@objectstack/plugin-approvals 15.1.1 → 16.0.0-rc.1

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @objectstack/plugin-approvals@15.1.1 build /home/runner/work/framework/framework/packages/plugins/plugin-approvals
+> @objectstack/plugin-approvals@16.0.0-rc.1 build /home/runner/work/framework/framework/packages/plugins/plugin-approvals
 > tsup --config ../../../tsup.config.ts
 
 CLI Building entry: src/index.ts
@@ -10,13 +10,13 @@
 CLI Cleaning output folder
 ESM Build start
 CJS Build start
-CJS dist/index.js     123.99 KB
-CJS dist/index.js.map 220.47 KB
-CJS ⚡️ Build success in 211ms
-ESM dist/index.mjs     122.33 KB
-ESM dist/index.mjs.map 219.27 KB
-ESM ⚡️ Build success in 257ms
+ESM dist/index.mjs     156.89 KB
+ESM dist/index.mjs.map 275.84 KB
+ESM ⚡️ Build success in 231ms
+CJS dist/index.js     158.72 KB
+CJS dist/index.js.map 277.08 KB
+CJS ⚡️ Build success in 235ms
 DTS Build start
-DTS ⚡️ Build success in 32099ms
-DTS dist/index.d.mts 397.05 KB
-DTS dist/index.d.ts  397.05 KB
+DTS ⚡️ Build success in 21940ms
+DTS dist/index.d.mts 418.30 KB
+DTS dist/index.d.ts  418.30 KB

