@isi-ui7/bos7-shared 0.2.4 → 0.2.7

package/src/style-contract.ts

@@ -2,6 +2,17 @@ export type Ui7FormDensity = "compact" | "comfortable";
 
 export type Ui7ThemeDensity = Ui7FormDensity | "normal";
 
+/**
+ * Desktop form-panel width. Mobile + tablet (<1056px) always release the
+ * cap and stretch to 100% — the modifier only matters at ≥1056px.
+ *
+ *  - "half"        → 50% of page body
+ *  - "two-thirds"  → 66.6667% (default — readable column width on wide
+ *                    monitors, what the contract shipped with originally)
+ *  - "full"        → 100% (forms with many columns or wide tables inside)
+ */
+export type Ui7FormWidth = "half" | "two-thirds" | "full";
+
 export interface Ui7FormVisualTokens {
   labelSpacing: "6px";
   labelFontSize: "12px";
@@ -58,6 +69,9 @@ export const UI7_FORM_VISUAL_CLASSNAMES = {
   scope: "ui7-form-contract",
   densityCompact: "ui7-form-contract--density-compact",
   densityComfortable: "ui7-form-contract--density-comfortable",
+  widthHalf: "ui7-form-contract--width-half",
+  widthTwoThirds: "ui7-form-contract--width-two-thirds",
+  widthFull: "ui7-form-contract--width-full",
   readonly: "ui7-form-contract--readonly",
   row: "ui7-form-row",
   section: "ui7-form-section",
@@ -76,15 +90,15 @@ export const UI7_FORM_VISUAL_CLASSNAMES = {
 export const UI7_FORM_DENSITY_TOKENS = {
   compact: {
     controlHeight: "2rem",
-    rowGap: "0.75rem",
-    sectionGap: "1rem",
-    columnGap: "0.75rem",
+    rowGap: "1rem",
+    sectionGap: "1.25rem",
+    columnGap: "1rem",
   },
   comfortable: {
     controlHeight: "2.5rem",
-    rowGap: "1rem",
+    rowGap: "1.25rem",
     sectionGap: "1.5rem",
-    columnGap: "1rem",
+    columnGap: "1.25rem",
   },
 } as const;
 
@@ -107,9 +121,24 @@ export function getUi7FormDensityClassName(
     : UI7_FORM_VISUAL_CLASSNAMES.densityComfortable;
 }
 
+export function getUi7FormWidthClassName(width?: Ui7FormWidth | null): string {
+  switch (width) {
+    case "half":
+      return UI7_FORM_VISUAL_CLASSNAMES.widthHalf;
+    case "full":
+      return UI7_FORM_VISUAL_CLASSNAMES.widthFull;
+    case "two-thirds":
+    default:
+      // Default is two-thirds — kept explicit (not relying on base CSS) so
+      // a future base-width change won't silently shift every form.
+      return UI7_FORM_VISUAL_CLASSNAMES.widthTwoThirds;
+  }
+}
+
 export function getUi7FormContractClassName(
   options?: {
     density?: Ui7ThemeDensity | null;
+    width?: Ui7FormWidth | null;
     readonly?: boolean;
     className?: string | null;
   }
@@ -120,6 +149,10 @@ export function getUi7FormContractClassName(
     classes.push(getUi7FormDensityClassName(options.density));
   }
 
+  // Width: always emit a modifier so the choice is explicit at the DOM
+  // level. Default = two-thirds (matches what the contract shipped with).
+  classes.push(getUi7FormWidthClassName(options?.width));
+
   if (options?.readonly) {
     classes.push(UI7_FORM_VISUAL_CLASSNAMES.readonly);
   }

package/src/workflow/starter.ts

@@ -18,15 +18,22 @@ type CookieReqLike = Request & {
   cookies?: { get?: (name: string) => { value?: string } | undefined };
 };
 
-function decodeJWTSub(token: string): string {
+type Auth7Claims = {
+  sub?: string;
+  preferred_username?: string;
+  org_id?: string;
+  branch_id?: string;
+  branch_code?: string;
+};
+
+function decodeJwtClaims(token: string): Auth7Claims {
   try {
     const parts = token.split('.');
-    if (parts.length < 2) return '';
+    if (parts.length < 2) return {};
     const payload = parts[1].replace(/-/g, '+').replace(/_/g, '/');
-    const claims = JSON.parse(Buffer.from(payload, 'base64').toString('utf-8')) as { sub?: string };
-    return claims.sub ?? '';
+    return JSON.parse(Buffer.from(payload, 'base64').toString('utf-8')) as Auth7Claims;
   } catch {
-    return '';
+    return {};
   }
 }
 
@@ -51,7 +58,23 @@ export type StartWorkflowInput = {
   flowId: string;
   payload: Record<string, unknown>;
   externalRef?: string;
-  initiatorContext?: { user_id?: string; branch_id?: string };
+  /**
+   * Optional override for initiator identity. By default the helper decodes
+   * the full tenant identity (user_id, username, org_id, branch_id, branch_code)
+   * from the access token and uses that. Any field explicitly set here wins.
+   *
+   * Set ONLY when the caller has a verified reason to override (rare). For
+   * normal flow-start paths leave this undefined — letting the helper read
+   * the JWT keeps initiator_context aligned with the auth7 signature.
+   */
+  initiatorContext?: {
+    user_id?: string;
+    username?: string;
+    org_id?: string;
+    branch_id?: string;
+    branch_code?: string;
+    ip?: string;
+  };
   /** User access token dari auth7 — diforward ke workflow7 sebagai Bearer. */
   userAccessToken: string;
 };
@@ -64,11 +87,25 @@ export type StartWorkflowResult = {
 };
 
 export async function startWorkflow(input: StartWorkflowInput): Promise<StartWorkflowResult> {
-  const userID = decodeJWTSub(input.userAccessToken);
-  const initiatorContext: Record<string, unknown> = { ...(input.initiatorContext ?? {}) };
-  if (!initiatorContext.user_id && userID) {
-    initiatorContext.user_id = userID;
-  }
+  // Decode the full tenant identity from the user JWT so workflow7 can pass
+  // through all five canonical actor fields to downstream service-task HTTP
+  // calls (lib7 ActorEnvelope / Wave 17 audit envelope). Decoding here keeps
+  // identity aligned with the auth7 signature — service-task verifiers can
+  // trust the envelope without re-checking subject claims.
+  const claims = decodeJwtClaims(input.userAccessToken);
+  const override = input.initiatorContext ?? {};
+  const initiatorContext: Record<string, unknown> = {};
+  type InitiatorKey = 'user_id' | 'username' | 'org_id' | 'branch_id' | 'branch_code';
+  const setIf = (k: InitiatorKey, fromClaim: string | undefined, fromOverride: unknown) => {
+    const v = fromOverride ?? fromClaim;
+    if (typeof v === 'string' && v !== '') initiatorContext[k] = v;
+  };
+  setIf('user_id', claims.sub, override.user_id);
+  setIf('username', claims.preferred_username, override.username);
+  setIf('org_id', claims.org_id, override.org_id);
+  setIf('branch_id', claims.branch_id, override.branch_id);
+  setIf('branch_code', claims.branch_code, override.branch_code);
+  if (typeof override.ip === 'string' && override.ip !== '') initiatorContext.ip = override.ip;
 
   const body: Record<string, unknown> = {
     flow_definition_code: input.flowId,