@nanobpm/urban 0.75.0 → 0.76.0

package/dist/runtime/core/modules/surfaces.js

@@ -38,7 +38,7 @@ form .field input[type=checkbox],form .field input[type=radio]{width:auto}
 <h1>Task inbox</h1><ul id="tasks"><li>loading…</li></ul>
 <div id="form"></div>
 <script>
-const BASE=location.pathname.replace(/\/+$/,'');
+const BASE=location.pathname.replace(/[/]+$/,'');
 const tasksEl=document.getElementById('tasks');
 const formEl=document.getElementById('form');
 
@@ -47,7 +47,7 @@ function api(path,opts){return fetch(BASE+path,opts).then(r=>{if(!r.ok)return r.
 function loadTasks(){
   formEl.replaceChildren();
   tasksEl.replaceChildren(el('li',{},'loading…'));
-  return api('/api/tasks').then(ts=>{
+  return api('/api/tasks'+location.search).then(ts=>{
     tasksEl.replaceChildren();
     if(!ts.length){tasksEl.appendChild(el('li',{},'No open tasks.'));return;}
     for(const t of ts){
@@ -202,13 +202,18 @@ export function mountSurfaces(ctx, app) {
             source: "surface:taskInbox",
             handler: async (req) => {
                 const pik = req.query.get("processInstanceKey") ?? undefined;
-                // Constrain the inbox to open (answerable) tasks. Without a state filter the engine
-                // returns tasks in every state (CREATED/COMPLETED/CANCELED/...), so already-answered
-                // or withdrawn tasks would surface as if actionable — completing one then fails with
-                // "User task ... is not active". See nanobpm/nano-ide#248.
-                const tasks = await app.engine.searchUserTasks({
-                    state: "CREATED",
+                const assignee = req.query.get("assignee") ?? undefined;
+                const candidateGroup = req.query.get("candidateGroup") ?? undefined;
+                // Constrain the inbox to open (answerable) tasks via openUserTasks — the accessor that
+                // pins state="CREATED" for us. A bare searchUserTasks returns tasks in every state
+                // (CREATED/COMPLETED/CANCELED/...), so already-answered or withdrawn tasks would surface
+                // as if actionable — completing one then fails with "User task ... is not active".
+                // Deriving the pin from openUserTasks (rather than re-pinning state here) keeps the
+                // definition of "open" single-sourced. See nanobpm/nano-ide#248.
+                const tasks = await app.engine.openUserTasks({
                     ...(pik ? { processInstanceKey: pik } : {}),
+                    ...(assignee ? { assignee } : {}),
+                    ...(candidateGroup ? { candidateGroup } : {}),
                 });
                 return json(tasks);
             },

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nanobpm/urban",
-	"version": "0.75.0",
+	"version": "0.76.0",
 	"description": "Urban: build and run code-first apps on Nano — runtime, derivation toolkit, and CLI in one. Author durable processes with @nanobpm/workflow (defineFlow), a typed datasource, forms, triggers and surfaces from a nano.app.json manifest, on Node or Deno.",
 	"license": "Apache-2.0",
 	"type": "module",

package/src/runtime/core/modules/surfaces.test.ts

@@ -163,11 +163,29 @@ test("inbox page renders the client-side form fetch + renderer", async () => {
   assert.ok(!/const\s+variables\s*=\s*\{\}/.test(rendered), "client must not collect untrusted keys into a plain {} object");
 });
 
