@objectstack/plugin-approvals 12.6.0 → 14.3.0

package/dist/index.mjs

@@ -1007,7 +1007,7 @@ var ESCALATION_JOB_NAME = "approvals-sla-escalation";
 var ESCALATION_SCAN_INTERVAL_MS = 5 * 60 * 1e3;
 var SLA_ACTOR_ID = "system:sla";
 var ACTION_TOKEN_TTL_MS = 72 * 60 * 60 * 1e3;
-var SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+var SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] };
 function uid(prefix) {
   const g = globalThis;
   if (g.crypto?.randomUUID) return `${prefix}_${g.crypto.randomUUID()}`;
@@ -1130,16 +1130,20 @@ var _ApprovalService = class _ApprovalService {
   }
   /**
    * Expand the approvers on an Approval node into user IDs by querying the
-   * graph tables for `team:` / `department:` / `role:` / `manager:` approver
-   * types. Falls back to a prefixed literal (`type:value`) when graph lookups
-   * produce nothing — so existing fixtures and flows that rely on substring
-   * matching keep working.
+   * graph tables for `team:` / `department:` / `position:` / `role:` /
+   * `manager:` approver types. Falls back to a prefixed literal
+   * (`type:value`) when graph lookups produce nothing — so existing fixtures
+   * and flows that rely on substring matching keep working.
    *
    * **Graph semantics:**
    *   - `team`       → flat members of `sys_team` (better-auth; no BFS)
    *   - `department` → recursive BFS of `sys_business_unit.parent_business_unit_id`
    *                    → members of every descendant via `sys_business_unit_member`
-   *   - `role`       → users with `sys_member.role = value` in tenant
+   *   - `position`   → holders via `sys_user_position` ∪ `sys_member.role`
+   *                    transition source (ADR-0090 D3 / ADR-0057 D4)
+   *   - `role`       → users with `sys_member.role = value` in tenant — the
+   *                    better-auth MEMBERSHIP TIER (owner/admin/member), not a
+   *                    position; author `position` for org positions
    *   - `manager`    → `sys_user.manager_id` of `record[value] ?? record.owner_id`
    *   - `field`      → literal user id stored in `record[value]`
    *   - `user`       → literal value
@@ -1164,12 +1168,18 @@ var _ApprovalService = class _ApprovalService {
             for (const u of users) out.push(u);
             continue;
           }
-        } else if (a.type === "business_unit" || a.type === "bu") {
+        } else if (a.type === "department" || a.type === "business_unit" || a.type === "bu") {
           const users = await this.expandBusinessUnitUsers(String(a.value), organizationId);
           if (users.length) {
             for (const u of users) out.push(u);
             continue;
           }
+        } else if (a.type === "position") {
+          const users = await this.expandPositionUsers(String(a.value), organizationId);
+          if (users.length) {
+            for (const u of users) out.push(u);
+            continue;
+          }
         } else if (a.type === "role") {
           const users = await this.expandRoleUsers(String(a.value), organizationId);
           if (users.length) {
@@ -1256,6 +1266,36 @@ var _ApprovalService = class _ApprovalService {
     }
     return Array.from(new Set((rows ?? []).map((r) => String(r.user_id ?? "")).filter(Boolean)));
   }
+  /**
+   * Position holders (ADR-0090 D3): `sys_user_position` is the platform-owned
+   * assignment table, keyed by the position's machine name (ADR-0057 D4),
+   * unioned with the better-auth membership string (`sys_member.role`) as a
+   * transition source — the same semantics as `PositionGraphService` in
+   * `plugin-sharing`, so an approval routes to exactly the users the sharing
+   * engine would expand for the same position.
+   */
+  async expandPositionUsers(positionName, organizationId) {
+    if (!positionName) return [];
+    const users = /* @__PURE__ */ new Set();
+    const filter = { position: positionName };
+    if (organizationId) filter.organization_id = organizationId;
+    try {
+      const rows = await this.engine.find("sys_user_position", {
+        filter,
+        fields: ["user_id"],
+        limit: 1e4,
+        context: SYSTEM_CTX
+      });
+      for (const r of rows ?? []) {
+        const uid2 = String(r.user_id ?? "");
+        if (uid2) users.add(uid2);
+      }
+    } catch {
+    }
+    for (const uid2 of await this.expandRoleUsers(positionName, organizationId)) users.add(uid2);
+    return Array.from(users);
+  }
+  /** better-auth org-membership tier (`sys_member.role`) — NOT positions. */
   async expandRoleUsers(roleName, organizationId) {
     if (!roleName) return [];
     const filter = { role: roleName };
@@ -2177,6 +2217,15 @@ var _ApprovalService = class _ApprovalService {
     const escalateTo = typeof esc2.escalateTo === "string" && esc2.escalateTo.trim() ? esc2.escalateTo.trim() : void 0;
     const now = this.clock.now().toISOString();
     const pending = csvSplit(raw.pending_approvers);
+    let escalatees = [];
+    if (escalateTo) {
+      try {
+        escalatees = await this.expandPositionUsers(escalateTo, raw.organization_id ?? null);
+      } catch {
+        escalatees = [];
+      }
+      if (!escalatees.length) escalatees = [escalateTo];
+    }
     await this.engine.insert("sys_approval_action", {
       id: uid("aact"),
       request_id: raw.id,
@@ -2188,16 +2237,16 @@ var _ApprovalService = class _ApprovalService {
       comment: `${action}${escalateTo ? ` \u2192 ${escalateTo}` : ""}`,
       created_at: now
     }, { context: SYSTEM_CTX });
-    if (action === "reassign" && escalateTo) {
+    if (action === "reassign" && escalatees.length) {
       await this.engine.update("sys_approval_request", {
         id: raw.id,
-        pending_approvers: escalateTo,
+        pending_approvers: escalatees.join(","),
         updated_at: now
       }, { context: SYSTEM_CTX });
-      await this.syncApproverIndex(raw.id, [escalateTo], raw.organization_id ?? null, now);
+      await this.syncApproverIndex(raw.id, escalatees, raw.organization_id ?? null, now);
       await this.notify({
         topic: "approval.escalated",
-        audience: [escalateTo],
+        audience: escalatees,
         actorId: SLA_ACTOR_ID,
         source: { object: "sys_approval_request", id: raw.id },
         payload: {
@@ -2215,7 +2264,7 @@ var _ApprovalService = class _ApprovalService {
     } else {
       await this.notify({
         topic: "approval.sla_breached",
-        audience: [...pending, ...escalateTo ? [escalateTo] : []],
+        audience: [...pending, ...escalatees],
         actorId: SLA_ACTOR_ID,
         source: { object: "sys_approval_request", id: raw.id },
         payload: {
@@ -2920,7 +2969,7 @@ import {
   getApprovalNodeConfigJsonSchema,
   APPROVAL_NODE_TYPE
 } from "@objectstack/spec/automation";
-var SYSTEM_CTX2 = { isSystem: true, roles: [], permissions: [] };
+var SYSTEM_CTX2 = { isSystem: true, positions: [], permissions: [] };
 function registerApprovalNode(automation, service, logger) {
   automation.registerNodeExecutor({
     type: APPROVAL_NODE_TYPE,