@objectstack/plugin-approvals 12.6.0 → 13.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-approvals",
-  "version": "12.6.0",
+  "version": "13.0.0",
   "license": "Apache-2.0",
   "description": "Multi-step approval engine for ObjectStack — sys_approval_process + sys_approval_request + sys_approval_action + IApprovalService.",
   "main": "dist/index.js",
@@ -13,17 +13,17 @@
     }
   },
   "dependencies": {
-    "@objectstack/core": "12.6.0",
-    "@objectstack/formula": "12.6.0",
-    "@objectstack/metadata-core": "12.6.0",
-    "@objectstack/platform-objects": "12.6.0",
-    "@objectstack/spec": "12.6.0"
+    "@objectstack/core": "13.0.0",
+    "@objectstack/formula": "13.0.0",
+    "@objectstack/metadata-core": "13.0.0",
+    "@objectstack/platform-objects": "13.0.0",
+    "@objectstack/spec": "13.0.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
-    "@objectstack/service-automation": "12.6.0"
+    "@objectstack/service-automation": "13.0.0"
   },
   "keywords": [
     "objectstack",

package/src/approval-node.test.ts

@@ -5,7 +5,7 @@ import { AutomationEngine } from '@objectstack/service-automation';
 import { ApprovalService } from './approval-service.js';
 import { registerApprovalNode } from './approval-node.js';
 
-const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] } as any;
+const SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] } as any;
 
 const noopLogger = {
   info() {}, warn() {}, error() {}, debug() {},
@@ -190,7 +190,7 @@ describe('Approval node bridge (ADR-0019)', () => {
     const request = (await fake.find('sys_approval_request', { where: { status: 'pending' } }))[0];
 
     await expect(
-      service.decideNode(request.id, { decision: 'approve', actorId: 'intruder' }, { isSystem: false, roles: [], permissions: [] } as any),
+      service.decideNode(request.id, { decision: 'approve', actorId: 'intruder' }, { isSystem: false, positions: [], permissions: [] } as any),
     ).rejects.toThrow(/FORBIDDEN/);
   });
 });

package/src/approval-node.ts

@@ -48,7 +48,7 @@ interface MinimalLogger {
   warn?: (msg: any, ...rest: any[]) => void;
 }
 
-const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] } as const;
+const SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] } as const;
 
 /**
  * Register the `approval` node executor on the automation engine. Idempotent at

package/src/approval-revise.test.ts

@@ -19,8 +19,8 @@ import { ApprovalService } from './approval-service.js';
 import { registerApprovalNode } from './approval-node.js';
 import { bindApprovalLockHook, APPROVALS_HOOK_PACKAGE } from './lifecycle-hooks.js';
 
-const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] } as any;
-const USER_CTX = { isSystem: false, roles: [], permissions: [] } as any;
+const SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] } as any;
+const USER_CTX = { isSystem: false, positions: [], permissions: [] } as any;
 
 const noopLogger = { info() {}, warn() {}, error() {}, debug() {} };
 
@@ -288,7 +288,7 @@ describe('Send back for revision (ADR-0044)', () => {
     const editAttempt = () => hook!({
       object: 'fin_expense',
       input: { id: 'x1', data: { amount: 1200 } },
-      session: { isSystem: false, roles: [] },
+      session: { isSystem: false, positions: [] },
     });
 
     await expect(editAttempt()).rejects.toThrow(/RECORD_LOCKED/);          // pending → locked

package/src/approval-service.test.ts

@@ -110,8 +110,8 @@ function makeFakeEngine() {
   };
 }
 
-const CTX = { userId: 'u1', tenantId: 't1', roles: [], permissions: [] } as any;
-const SYS = { isSystem: true, roles: [], permissions: [] } as any;
+const CTX = { userId: 'u1', tenantId: 't1', positions: [], permissions: [] } as any;
+const SYS = { isSystem: true, positions: [], permissions: [] } as any;
 
 function nodeConfig(approvers: string[], extra: Record<string, any> = {}) {
   return {
@@ -219,7 +219,7 @@ describe('ApprovalService (node era)', () => {
   it('decideNode: blocks a non-approver in a non-system context', async () => {
     const req = await svc.openNodeRequest(openInput(['u9']), CTX);
     await expect(
-      svc.decideNode(req.id, { decision: 'approve', actorId: 'mallory' }, { isSystem: false, roles: [], permissions: [] } as any),
+      svc.decideNode(req.id, { decision: 'approve', actorId: 'mallory' }, { isSystem: false, positions: [], permissions: [] } as any),
     ).rejects.toThrow(/FORBIDDEN/);
   });
 