package/CHANGELOG.md

@@ -1,5 +1,173 @@
 # @objectstack/plugin-approvals
 
+## 16.0.0-rc.1
+
+### Minor Changes
+
+- e412fb6: feat(approvals): declare file attachments on approve/reject decisions
+
+  The declared `approval_approve` / `approval_reject` actions on
+  `sys_approval_request` gain an optional multi-file `attachments` param
+  (`type: 'file'`, `multiple`). The console renders `type:'file'` action params
+  through the shared upload widget (objectui ADR-0059) and POSTs the resolved
+  `attachments: string[]`, so a reviewer can attach supporting files to a
+  decision through the generic declared-action dialog — letting the approvals
+  inbox retire its hand-wired attachment composer (objectui#2698).
+
+  Purely additive metadata: the decision route already forwards
+  `body.attachments` to `ApprovalService.decide`, and the
+  `sys_approval_action.attachments` column (file, multiple) already persists them
+  (#3266/#3274). No service or route change.
+
+- 8efa395: feat(approvals): server-computed `viewer` capability for precise decision-action gating
+
+  `getRequest` / `listRequests` now attach a per-viewer block —
+  `viewer: { can_act, is_submitter }` — computed from the caller's context
+  (`ApprovalRequestRow.viewer`):
+
+  - `can_act` — the caller is a _current pending approver_ (their user id is in the
+    request's resolved `pending_approvers` while it is still `pending`). This is
+    the same check the decision methods authorize with, so it already reflects
+    position/team/manager resolution — strictly more accurate than a client-side
+    identity guess.
+  - `is_submitter` — the caller submitted the request.
+
+  The declared decision actions on `sys_approval_request` now gate on it: approver
+  actions (approve/reject/reassign/send-back/request-info) use
+  `record.viewer.can_act`; submitter levers (remind/recall/resubmit) use
+  `record.viewer.is_submitter`. Previously approver actions only trimmed the
+  non-pending case, so a submitter viewing their own pending request saw buttons
+  they couldn't use (the backend 403'd); a position-addressed approver could be
+  wrongly hidden by the old client heuristic. Where `viewer` is absent (a row
+  surfaced outside a service read with a user context), the predicate fails closed.
+
+### Patch Changes
+
+- 62a2117: **Split the overloaded `managedBy: 'system'` bucket with an explicit `engine-owned` value (ADR-0103 addendum, #3343).** ADR-0103 deferred the enum split ("revisitable later as a rename") because a new `managedBy` value would fall through to the fully-editable `platform` default on deployed Console clients. Both reasons against it are now retired — the server-side write guard / `apiMethods` reconciliation / `/me/permissions` clamp make that fallthrough cosmetic (the write is rejected regardless of what the client renders), and objectui#2712 closed the UI union — so v16 lands it, **additively**.
+
+  - **New enum value `engine-owned`** with the same all-locked default affordance row as `system` (`create/import/edit/delete: false`, `exportCsv: true`). It joins `ENGINE_OWNED_BUCKETS` (the engine write guard) and `GUARDED_WRITE_BUCKETS` (the `/me/permissions` clamp); the guard, `reconcileManagedApiMethods`, and the clamp mechanisms are unchanged — `engine-owned` is an explicit member of the set they already covered by resolved affordance.
+  - **20 objects relabelled `system → engine-owned`** — the ones the engine owns end to end and that declared no write-opening `userActions` (the metadata store, jobs, approval runtime rows, sharing rows, `sys_automation_run`, the messaging delivery/receipt pipeline, `sys_secret`, settings). One-line, behaviour-identical per object.
+  - **8 admin/user-writable objects keep `managedBy: 'system'`** (the RBAC link tables, `sys_user_preference`, `sys_approval_delegation`, the messaging config grids) — `system` now reads as "engine-managed schema, writable via `userActions`".
+
+  Behaviour-, enforcement- and wire-identical: resolved affordances, the guard verdict, the 405 `apiMethods` reconciliation, and the permissions clamp are the same before and after — this is a self-documenting relabel, not a policy change. No data migration (`managedBy` is schema metadata) and no code branches on the `'system'` literal. Retiring the overloaded `system` entirely (moving the 8 writable objects to a dedicated bucket) is a breaking rename deferred to v17.
+
+- Updated dependencies [6289ec3]
+- Updated dependencies [8efa395]
+- Updated dependencies [bfa3c3f]
+- Updated dependencies [7125007]
+- Updated dependencies [62a2117]
+- Updated dependencies [06ff734]
+  - @objectstack/spec@16.0.0-rc.1
+  - @objectstack/platform-objects@16.0.0-rc.1
+  - @objectstack/formula@16.0.0-rc.1
+  - @objectstack/metadata-core@16.0.0-rc.1
+  - @objectstack/core@16.0.0-rc.1
+
+## 16.0.0-rc.0
+
+### Minor Changes
+
+- 3a18b60: feat(approvals): rename the `role` approver type to `org_membership_level` (#3133)
+
+  `ApproverType.role` was the last platform surface projecting the reserved word
+  "role" (ADR-0090 D3). It is not covered by D3's better-auth exception: that
+  exception protects better-auth's own `sys_member.role` **column**, which we do
+  not own — `ApproverType` is our own enum, an authoring surface, and D3 mandates
+  that the projection of that concept is spelled `org_membership_level` and
+  labelled "organization membership", **never "role"**.
+
+  The sentence licensing the leak was also false: ADR-0090 D3 claims
+  `sys_member.role` is "already relabelled `org_membership_level` in the platform
+  projection", but `org_membership_level` existed nowhere in the codebase and
+  ADR-0057 D7 lists that relabel under "Deferred (evidence-gated, P4)". The
+  projection never landed, so the word reached authors.
+
+  The name manufactured a real, silent failure — "hotcrm class": every other
+  surface renamed to `position` (`sys_role`, `ShareRecipientType.role`,
+  `ctx.roles[]`), so `{ type: 'role', value: 'sales_manager' }` reads as the
+  legacy spelling of a position. It resolves against the membership tier, finds
