@gadmin2n/schematics 0.0.144 → 0.0.145

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/humanApproval/outbox-retry.util.ts

@@ -1,4 +1,5 @@
 export const OUTBOX_RETRY_CAP_MS = 15 * 60 * 1000;
+export const OUTBOX_MAX_RETRY_COUNT = 10;
 
 export function outboxRetryAt(retryCount: number, now = new Date()): Date {
   const delay = Math.min(

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/humanApproval/runtime/human-approval-runtime.controller.spec.ts

@@ -0,0 +1,150 @@
+import { hashNodeInstanceConfig } from '../../workflowNodeInstance/node-instance-config.util';
+import { HumanApprovalRuntimeController } from './human-approval-runtime.controller';
+
+describe('HumanApprovalRuntimeController', () => {
+  const input = {
+    tenantNamespace: 'tenant-a',
+    workflowInstanceId: '10',
+    workflowVersionId: '20',
+    nodeId: 'approval-1',
+    temporalRunId: 'run-1',
+    task: { title: '采购审批', details: [] },
+    input: { purchaseId: 'PO-1' },
+  };
+
+  const createController = (node: Record<string, unknown>) => {
+    const prisma = {
+      workflowInstance: {
+        findUnique: jest.fn().mockResolvedValue({
+          id: BigInt(10),
+          workflowId: BigInt(30),
+          versionId: BigInt(20),
+          temporalRunId: 'run-1',
+          context: {},
+        }),
+        findMany: jest.fn().mockResolvedValue([]),
+      },
+      workflowVersion: {
+        findUnique: jest.fn().mockResolvedValue({
+          workflowId: BigInt(30),
+          dsl: { nodes: [node] },
+        }),
+      },
+      approvalRequest: {
+        findFirst: jest.fn().mockResolvedValue(null),
+      },
+    };
+    const approvals = {
+      startRequest: jest.fn(async (request) => {
+        if (
+          hashNodeInstanceConfig(request.configSnapshot) !== request.configHash
+        ) {
+          throw new Error('snapshot mismatch');
+        }
+        return {
+          id: BigInt(40),
+          status: 'PENDING',
+          expiresAt: new Date('2026-08-13T01:00:00.000Z'),
+        };
+      }),
+    };
+    const controller = new HumanApprovalRuntimeController(
+      prisma as any,
+      approvals as any,
+      { assertTenant: jest.fn() } as any,
+      { resolveExternalCallback: jest.fn() } as any,
+    );
+    return { approvals, controller, prisma };
+  };
+
+  it('hashes the compiled config for a legitimate inline approval node', async () => {
+    const config = {
+      task: {
+        title: {
+          source: 'FIXED',
+          valueType: 'STRING',
+          value: '采购审批',
+        },
+        details: [],
+      },
+      subjects: [{ source: 'STATIC', provider: 'USER', refs: ['reviewer'] }],
+      approvalRule: { mode: 'ANY' },
+      rejectionRule: { mode: 'ANY' },
+      timeout: { durationSeconds: 0, action: 'REJECTED' },
+    };
+    const { approvals, controller } = createController({
+      id: 'approval-1',
+      type: 'approval',
+      runtimeKey: 'human_approval',
+      config,
+    });
+
+    await expect(controller.start(input)).resolves.toMatchObject({
+      requestId: '40',
+      status: 'PENDING',
+      expiresAt: '2026-08-13T01:00:00.000Z',
+    });
+    expect(approvals.startRequest).toHaveBeenCalledWith(
+      expect.objectContaining({
+        configHash: hashNodeInstanceConfig(config),
+        configSnapshot: config,
+        task: input.task,
+      }),
+      { userId: 'runtime:tenant-a' },
+    );
+  });
+
+  it('keeps the compiled source hash so snapshot mismatches are still rejected', async () => {
+    const { approvals, controller } = createController({
+      id: 'approval-1',
+      type: 'approval',
+      runtimeKey: 'human_approval',
+      config: { timeout: { durationSeconds: 0 } },
+      source: { configHash: 'published-config-hash' },
+    });
+
+    await expect(controller.start(input)).rejects.toThrow('snapshot mismatch');
+    expect(approvals.startRequest).toHaveBeenCalledWith(
+      expect.objectContaining({ configHash: 'published-config-hash' }),
+      expect.anything(),
+    );
+  });
+
+  it('reuses a completed approval from the original retry operation', async () => {
+    const config = {
+      task: { title: { source: 'FIXED', value: '采购审批' }, details: [] },
+      subjects: [{ source: 'STATIC', provider: 'USER', refs: ['reviewer'] }],
+      approvalRule: { mode: 'ANY' },
+      rejectionRule: { mode: 'ANY' },
+      timeout: { durationSeconds: 0, action: 'REJECTED' },
+    };
+    const { approvals, controller } = createController({
+      id: 'approval-1',
+      type: 'approval',
+      runtimeKey: 'human_approval',
+      config,
+    });
+    approvals.startRequest.mockResolvedValueOnce({
+      id: BigInt(40),
+      status: 'APPROVED',
+      expiresAt: new Date('2026-08-13T01:00:00.000Z'),
+      reusedResolution: {
+        requestId: '40',
+        result: 'APPROVED',
+        reason: 'RULE_SATISFIED',
+        decidedAt: '2026-08-13T01:00:00.000Z',
+      },
+    } as any);
+
+    await expect(controller.start(input)).resolves.toMatchObject({
+      requestId: '40',
+      status: 'APPROVED',
+      resolution: {
+        result: 'APPROVED',
+        reason: 'RULE_SATISFIED',
+        decidedAt: '2026-08-13T01:00:00.000Z',
+      },
+    });
+    expect(approvals.startRequest).toHaveBeenCalledTimes(1);
+  });
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/humanApproval/runtime/human-approval-runtime.controller.ts