@@ -319,7 +319,7 @@ describe('ApprovalService (node era)', () => {
 
   it('recall: blocks a non-submitter in a non-system context', async () => {
     const req = await svc.openNodeRequest(openInput(['u9']), CTX);
-    await expect(svc.recall(req.id, { actorId: 'u9' }, { roles: [], permissions: [] } as any))
+    await expect(svc.recall(req.id, { actorId: 'u9' }, { positions: [], permissions: [] } as any))
       .rejects.toThrow(/FORBIDDEN/);
   });
 
@@ -483,7 +483,7 @@ describe('ApprovalService (node era)', () => {
 
   it('remind: only the submitter may nudge', async () => {
     const req = await svc.openNodeRequest(openInput(['u9']), CTX);
-    await expect(svc.remind(req.id, { actorId: 'u9' }, { roles: [], permissions: [] } as any))
+    await expect(svc.remind(req.id, { actorId: 'u9' }, { positions: [], permissions: [] } as any))
       .rejects.toThrow(/FORBIDDEN/);
   });
 
@@ -503,7 +503,7 @@ describe('ApprovalService (node era)', () => {
     const req = await svc.openNodeRequest(openInput(['u9']), CTX);
     await svc.comment(req.id, { actorId: 'u1', comment: 'Numbers attached.' }, CTX);
     await svc.comment(req.id, { actorId: 'u9', comment: 'Thanks, reviewing.' }, CTX);
-    await expect(svc.comment(req.id, { actorId: 'outsider', comment: 'hi' }, { roles: [], permissions: [] } as any))
+    await expect(svc.comment(req.id, { actorId: 'outsider', comment: 'hi' }, { positions: [], permissions: [] } as any))
       .rejects.toThrow(/FORBIDDEN/);
     const actions = await svc.listActions(req.id, SYS);
     expect(actions.filter(a => a.action === 'comment')).toHaveLength(2);
@@ -882,7 +882,7 @@ describe('record-lock hook (node era)', () => {
       engine.fire('beforeUpdate', {
         object: 'opportunity',
         input: { id: 'opp1', data: { amount: 200 } },
-        session: { isSystem: false, roles: [], userId: 'u1' },
+        session: { isSystem: false, positions: [], userId: 'u1' },
       }),
     ).rejects.toThrow(/RECORD_LOCKED/);
   });
@@ -892,7 +892,7 @@ describe('record-lock hook (node era)', () => {
       engine.fire('beforeUpdate', {
         object: 'opportunity',
         input: { id: 'opp1', data: { approval_status: 'approved' } },
-        session: { isSystem: false, roles: [] },
+        session: { isSystem: false, positions: [] },
       }),
     ).resolves.toBeUndefined();
   });
@@ -902,7 +902,7 @@ describe('record-lock hook (node era)', () => {
       engine.fire('beforeUpdate', {
         object: 'opportunity',
         input: { id: 'opp1', data: { amount: 200 } },
-        session: { isSystem: true, roles: [] },
+        session: { isSystem: true, positions: [] },
       }),
     ).resolves.toBeUndefined();
   });
@@ -922,7 +922,7 @@ describe('record-lock hook (node era)', () => {
       engine.fire('beforeUpdate', {
         object: 'opportunity',
         input: { id: 'other_record', data: { amount: 200 } },
-        session: { isSystem: false, roles: [] },
+        session: { isSystem: false, positions: [] },
       }),
     ).resolves.toBeUndefined();
   });

package/src/approval-service.ts

@@ -97,7 +97,7 @@ export type ActionTokenOutcome =
   | { ok: true; action: 'approve' | 'reject'; request: ApprovalRequestRow; approverId: string }
   | { ok: false; reason: 'invalid' | 'expired' | 'consumed' | 'not_pending' | 'not_approver'; request?: ApprovalRequestRow };
 
-const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] } as const;
+const SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] } as const;
 
 function uid(prefix: string): string {
   const g: any = globalThis as any;