+  no member row, falls back to an inert `role:sales_manager` literal, and the
+  request waits forever on an approver that cannot exist.
+
+  - **spec**: `ApproverType` gains `org_membership_level`; `role` stays as a
+    deprecated alias for one window (a published 15.x flow keeps loading) with
+    `DEPRECATED_APPROVER_TYPES` + `canonicalApproverType()` as the single source
+    for the mapping. Removed in the next major.
+  - **plugin-approvals**: resolves on the canonical type and warns on the
+    deprecated spelling. The `type:value` fallback literal keeps the **authored**
+    spelling — stored `sys_approval_approver` rows and `pending_approvers` slots
+    from 15.x carry `role:<v>`, and rewriting it would orphan them.
+  - **lint**: `approval-role-not-membership-tier` → `approval-approver-not-membership-tier`
+    (the rule id carried the reserved word too), plus a new
+    `approval-approver-type-deprecated`. The two are mutually exclusive: a bad
+    _value_ wins, because prescribing `org_membership_level` for a position name
+    would be wrong advice — the fix there is `position`.
+
+  Authoring `type: 'role'` keeps working and now says so out loud. Rewrite it as
+  `org_membership_level`; if the value is an org position, the fix is `position`.
+
+### Patch Changes
+
+- 22013aa: **Split the overloaded `managedBy: 'system'` bucket into engine-owned vs. admin-writable, and enforce engine-owned writes (ADR-0103, #3220).** The `system` bucket conflated two incompatible write policies: rows a platform service owns end to end (never user-written), and platform-defined schema whose rows are legitimately admin/user-writable. It carried the same all-false affordance row as `better-auth`/`append-only` but, unlike `better-auth`, had no engine enforcement — a wildcard admin could raw-write these rows through the generic data API (ADR-0049 gap).
+
+  Rather than add a new `managedBy` enum value (which would fall through to fully-editable `platform` defaults on already-deployed Console clients), the write policy is now the **resolved affordance** (`resolveCrudAffordances` = bucket default + `userActions`), and _engine-owned_ is defined as a `system`/`append-only` object that grants no write:
+
+  - **Writable set declares `userActions`** — the RBAC link tables (`sys_user_position`, `sys_user_permission_set`, `sys_position_permission_set`), `sys_user_preference`, `sys_approval_delegation`, and the messaging config grids (`sys_notification_preference` / `…_subscription` / `…_template`) now declare `userActions: { create, edit, delete: true }`. The affordance is a declaration only — the `DelegatedAdminGate` / RLS / permission sets remain the authz.
+  - **Engine-owned objects locked to reads** — `apiMethods: ['get','list']` added where absent (jobs, notifications, approval request/approver/token/action, `sys_record_share`, `sys_automation_run`, mail/settings/secret audit, the messaging delivery pipeline). `sys_secret` is explicitly read-locked (an empty `apiMethods` array fails open).
+  - **`sys_import_job`** stays engine-owned: the REST import route now writes its job rows `isSystem`-elevated (attribution preserved via the explicit `created_by` stamp) and the object is locked to `['get','list']`.
+  - **New engine write guard** (`assertEngineOwnedWriteAllowed`, plugin-security) fail-closed rejects user-context generic writes to engine-owned `system`/`append-only` objects, keyed off the resolved affordance; `isSystem` and context-less engine/service writes bypass by construction. Wired into the security middleware alongside the other data-layer gates.
+  - **`reconcileManagedApiMethods`** (objectql registry) now runs for **every** managed bucket, not just `better-auth`: any advertised write verb an object's resolved affordances forbid is stripped at registration with a warning (the drift backstop, ADR-0049).
+  - **`/me/permissions` clamp** (plugin-hono-server) now clamps `system`/`append-only` as well as `better-auth`, so the client hint reflects `permission ∩ guard`.
+
+  **Potentially breaking:** a downstream/third-party `system` object that advertised generic write verbs relying on today's fail-open behaviour will have those verbs stripped (with a warning) and user-context generic writes to it rejected. Declare `userActions` opening the verbs the object legitimately takes from a user context. `better-auth` keeps plugin-auth's identity write guard unchanged; the row-level `managed_by` provenance vocabulary (ADR-0066) is a different axis and is untouched.
+
+- Updated dependencies [f972574]
+- Updated dependencies [22013aa]
+- Updated dependencies [3ad3dd5]
+- Updated dependencies [3a18b60]
+- Updated dependencies [a8aa34c]
+- Updated dependencies [e057f42]
+- Updated dependencies [a3823b2]
+- Updated dependencies [bc65105]
+- Updated dependencies [43a3efb]
+- Updated dependencies [524696a]
+- Updated dependencies [6b51346]
+- Updated dependencies [80273c8]
+- Updated dependencies [5e3301d]
+- Updated dependencies [dd9f223]
+- Updated dependencies [46e876c]
+- Updated dependencies [5f05de2]
+- Updated dependencies [021ba4c]
+- Updated dependencies [158aa14]
+- Updated dependencies [d2723e2]
+- Updated dependencies [fefcd54]
+- Updated dependencies [beaf2de]
+- Updated dependencies [06cb319]
+- Updated dependencies [369eb6e]
+- Updated dependencies [b659111]
+- Updated dependencies [5754a23]
+- Updated dependencies [6c270a6]
+- Updated dependencies [290e2f0]
+- Updated dependencies [668dd17]
+- Updated dependencies [8abf133]
+- Updated dependencies [e0859b1]
+- Updated dependencies [04ecd4e]
+- Updated dependencies [4d5a892]
+- Updated dependencies [16cebeb]
+- Updated dependencies [86d30af]
+- Updated dependencies [8923843]
+- Updated dependencies [ea32ec7]
+- Updated dependencies [a2795f6]
+- Updated dependencies [f16b492]
+- Updated dependencies [4b6fde8]
+- Updated dependencies [2018df9]
+- Updated dependencies [fc5a3a2]
+  - @objectstack/spec@16.0.0-rc.0
+  - @objectstack/platform-objects@16.0.0-rc.0
+  - @objectstack/core@16.0.0-rc.0
+  - @objectstack/formula@16.0.0-rc.0
+  - @objectstack/metadata-core@16.0.0-rc.0
+
 ## 15.1.1
 
 ### Patch Changes