.plugins.getCustomFieldTypes());
         // Views always use the actor's tenant (possibly none); only trusted base-engine calls may set it.
         const input = { ...project, tenantId: this.actor ? this.actor.tenantId : project.tenantId };
         // The creator administers the project they create.
@@ -360,6 +369,7 @@ export class CriticalPathEngine {
         await this.requireProjectAccess('project.update', id);
         if ('members' in updates)
             await this.requireProjectAccess('project.manage_members', id);
+        validateCustomFieldDefinitions(updates.customFieldDefinitions, this.plugins.getCustomFieldTypes());
         updates = this.withoutTenant(updates);
         const updated = await this.store.updateProject(id, updates);
         if (updated) {
@@ -394,12 +404,19 @@ export class CriticalPathEngine {
         // Deleting the project implies deleting its tasks; skip per-task checks for the cascade.
         const cascade = this.elevated();
         const tasks = await this.store.getTasks(id);
-        const deletedTaskIds = [];
         for (const task of tasks) {
-            if (await cascade.deleteTask(task.id)) {
-                deletedTaskIds.push(task.id);
-            }
-        }
+            // Subtasks may already be gone with their parent; deleteTask then returns false.
+            await cascade.deleteTask(task.id);
+        }
+        const deletedTaskIds = (await Promise.all(tasks.map(async (t) => ((await this.store.getTask(t.id)) ? null : t.id)))).filter((taskId) => taskId !== null);
+        for (const container of await this.store.getContainers(id))
+            await this.store.deleteContainer(container.id);
+        for (const iteration of await this.store.getIterations(id))
+            await this.store.deleteIteration(iteration.id);
+        for (const deliverable of await this.store.getDeliverables(id))
+            await cascade.deleteDeliverable(deliverable.id);
+        for (const attachment of await this.store.getAttachments({ projectId: id }))
+            await cascade.deleteAttachment(attachment.id);
         const deleted = await this.store.deleteProject(id);
         if (deleted) {
             const now = new Date().toISOString();
@@ -440,13 +457,14 @@ export class CriticalPathEngine {
             taskInput = { ...taskInput, reporterId: this.actor.userId };
         }
         const processedInput = await this.plugins.runBeforeTaskCreate(taskInput);
-        const projectId = processedInput.projectId || taskInput.projectId;
+        if (processedInput.projectId && processedInput.projectId !== taskInput.projectId) {
+            throw new ValidationError('Plugins cannot move a task to another project in beforeTaskCreate.');
+        }
+        const projectId = taskInput.projectId;
         const project = await this.store.getProject(projectId);
         const workflow = await this.resolveProjectWorkflow(projectId);
-        // Validate custom field domain invariants
-        if (project?.customFieldDefinitions && (processedInput.customFields || taskInput.customFields)) {
-            validateCustomFieldValues(project.customFieldDefinitions, processedInput.customFields || taskInput.customFields);
-        }
+        // Validate custom fields on the final (post-plugin) input, including required fields when none are given
+        validateCustomFieldValues(project?.customFieldDefinitions, processedInput.customFields ?? taskInput.customFields, this.plugins.getCustomFieldTypes());
         const defaultStatus = workflow?.defaultStatusKey || 'todo';
         const initialStatus = processedInput.status || taskInput.status || defaultStatus;
         const now = new Date().toISOString();
@@ -533,21 +551,20 @@ export class CriticalPathEngine {
         const taskUpdates = updates;
         const project = await this.store.getProject(existing.projectId);
         const workflow = await this.resolveProjectWorkflow(existing.projectId);
+        // Plugins run first; their output is then validated like caller input. Identity and
+        // ownership fields are never changed by hooks.
+        const { id: _id, projectId: _projectId, createdAt: _createdAt, ...processedUpdates } = await this.plugins.runBeforeTaskUpdate(id, taskUpdates);
         // Validate workflow transition invariant
-        if (taskUpdates.status && taskUpdates.status !== existing.status) {
-            const isValid = validateTransition(workflow || undefined, existing.status, taskUpdates.status);
+        if (processedUpdates.status && processedUpdates.status !== existing.status) {
+            const isValid = validateTransition(workflow || undefined, existing.status, processedUpdates.status);
             if (!isValid) {
-                throw new WorkflowValidationError(existing.status, taskUpdates.status, workflow?.id);
+                throw new WorkflowValidationError(existing.status, processedUpdates.status, workflow?.id);
             }
         }
         // Validate custom field invariants
-        if (project?.customFieldDefinitions && taskUpdates.customFields) {
-            validateCustomFieldValues(project.customFieldDefinitions, {
-                ...existing.customFields,
-                ...taskUpdates.customFields
-            });
+        if (processedUpdates.customFields) {
+            validateCustomFieldValues(project?.customFieldDefinitions, { ...existing.customFields, ...processedUpdates.customFields }, this.plugins.getCustomFieldTypes());
         }
-        const processedUpdates = await this.plugins.runBeforeTaskUpdate(id, taskUpdates);
         const now = new Date().toISOString();
         const existingStatusDef = resolveStatusDefinition(existing.status, project?.statusDefinitions || workflow?.statuses);
         const newStatusDef = processedUpdates.status
@@ -864,15 +881,21 @@ export class CriticalPathEngine {
             console.error(`[CriticalPathEngine] Error during auto-unblocking for task ${completedTask.id}:`, err);
         }
     }
-    async deleteTask(id) {
+    /**
+     * Deletes a task and everything that belongs to it: subtasks (or, with `subtasks: 'detach'`,
+     * their parent link), dependencies, comments, attachments (including stored files) and time
+     * entries. The activity log is kept as an audit trail.