@@ -11,12 +11,12 @@ import {
 import { PrismaService } from 'nestjs-prisma';
 import { AllowUnauthorizedRequest } from '../../../lib/auth.guard';
 import { WorkflowCallbackUrlService } from '../../externalInteraction/workflow-callback-url.service';
+import { hashNodeInstanceConfig } from '../../workflowNodeInstance/node-instance-config.util';
 import { WorkflowRuntimeConfigService } from '../../workflowRuntimeConfig/workflow-runtime-config.service';
-import { SubmitExternalApprovalDecisionDto } from '../human-approval.dto';
 import { HumanApprovalService } from '../human-approval.service';
 import {
+  HumanApprovalRuntimeMetadataDto,
   StartHumanApprovalRuntimeDto,
-  SubmitApprovalResultRuntimeDto,
 } from './human-approval-runtime.dto';
 import { RuntimeTokenGuard } from './runtime-token.guard';
 
@@ -63,7 +63,6 @@ export class HumanApprovalRuntimeController {
       !version ||
       version.workflowId !== instance.workflowId ||
       node?.runtimeKey !== 'human_approval' ||
-      !node?.source?.configHash ||
       !node?.config ||
       typeof node.config !== 'object'
     )
@@ -72,37 +71,43 @@ export class HumanApprovalRuntimeController {
         message: 'Human Approval input does not match the compiled workflow',
         retryable: false,
       });
+    const configHash =
+      node.source?.configHash ?? hashNodeInstanceConfig(node.config);
+    const callbackUrl = input.callbackToken
+      ? this.callbackUrls.resolveExternalCallback()
+      : undefined;
     const request = await this.approvals.startRequest(
       {
         workflowInstanceId: input.workflowInstanceId,
         workflowVersionId: input.workflowVersionId,
-        tenantNamespace: input.tenantNamespace,
-        temporalRunId: input.temporalRunId,
-        approvalWorkflowRunId: input.approvalWorkflowRunId,
-        callbackToken: input.callbackToken,
         nodeId: input.nodeId,
-        configHash: node.source.configHash,
+        configHash,
         configSnapshot: node.config,
         dynamicInputs: input.dynamicInputs,
-        approvalWorkflowInputs: input.approvalWorkflowInputs,
-        resolvedSubjects: input.resolvedSubjects,
+        task: input.task,
+        input: input.input,
+        callbackToken: input.callbackToken,
+        callbackUrl,
+        tenantNamespace: input.tenantNamespace,
+        temporalRunId: input.temporalRunId,
       },
       { userId: `runtime:${input.tenantNamespace}` },
     );
-    const approvalWorkflowInvocation = (request as any)
-      .approvalWorkflowInvocation;
+    const externalApproval = (request as any).externalApproval;
+    const reusedResolution = (request as any).reusedResolution;
     return {
       requestId: String(request.id),
       status: request.status,
       signalName: 'humanApprovalResolved',
-      ...(approvalWorkflowInvocation && {
-        approvalWorkflowInvocation: {
-          ...approvalWorkflowInvocation,
-          workflow: {
-            ...approvalWorkflowInvocation.workflow,
-            callbackUrl: await this.callbackUrls.resolveExternalCallback(),
-          },
-        },
+      expiresAt:
+        request.expiresAt instanceof Date
+          ? request.expiresAt.toISOString()
+          : request.expiresAt ?? null,
+      ...(externalApproval && {
+        externalApproval,
+      }),
+      ...(reusedResolution && {
+        resolution: { ...reusedResolution, nodeId: input.nodeId },
       }),
     };
   }
@@ -119,29 +124,40 @@ export class HumanApprovalRuntimeController {
     return this.approvals.expireRequest(parseId(requestId));
   }
 
