@isi-ui7/bos7-shared 0.3.0 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isi-ui7/bos7-shared",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Shared auth7 and layout primitives for bos7 applications.",
   "license": "MIT",
   "repository": {
@@ -9,11 +9,11 @@
     "directory": "packages/bos7-shared"
   },
   "type": "module",
-  "main": "dist/index.js",
-  "module": "dist/index.js",
-  "types": "dist/index.d.ts",
+  "main": "src/index.ts",
+  "module": "src/index.ts",
+  "types": "src/index.ts",
   "exports": {
-    ".": "./dist/index.js",
+    ".": "./src/index.ts",
     "./auth7": "./src/auth7/index.ts",
     "./page-layout": "./src/page-layout.tsx",
     "./modal-layout": "./src/modal-layout.tsx",
@@ -50,23 +50,79 @@
     "./bff/health": "./src/bff/health.ts",
     "./observability/otel-init": "./src/observability/otel-init.ts",
     "./form-types": "./src/form-types.ts",
+    "./form-value-schema": "./src/form-value-schema.ts",
     "./form-numeric": "./src/form-numeric.ts",
     "./form-renderer": "./src/form-renderer.tsx",
     "./form-renderer-utils": "./src/form-renderer-utils.ts",
     "./form-rules": "./src/form-rules.ts",
     "./i18n": "./src/i18n.tsx",
     "./workflow/use-crud-form": "./src/workflow/use-crud-form.ts",
-    "./styles": "./src/form-contract.css",
-    "./form-value-schema": "./src/form-value-schema.ts"
+    "./styles": "./src/form-contract.css"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
-    "access": "public"
+    "access": "public",
+    "main": "dist/index.js",
+    "module": "dist/index.js",
+    "types": "dist/index.d.ts",
+    "exports": {
+      ".": "./dist/index.js",
+      "./auth7": "./src/auth7/index.ts",
+      "./page-layout": "./src/page-layout.tsx",
+      "./modal-layout": "./src/modal-layout.tsx",
+      "./form-layout": "./src/form-layout.tsx",
+      "./backend": "./src/backend.ts",
+      "./export": "./src/export.ts",
+      "./types/notification": "./src/types/notification.ts",
+      "./nats/client": "./src/nats/client.ts",
+      "./event-bus": "./src/event-bus/index.ts",
+      "./event-bus/useEventBus": "./src/event-bus/useEventBus.ts",
+      "./api": "./src/api.ts",
+      "./types/core": "./src/types/core.ts",
+      "./style-contract": "./src/style-contract.ts",
+      "./crud-components": "./src/crud-components.tsx",
+      "./workflow/backend": "./src/workflow/backend.ts",
+      "./workflow/notif7": "./src/workflow/notif7.ts",
+      "./workflow/api-client": "./src/workflow/api-client.ts",
+      "./workflow/starter": "./src/workflow/starter.ts",
+      "./workflow/use-workflow-tracker": "./src/workflow/use-workflow-tracker.ts",
+      "./workflow/crud-client": "./src/workflow/crud-client.ts",
+      "./data-table/cursor-adapter": "./src/data-table/cursor-adapter.ts",
+      "./data-table/proxy": "./src/data-table/proxy.ts",
+      "./notification/routing": "./src/notification/routing.ts",
+      "./shell/interaction": "./src/shell/interaction.ts",
+      "./shell/branch": "./src/shell/branch.ts",
+      "./notif7": "./src/notif7.ts",
+      "./shell/provider": "./src/shell/provider.tsx",
+      "./shell/app-shell-layout": "./src/shell/app-shell-layout.tsx",
+      "./notifications-bff": "./src/notifications-bff.ts",
+      "./bff/auth-me": "./src/bff/auth-me.ts",
+      "./bff/auth-refresh": "./src/bff/auth-refresh.ts",
+      "./bff/auth-logout": "./src/bff/auth-logout.ts",
+      "./bff/auth-preferences": "./src/bff/auth-preferences.ts",
+      "./bff/health": "./src/bff/health.ts",
+      "./observability/otel-init": "./src/observability/otel-init.ts",
+      "./form-types": "./src/form-types.ts",
+      "./form-numeric": "./src/form-numeric.ts",
+      "./form-renderer": "./src/form-renderer.tsx",
+      "./form-renderer-utils": "./src/form-renderer-utils.ts",
+      "./form-rules": "./src/form-rules.ts",
+      "./i18n": "./src/i18n.tsx",
+      "./workflow/use-crud-form": "./src/workflow/use-crud-form.ts",
+      "./styles": "./src/form-contract.css",
+      "./form-value-schema": "./src/form-value-schema.ts"
+    }
   },
   "files": [
     "dist",
     "src"
   ],
+  "scripts": {
+    "build": "vite build",
+    "lint": "eslint \"src/**/*.{ts,tsx}\"",
+    "test": "vitest run --passWithNoTests",
+    "typecheck": "tsc --noEmit"
+  },
   "peerDependencies": {
     "@carbon/icons-react": "^11.71.0",
     "@carbon/react": "^1.97.0",
@@ -87,6 +143,14 @@
     "@carbon/react": "^1.97.0",
     "@eslint/eslintrc": "^3.3.1",
     "@eslint/js": "^9.39.0",
+    "@isi-ui7/corporate-themes": "workspace:*",
+    "@isi-ui7/data-table": "workspace:*",
+    "@isi-ui7/editable-table": "workspace:*",
+    "@isi-ui7/i18n": "workspace:*",
+    "@isi-ui7/lookup-input": "workspace:*",
+    "@isi-ui7/modal-manager": "workspace:*",
+    "@isi-ui7/realtime": "workspace:*",
+    "@isi-ui7/ui-shell": "workspace:*",
     "@testing-library/dom": "^10.0.0",
     "@testing-library/react": "^16.0.0",
     "@testing-library/user-event": "^14.5.0",
@@ -105,19 +169,14 @@
     "typescript": "^5.3.3",
     "vite": "^5.0.0",
     "vite-plugin-dts": "^3.6.0",
-    "vitest": "^1.0.0",
-    "@isi-ui7/editable-table": "0.2.3",
-    "@isi-ui7/lookup-input": "0.2.4",
-    "@isi-ui7/i18n": "0.2.3",
-    "@isi-ui7/data-table": "0.2.4",
-    "@isi-ui7/corporate-themes": "0.2.6",
-    "@isi-ui7/realtime": "0.2.3",
-    "@isi-ui7/modal-manager": "0.2.2",
-    "@isi-ui7/ui-shell": "0.2.8"
+    "vitest": "^1.0.0"
   },
   "dependencies": {
     "@carbon/icons-react": "^11.71.0",
     "@carbon/react": "^1.97.0",
+    "@isi-ui7/data-table": "workspace:*",
+    "@isi-ui7/editable-table": "workspace:*",
+    "@isi-ui7/lookup-input": "workspace:*",
     "@opentelemetry/auto-instrumentations-node": "^0.57.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.57.0",
     "@opentelemetry/sdk-node": "^0.57.0",
@@ -125,15 +184,6 @@
     "exceljs": "^4.4.0",
     "jose": "^5.9.6",
     "jspdf": "^4.2.1",
-    "jspdf-autotable": "^5.0.7",
-    "@isi-ui7/data-table": "0.2.4",
-    "@isi-ui7/editable-table": "0.2.3",
-    "@isi-ui7/lookup-input": "0.2.4"
-  },
-  "scripts": {
-    "build": "vite build",
-    "lint": "eslint \"src/**/*.{ts,tsx}\"",
-    "test": "vitest run --passWithNoTests",
-    "typecheck": "tsc --noEmit"
+    "jspdf-autotable": "^5.0.7"
   }
-}
+}