+test("inbox client script parses — no template-literal backslash collapse", async () => {
+  const { page } = inboxRoutes(fakeEngine);
+  const rendered = String((await call(page)).body);
+  // Extract every inline <script> body and assert each parses. A backslash-bearing regex
+  // written inside the page's template literal (e.g. `/\/+$/`) collapses to `//…` at emit
+  // time, turning the rest of the statement into a line comment and breaking the parse
+  // (issue #433). `new Function(body)` throws on any such SyntaxError.
+  const scripts = rendered
+    .split("<script>")
+    .slice(1)
+    .map((chunk) => chunk.split("</scr" + "ipt>")[0]);
+  assert.ok(scripts.length > 0, "inbox page has at least one inline script");
+  for (const body of scripts) {
+    assert.ok(!body.includes("//+$/"), "trailing-slash-strip regex collapsed to a line comment");
+    assert.doesNotThrow(() => new Function(body), "inline client script must parse");
+  }
+});
+
 test("/api/tasks surfaces the resolved form linkage", async () => {
   let seenFilter: unknown;
   const engine: EngineClient = {
     ...fakeEngine,
-    searchUserTasks: async (filter) => {
+    openUserTasks: async (filter) => {
       seenFilter = filter;
       return [
         { userTaskKey: "1", elementId: "approve", formKey: "form-123" },
@@ -177,26 +195,97 @@ test("/api/tasks surfaces the resolved form linkage", async () => {
   };
   const { tasks } = inboxRoutes(engine);
   const res = await call(tasks, { query: "processInstanceKey=pi-9" });
-  assert.deepEqual(seenFilter, { state: "CREATED", processInstanceKey: "pi-9" });
+  assert.deepEqual(seenFilter, { processInstanceKey: "pi-9" });
   const parsed = JSON.parse(String(res.body));
   assert.equal(parsed[0].formKey, "form-123");
   assert.equal(parsed[1].formKey, undefined);
 });
 
-test("/api/tasks constrains the search to open (CREATED) tasks", async () => {
+test("/api/tasks constrains the search to open tasks via openUserTasks", async () => {
   let seenFilter: unknown;
+  let openCalled = false;
   const engine: EngineClient = {
     ...fakeEngine,
-    searchUserTasks: async (filter) => {
+    // A regression to a bare searchUserTasks (which does not pin state="CREATED") must fail
+    // loudly rather than silently surface answered/canceled tasks (nanobpm/nano-ide#248).
+    searchUserTasks: async () => {
+      throw new Error("inbox must use openUserTasks, not a bare searchUserTasks");
+    },
+    openUserTasks: async (filter) => {
+      openCalled = true;
       seenFilter = filter;
       return [];
     },
   };
   const { tasks } = inboxRoutes(engine);
   await call(tasks);
-  // No processInstanceKey supplied, but the inbox must still pin state=CREATED so that
-  // already-answered/canceled tasks never surface as answerable (nanobpm/nano-ide#248).
-  assert.deepEqual(seenFilter, { state: "CREATED" });
+  // No processInstanceKey supplied; the inbox routes through openUserTasks, which pins the
+  // open (CREATED) invariant for us, so the handler forwards only selectors (none here).
+  assert.equal(openCalled, true);
+  assert.deepEqual(seenFilter, {});
+});
+
+test("/api/tasks forwards assignee and candidateGroup to the engine (nanobpm/nano-ide#438)", async () => {
+  let seenFilter: unknown;
+  const engine: EngineClient = {
+    ...fakeEngine,
+    openUserTasks: async (filter) => {
+      seenFilter = filter;
+      return [];
+    },
+  };
+  const { tasks } = inboxRoutes(engine);
+  await call(tasks, { query: "assignee=demo-reviewer&candidateGroup=reviewers&processInstanceKey=pi-9" });
+  // A manifest ui.path like /tasks?assignee=… must scope the inbox to that reviewer/group on a
+  // shared engine — the handler forwards both alongside the processInstanceKey selector (the
+  // open/CREATED pin is openUserTasks' responsibility, not repeated here).
+  assert.deepEqual(seenFilter, {
+    processInstanceKey: "pi-9",
+    assignee: "demo-reviewer",
+    candidateGroup: "reviewers",
+  });
+});
+
+test("/api/tasks omits assignee/candidateGroup when absent (unscoped inbox unchanged)", async () => {
+  let seenFilter: unknown;
+  const engine: EngineClient = {
+    ...fakeEngine,
+    openUserTasks: async (filter) => {
+      seenFilter = filter;
+      return [];
+    },
+  };
+  const { tasks } = inboxRoutes(engine);
+  await call(tasks, { query: "assignee=demo-reviewer" });
+  // Only the supplied param is forwarded; candidateGroup stays off so its key never appears.
+  assert.deepEqual(seenFilter, { assignee: "demo-reviewer" });
+});
+
+test("/api/tasks omits assignee when only candidateGroup is present (symmetric scoping)", async () => {
+  let seenFilter: unknown;
+  const engine: EngineClient = {
+    ...fakeEngine,
+    openUserTasks: async (filter) => {
+      seenFilter = filter;
+      return [];
+    },
+  };
+  const { tasks } = inboxRoutes(engine);
+  await call(tasks, { query: "candidateGroup=reviewers" });
+  // Symmetric to the assignee-only case: only the supplied param is forwarded, so assignee's
+  // key never appears when scoping the inbox to a candidate group alone.
+  assert.deepEqual(seenFilter, { candidateGroup: "reviewers" });
+});
+
+test("inbox client forwards the surface query string to /api/tasks (nanobpm/nano-ide#438)", async () => {
+  const { page } = inboxRoutes(fakeEngine);
+  const rendered = String((await call(page)).body);
+  // A scoped surface path (e.g. /tasks?assignee=…) reaches the iframe as location.search; the
+  // client must append it so the handler sees the scope. Guard the drift closed.
+  assert.ok(
+    rendered.includes("'/api/tasks'+location.search") || rendered.includes("'/api/tasks' + location.search"),
+    "client forwards location.search onto the /api/tasks fetch",
+  );
 });
 