-  @Post('external-decisions')
-  @AllowUnauthorizedRequest()
-  async submitApprovalResult(@Body() input: SubmitApprovalResultRuntimeDto) {
-    await this.runtimeConfig.assertTenant(input.tenantNamespace);
-    const {
-      requestId,
-      tenantNamespace: _tenantNamespace,
-      workflowInstanceId: _workflowInstanceId,
-      workflowVersionId: _workflowVersionId,
-      temporalRunId: _temporalRunId,
-      nodeId: _nodeId,
-      ...decision
-    } = input;
-    return this.approvals.submitExternalDecision(parseId(requestId), decision);
-  }
-
-  @Post(':requestId/external-decisions')
+  @Post(':requestId/cancel')
   @AllowUnauthorizedRequest()
-  submitExternalDecision(
+  async cancel(
     @Param('requestId') requestId: string,
-    @Body() input: SubmitExternalApprovalDecisionDto,
+    @Body() input: HumanApprovalRuntimeMetadataDto,
   ) {
-    return this.approvals.submitExternalDecision(parseId(requestId), input);
+    await this.runtimeConfig.assertTenant(input.tenantNamespace);
+    const request = await this.prisma.approvalRequest.findUnique({
+      where: { id: parseId(requestId) },
+      select: {
+        workflowInstanceId: true,
+        workflowVersionId: true,
+        nodeId: true,
+      },
+    });
+    const instance = request
+      ? await this.prisma.workflowInstance.findUnique({
+          where: { id: request.workflowInstanceId },
+          select: { temporalRunId: true },
+        })
+      : null;
+    if (
+      !request ||
+      request.workflowInstanceId !== parseId(input.workflowInstanceId) ||
+      request.workflowVersionId !== parseId(input.workflowVersionId) ||
+      request.nodeId !== input.nodeId ||
+      instance?.temporalRunId !== input.temporalRunId
+    )
+      throw new NotFoundException({
+        code: 'WORKFLOW_RUNTIME_INSTANCE_NOT_FOUND',
+        message: 'Workflow runtime instance metadata does not match',
+        retryable: false,
+      });
+    return this.approvals.cancelRequest(parseId(requestId), false);
   }
 }
 

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/humanApproval/runtime/human-approval-runtime.dto.ts

@@ -1,18 +1,16 @@
 import { Type } from 'class-transformer';
 import {
-  IsArray,
+  Allow,
+  IsDefined,
   IsNotEmpty,
   IsObject,
   IsOptional,
   IsString,
   ValidateNested,
 } from 'class-validator';
-import {
-  ResolvedApprovalSubjectDto,
-  SubmitExternalApprovalDecisionDto,
-} from '../human-approval.dto';
+import { ApprovalTaskDto } from '../human-approval.dto';
 
-export class StartHumanApprovalRuntimeDto {
+export class HumanApprovalRuntimeMetadataDto {
   @IsString()
   @IsNotEmpty()
   tenantNamespace: string;
@@ -29,68 +27,26 @@ export class StartHumanApprovalRuntimeDto {
   @IsNotEmpty()
   nodeId: string;
 
-  // Kept temporarily so older workers can still send these fields. The server
-  // always reads the authoritative config from WorkflowVersion.dsl.
-  @IsOptional()
-  @IsString()
-  instanceVersionId?: string;
-
-  @IsOptional()
-  @IsString()
-  configHash?: string;
-
-  @IsOptional()
-  configSnapshot?: unknown;
-
-  @IsOptional()
-  @IsObject()
-  dynamicInputs?: Record<string, unknown>;
-
-  @IsOptional()
-  @IsObject()
-  approvalWorkflowInputs?: Record<string, unknown>;
-
-  @IsOptional()
-  @IsArray()
-  @ValidateNested({ each: true })
-  @Type(() => ResolvedApprovalSubjectDto)
-  resolvedSubjects?: ResolvedApprovalSubjectDto[];
-
   @IsString()
   @IsNotEmpty()
   temporalRunId: string;
-
-  @IsString()
-  @IsNotEmpty()
-  approvalWorkflowRunId: string;
-
-  @IsString()
-  @IsNotEmpty()
-  callbackToken: string;
 }
 