package/src/crud-client-error.test.ts

@@ -0,0 +1,53 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { fetchDetailData } from './workflow/crud-client';
+
+// Bentuk error yang BENAR-BENAR dikirim service Go di estate ini. Menyerahkan
+// objek langsung ke `new Error()` menghasilkan pesan literal "[object Object]",
+// dan penyebab sebenarnya tertelan — operator hanya melihat "[object Object]"
+// sementara yang terjadi 403 "access denied".
+function mockRes(status: number, body: unknown) {
+  global.fetch = vi.fn().mockResolvedValue({
+    ok: status >= 200 && status < 300,
+    status,
+    json: () => Promise.resolve(body),
+  });
+}
+
+afterEach(() => vi.restoreAllMocks());
+
+describe('fetchDetailData — pesan error', () => {
+  it('membuka error berbentuk OBJEK {code, message} — bukan "[object Object]"', async () => {
+    mockRes(403, { error: { code: 'FORBIDDEN', message: 'access denied' } });
+    await expect(fetchDetailData('/x')).rejects.toThrow('access denied (FORBIDDEN)');
+  });
+
+  it('tidak pernah memunculkan "[object Object]" apa pun bentuk error-nya', async () => {
+    for (const body of [
+      { error: { code: 'FORBIDDEN', message: 'access denied' } },
+      { error: { message: 'boom' } },
+      { error: { code: 'ONLY_CODE' } },
+      { error: {} },
+      { message: { code: 'X', message: 'y' } },
+    ]) {
+      mockRes(500, body);
+      await expect(fetchDetailData('/x')).rejects.toThrow(
+        expect.not.stringContaining('[object Object]') as unknown as string,
+      );
+    }
+  });
+
+  it('tetap menerima error berbentuk string', async () => {
+    mockRes(401, { error: 'unauthorized' });
+    await expect(fetchDetailData('/x')).rejects.toThrow('unauthorized');
+  });
+
+  it('jatuh ke pesan HTTP ketika body tidak memuat error yang bisa dibaca', async () => {
+    mockRes(502, {});
+    await expect(fetchDetailData('/x')).rejects.toThrow('Gagal memuat data (HTTP 502)');
+  });
+
+  it('sukses tetap membuka envelope {data}', async () => {
+    mockRes(200, { data: { id: 7, name: 'ok' } });
+    await expect(fetchDetailData<{ id: number }>('/x')).resolves.toEqual({ id: 7, name: 'ok' });
+  });
+});