 test("/api/form resolves a linked form's schema", async () => {

package/src/runtime/core/modules/surfaces.ts

@@ -50,7 +50,7 @@ form .field input[type=checkbox],form .field input[type=radio]{width:auto}
 <h1>Task inbox</h1><ul id="tasks"><li>loading…</li></ul>
 <div id="form"></div>
 <script>
-const BASE=location.pathname.replace(/\/+$/,'');
+const BASE=location.pathname.replace(/[/]+$/,'');
 const tasksEl=document.getElementById('tasks');
 const formEl=document.getElementById('form');
 
@@ -59,7 +59,7 @@ function api(path,opts){return fetch(BASE+path,opts).then(r=>{if(!r.ok)return r.
 function loadTasks(){
   formEl.replaceChildren();
   tasksEl.replaceChildren(el('li',{},'loading…'));
-  return api('/api/tasks').then(ts=>{
+  return api('/api/tasks'+location.search).then(ts=>{
     tasksEl.replaceChildren();
     if(!ts.length){tasksEl.appendChild(el('li',{},'No open tasks.'));return;}
     for(const t of ts){
@@ -216,13 +216,18 @@ export function mountSurfaces(ctx: RuntimeContext, app: AppApi): SurfacesHandle
       source: "surface:taskInbox",
       handler: async (req) => {
         const pik = req.query.get("processInstanceKey") ?? undefined;
-        // Constrain the inbox to open (answerable) tasks. Without a state filter the engine
-        // returns tasks in every state (CREATED/COMPLETED/CANCELED/...), so already-answered
-        // or withdrawn tasks would surface as if actionable — completing one then fails with
-        // "User task ... is not active". See nanobpm/nano-ide#248.
-        const tasks = await app.engine.searchUserTasks({
-          state: "CREATED",
+        const assignee = req.query.get("assignee") ?? undefined;
+        const candidateGroup = req.query.get("candidateGroup") ?? undefined;
+        // Constrain the inbox to open (answerable) tasks via openUserTasks — the accessor that
+        // pins state="CREATED" for us. A bare searchUserTasks returns tasks in every state
+        // (CREATED/COMPLETED/CANCELED/...), so already-answered or withdrawn tasks would surface
+        // as if actionable — completing one then fails with "User task ... is not active".
+        // Deriving the pin from openUserTasks (rather than re-pinning state here) keeps the
+        // definition of "open" single-sourced. See nanobpm/nano-ide#248.
+        const tasks = await app.engine.openUserTasks({
           ...(pik ? { processInstanceKey: pik } : {}),
+          ...(assignee ? { assignee } : {}),
+          ...(candidateGroup ? { candidateGroup } : {}),
         });
         return json(tasks);
       },