-export class SubmitApprovalResultRuntimeDto extends SubmitExternalApprovalDecisionDto {
-  @IsString()
-  @IsNotEmpty()
-  requestId: string;
-
-  @IsString()
-  @IsNotEmpty()
-  tenantNamespace: string;
-
-  @IsString()
-  @IsNotEmpty()
-  workflowInstanceId: string;
+export class StartHumanApprovalRuntimeDto extends HumanApprovalRuntimeMetadataDto {
+  @IsOptional()
+  @IsObject()
+  dynamicInputs?: Record<string, unknown>;
 
-  @IsString()
-  @IsNotEmpty()
-  workflowVersionId: string;
+  @ValidateNested()
+  @Type(() => ApprovalTaskDto)
+  task: ApprovalTaskDto;
 
-  @IsString()
-  @IsNotEmpty()
-  temporalRunId: string;
+  @Allow()
+  @IsDefined()
+  input: unknown;
 
+  @IsOptional()
   @IsString()
   @IsNotEmpty()
-  nodeId: string;
+  callbackToken?: string;
 }

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/integrationConnection/integration-connection.controller.ts

@@ -3,6 +3,7 @@ import {
   Body,
   Controller,
   Get,
+  Header,
   Param,
   Patch,
   Post,
@@ -38,6 +39,18 @@ export class IntegrationConnectionController {
     return this.service.list(query?.trim() ?? '');
   }
 
+  @Get(':code/secrets')
+  @Header('Cache-Control', 'no-store')
+  @Header('Pragma', 'no-cache')
+  @UseRoles({
+    resource: 'integrationConnection',
+    action: 'update',
+    possession: 'any',
+  })
+  getSecrets(@Param('code') code: string) {
+    return this.service.getSecrets(code);
+  }
+
   @Get(':code')
   @UseRoles({
     resource: 'integrationConnection',

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/integrationConnection/integration-connection.service.spec.ts

@@ -0,0 +1,44 @@
+import { IntegrationConnectionService } from './integration-connection.service';
+import { IntegrationSecretCipher } from './integration-secret-cipher';
+
+describe('IntegrationConnectionService', () => {
+  it('keeps secrets out of normal responses and reveals them only on demand', async () => {
+    const key = Buffer.alloc(32, 9).toString('base64');
+    const secrets = { token: 'saved-bearer-token' };
+    const entity = {
+      id: BigInt(1),
+      code: 'ticket-api',
+      name: '工单系统',
+      description: null,
+      type: 'HTTP',
+      baseUrl: 'https://tickets.example.com/api',
+      authType: 'BEARER',
+      publicConfig: {},
+      encryptedSecrets: new IntegrationSecretCipher(key).encrypt(secrets),
+      isEnabled: true,
+      revision: 1,
+      creator: 'admin',
+      createdAt: new Date('2026-08-13T00:00:00.000Z'),
+      updatedAt: new Date('2026-08-13T00:00:00.000Z'),
+    };
+    const prisma = {
+      integrationConnection: {
+        findUnique: jest.fn().mockResolvedValue(entity),
+      },
+    };
+    const service = new IntegrationConnectionService(
+      prisma as any,
+      {
+        get: jest.fn().mockReturnValue(key),
+      } as any,
+    );
+
+    await expect(service.get(entity.code)).resolves.toEqual(
+      expect.not.objectContaining({
+        encryptedSecrets: expect.anything(),
+        token: expect.anything(),
+      }),
+    );
+    await expect(service.getSecrets(entity.code)).resolves.toEqual(secrets);
+  });
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/integrationConnection/integration-connection.service.ts

@@ -46,6 +46,12 @@ export class IntegrationConnectionService {
     return this.toPublic(entity);
   }
 
+  async getSecrets(code: string): Promise<Record<string, unknown>> {
+    const entity = await this.findOrThrow(code);
+    if (!entity.encryptedSecrets) return {};
+    return this.getCipher().decrypt(entity.encryptedSecrets);
+  }
+
   async create(input: CreateIntegrationConnectionDto, actor: ActorContext) {
     const authType = input.authType as IntegrationAuthType;
     const baseUrl = normalizeBaseUrl(input.baseUrl);