package/src/workflow/crud-client.ts

@@ -1,9 +1,40 @@
+/**
+ * Ambil pesan error dari body respons.
+ *
+ * ⚠️ Service Go di estate ini mengembalikan `error` sebagai OBJEK
+ * (`{"error": {"code": "FORBIDDEN", "message": "access denied"}}`), bukan
+ * string. Versi sebelumnya menyerahkan objek itu langsung ke `new Error()`,
+ * yang menghasilkan pesan literal "[object Object]" — jadi penyebab sebenarnya
+ * (403, pesan "access denied") TERTELAN, dan yang dilihat operator hanya
+ * "[object Object]". Kena 2026-08-14 pada detail nasabah cif: penyebab aslinya
+ * token BFF yang salah bentuk, tapi tak seorang pun bisa melihatnya dari UI.
+ *
+ * Menerima ketiga bentuk: string, `{message}`, dan `{code, message}`.
+ */
+function errorMessage(err: unknown, fallback: string): string {
+  if (typeof err === 'string' && err.trim() !== '') return err;
+  if (err && typeof err === 'object') {
+    const o = err as { message?: unknown; code?: unknown };
+    if (typeof o.message === 'string' && o.message.trim() !== '') {
+      return typeof o.code === 'string' ? `${o.message} (${o.code})` : o.message;
+    }
+    if (typeof o.code === 'string' && o.code.trim() !== '') return o.code;
+  }
+  return fallback;
+}
+
 export async function fetchDetailData<T>(url: string): Promise<T> {
   const res = await fetch(url);
-  const body = (await res.json().catch(() => ({}))) as { data?: T; error?: string };
+  const body = (await res.json().catch(() => ({}))) as {
+    data?: T;
+    error?: unknown;
+    message?: unknown;
+  };
 
   if (!res.ok) {
-    throw new Error(body.error ?? `Gagal memuat data (HTTP ${res.status})`);
+    throw new Error(
+      errorMessage(body.error ?? body.message, `Gagal memuat data (HTTP ${res.status})`),
+    );
   }
   if (!body.data) {
     throw new Error('Gagal memuat data');

package/src/workflow/starter.ts

@@ -9,10 +9,43 @@
 // workflow7 EventRecorder dispatch SSE event `instance.completed` balik ke
 // initiator. Kalau initiatedBy kosong → no dispatch → notifikasi silent.
 
-const WORKFLOW7_URL =
-  process.env.NEXT_PUBLIC_BOS7_WORKFLOW_URL ??
-  process.env.WORKFLOW7_URL ??
-  'http://localhost:8081';
+// 🔑 WORKFLOW7_URL only. NEXT_PUBLIC_BOS7_WORKFLOW_URL is deliberately NOT
+// consulted here, and that is the fix — it used to be consulted FIRST.
+//
+// That variable names the workflow WEBAPP, in both environments:
+//
+//   local    workflow.bos7.local     → workflow7-web  :3002   (webapp)
+//            api.workflow.bos7.local → workflow7-svc   :8081   (service)
+//   Railway  workflow.ibos7.com      → bos7-workflow          (webapp)
+//            core7-service …          no public domain — internal only
+//
+// This helper POSTs to /wf/instances/start on the SERVICE. Pointing it at the
+// webapp produced a redirect chain that ends in a misleading 405, reproduced
+// end to end on Railway:
+//
+//   POST https://workflow.ibos7.com/wf/instances/start
+//     → 307 Location: /api/auth/login?returnTo=/wf/instances/start
+//     → fetch preserves POST across a 307
+//     → /api/auth/login accepts GET only
+//     → 405 Method Not Allowed
+//
+// Control, same path against the service: 401 — the route exists and only
+// wants auth.
+//
+// ⚠️ The old order only broke where NEXT_PUBLIC_BOS7_WORKFLOW_URL is SET.
+// Locally it is usually unset, so the chain fell through to the service and
+// every flow worked — which is why this survived local testing across four
+// webapps. On Railway it is set on all of them, so it won.
+//
+// The NEXT_PUBLIC fallback is removed rather than demoted: for this endpoint
+// it can only ever produce that 405, and a fallback whose sole outcome is a
+// misleading error is worse than none. With it gone, an unconfigured
+// container fails to connect — which names the real problem.
+//
+// NEXT_PUBLIC_BOS7_WORKFLOW_URL stays correct in notifications-bff.ts, which
+// builds user-facing LINKS to the workflow webapp. Same variable, different
+// job; only this file was using it for the wrong one.
+const WORKFLOW7_URL = process.env.WORKFLOW7_URL ?? 'http://localhost:8081';
 
 type CookieReqLike = Request & {
   cookies?: { get?: (name: string) => { value?: string } | undefined };