+     */
+    async deleteTask(id, options = {}) {
         const existing = await this.getTask(id);
         if (!existing)
             return false;
         await this.requireProjectAccess('task.delete', existing.projectId);
-        await this.plugins.runBeforeTaskDelete(id);
+        await this.plugins.runBeforeTaskDelete(id, existing);
+        await this.deleteTaskChildren(existing, options.subtasks ?? 'delete');
         const deleted = await this.store.deleteTask(id);
         if (deleted) {
-            await this.plugins.runAfterTaskDelete(id);
+            await this.plugins.runAfterTaskDelete(id, existing);
             const now = new Date().toISOString();
             const event = {
                 id: `evt_${Math.random().toString(36).substring(2, 9)}`,
@@ -897,6 +920,61 @@ export class CriticalPathEngine {
         }
         return deleted;
     }
+    /** Removes records owned by a task; the task's deletion was already authorized. */
+    async deleteTaskChildren(task, subtasks) {
+        const cascade = this.elevated();
+        const children = (await this.store.getTasks(task.projectId)).filter((t) => t.parentId === task.id);
+        for (const child of children) {
+            if (subtasks === 'delete') {
+                await cascade.deleteTask(child.id, { subtasks });
+            }
+            else {
+                await this.store.updateTask(child.id, { parentId: undefined });
+            }
+        }
+        for (const dependency of await this.store.getDependencies(task.id)) {
+            await cascade.removeDependency(dependency.id);
+        }
+        const comments = await this.store.getComments(task.id);
+        const attachments = [
+            ...(await this.store.getAttachments({ taskId: task.id })),
+            ...(await Promise.all(comments.map((c) => this.store.getAttachments({ commentId: c.id })))).flat()
+        ];
+        for (const attachmentId of new Set(attachments.map((a) => a.id))) {
+            await cascade.deleteAttachment(attachmentId);
+        }
+        for (const comment of comments) {
+            await cascade.deleteComment(comment.id);
+        }
+        for (const entry of await this.store.getTimeEntries(task.id)) {
+            await this.store.deleteTimeEntry(entry.id);
+        }
+    }
+    /** Removes a dependency between two tasks. Requires `task.update` on the dependent task's project. */
+    async removeDependency(id) {
+        const dependency = await this.store.getDependency(id);
+        if (!dependency)
+            return false;
+        if (this.enforcing) {
+            const task = await this.getTask(dependency.taskId);
+            if (!task)
+                return false;
+            await this.requireProjectAccess('task.update', task.projectId);
+        }
+        const removed = await this.store.removeDependency(id);
+        if (removed) {
+            const event = {
+                id: `evt_${Math.random().toString(36).substring(2, 9)}`,
+                name: 'dependency.removed',
+                aggregateId: id,
+                aggregateType: 'Dependency',
+                occurredAt: new Date().toISOString(),
+                payload: { dependency }
+            };
+            await this.events.publish(event);
+        }
+        return removed;
+    }
     // --- Task Dependencies & Graph ---
     async addDependency(dep) {
         if (this.enforcing) {
@@ -1419,13 +1497,25 @@ export class CriticalPathEngine {
         await this.requireProjectAccess('plan.manage', existing.projectId);
         return this.store.updateContainer(id, updates);
     }
+    /** Deletes a container. Its tasks and nested containers are kept but no longer reference it. */
     async deleteContainer(id) {
         const existing = await this.getContainer(id);
         if (!existing)
             return false;
         await this.requireProjectAccess('plan.manage', existing.projectId);
+        await this.clearTaskReferences(existing.projectId, 'containerId', id);
+        for (const child of (await this.store.getContainers(existing.projectId)).filter((c) => c.parentId === id)) {
+            await this.store.updateContainer(child.id, { parentId: undefined });
+        }
         return this.store.deleteContainer(id);
     }
+    /** Unsets a reference (e.g. `iterationId`) on every task in the project that points at `id`. */
+    async clearTaskReferences(projectId, field, id) {
+        for (const task of await this.store.getTasks(projectId)) {
+            if (task[field] === id)
+                await this.store.updateTask(task.id, { [field]: undefined });
+        }
+    }
     // --- Deliverables ---
     async getDeliverables(projectId) {
         if (!(await this.canReadProject(projectId)))
@@ -1442,7 +1532,7 @@ export class CriticalPathEngine {
         await this.requireProjectAccess('plan.manage', input.projectId);
         const project = await this.store.getProject(input.projectId);
         if (project?.customFieldDefinitions && input.customFields) {
-            validateCustomFieldValues(project.customFieldDefinitions, input.customFields);
+            validateCustomFieldValues(project.customFieldDefinitions, input.customFields, this.plugins.getCustomFieldTypes());
         }
         const created = await this.store.createDeliverable({
             ...input,
@@ -1517,6 +1607,7 @@ export class CriticalPathEngine {
         if (!existing)
             return false;
         await this.requireProjectAccess('plan.manage', existing.projectId);
+        await this.clearTaskReferences(existing.projectId, 'deliverableId', id);
         const deleted = await this.store.deleteDeliverable(id);
         if (deleted) {
             const now = new Date().toISOString();
@@ -1644,11 +1735,13 @@ export class CriticalPathEngine {
         }
         return updated;
     }
+    /** Deletes an iteration. Its tasks are kept and moved back to the backlog (no iteration). */
     async deleteIteration(id) {
         const existing = await this.getIteration(id);
         if (!existing)
             return false;
         await this.requireProjectAccess('plan.manage', existing.projectId);
+        await this.clearTaskReferences(existing.projectId, 'iterationId', id);
         return this.store.deleteIteration(id);
     }
     // --- Ladder of Abstraction & Critical Path Method ---