@objectstack/plugin-approvals 16.0.0-rc.0 → 16.0.0-rc.1

package/dist/index.mjs

@@ -855,7 +855,7 @@ var SysApprovalRequest = ObjectSchema.create({
   pluralLabel: "Approval Requests",
   icon: "inbox",
   isSystem: true,
-  managedBy: "system",
+  managedBy: "engine-owned",
   description: "Live approval instance tracked per submission",
   displayNameField: "id",
   nameField: "id",
@@ -1043,8 +1043,12 @@ var SysApprovalRequest = ObjectSchema.create({
   // (and their params) ship as metadata, not as hand-written buttons. Each
   // targets the existing approvals REST route; `{id}` resolves from the row
   // and `actorId` defaults to the caller server-side. The service remains the
-  // authority on who may act (pending-approver check) — `visible` only trims
-  // the obvious non-pending case.
+  // authority on who may act; `visible` gates on the server-computed
+  // per-viewer block (#3310): approver actions on `record.viewer.can_act`
+  // (the caller is a current pending approver — same check the service
+  // authorizes a decision with, so position/team approvers resolve correctly),
+  // submitter actions on `record.viewer.is_submitter`. `viewer` is attached by
+  // getRequest/listRequests; where it is absent the predicate fails closed.
   actions: [
     {
       name: "approval_approve",
@@ -1054,9 +1058,13 @@ var SysApprovalRequest = ObjectSchema.create({
       method: "POST",
       target: "/api/v1/approvals/requests/{id}/approve",
       params: [
-        { name: "comment", label: "Comment", type: "textarea", required: false }
+        { name: "comment", label: "Comment", type: "textarea", required: false },
+        // Decision attachments (#3266). The console renders `type:'file'` params
+        // through the shared upload widget and POSTs the resolved `attachments:
+        // string[]`; the decision route persists them on `sys_approval_action`.
+        { name: "attachments", label: "Attachments", type: "file", multiple: true, required: false }
       ],
-      visible: 'record.status == "pending"',
+      visible: "record.viewer.can_act",
       locations: ["record_section", "list_item"],
       successMessage: "Approved.",
       refreshAfter: true
@@ -1069,9 +1077,10 @@ var SysApprovalRequest = ObjectSchema.create({
       method: "POST",
       target: "/api/v1/approvals/requests/{id}/reject",
       params: [
-        { name: "comment", label: "Comment", type: "textarea", required: false }
+        { name: "comment", label: "Comment", type: "textarea", required: false },
+        { name: "attachments", label: "Attachments", type: "file", multiple: true, required: false }
       ],
-      visible: 'record.status == "pending"',
+      visible: "record.viewer.can_act",
       confirmText: "Reject this request? A rejection is final for every approver.",
       locations: ["record_section", "list_item"],
       successMessage: "Rejected.",
@@ -1093,15 +1102,15 @@ var SysApprovalRequest = ObjectSchema.create({
         { field: "submitter_id", name: "to", label: "New approver", required: true, helpText: "User to hand this step to" },
         { name: "comment", label: "Comment", type: "textarea", required: false }
       ],
-      visible: 'record.status == "pending"',
+      visible: "record.viewer.can_act",
       locations: ["record_section"],
       successMessage: "Reassigned.",
       refreshAfter: true
     },
     // ── Approver secondary decisions ────────────────────────────────
     // Send back for revision / request more info (ADR-0044). Both are approver
-    // actions on a pending request; the service is the authority on who may act,
-    // so `visible` only trims the non-pending case (matching approve/reject).
+    // actions, so `visible` gates on `record.viewer.can_act` (a current pending
+    // approver) — same as approve/reject. The service stays the authority.
     {
       name: "approval_send_back",
       label: "Send back",
@@ -1112,7 +1121,7 @@ var SysApprovalRequest = ObjectSchema.create({
       params: [
         { name: "comment", label: "Reason", type: "textarea", required: false }
       ],
-      visible: 'record.status == "pending"',
+      visible: "record.viewer.can_act",
       locations: ["record_section"],
       successMessage: "Sent back for revision.",
       refreshAfter: true
@@ -1127,17 +1136,17 @@ var SysApprovalRequest = ObjectSchema.create({
       params: [
         { name: "comment", label: "What do you need?", type: "textarea", required: true }
       ],
-      visible: 'record.status == "pending"',
+      visible: "record.viewer.can_act",
       locations: ["record_section"],
       successMessage: "Information requested.",
       refreshAfter: true
     },
     // ── Submitter continuity actions ────────────────────────────────
     // Remind / recall (pending) and resubmit / recall (returned). These are the
-    // submitter's own levers, so `visible` gates on `submitter_id == ctx.user.id`
-    // — the current user is exposed via the console's predicate scope. The
-    // service re-checks ownership; the predicate keeps a non-submitter from ever
-    // seeing a button they cannot use.
+    // submitter's own levers, so `visible` gates on `record.viewer.is_submitter`
+    // (server-computed on the current viewer). The service re-checks ownership;
+    // the predicate keeps a non-submitter from ever seeing a button they cannot
+    // use.
     {
       name: "approval_remind",
       label: "Send reminder",
@@ -1148,7 +1157,7 @@ var SysApprovalRequest = ObjectSchema.create({
       params: [
         { name: "comment", label: "Note", type: "textarea", required: false }
       ],
-      visible: 'record.status == "pending" && record.submitter_id == ctx.user.id',
+      visible: 'record.status == "pending" && record.viewer.is_submitter',
       locations: ["record_section"],
       successMessage: "Reminder sent.",
       refreshAfter: true
@@ -1165,7 +1174,7 @@ var SysApprovalRequest = ObjectSchema.create({
       ],
       // Recall applies while the request is live for the submitter — pending
       // (withdraw) or returned (abandon the revision instead of resubmitting).
-      visible: '(record.status == "pending" || record.status == "returned") && record.submitter_id == ctx.user.id',
+      visible: '(record.status == "pending" || record.status == "returned") && record.viewer.is_submitter',
       confirmText: "Recall this request? Approvers can no longer act on it and the record is unlocked.",
       locations: ["record_section"],
       successMessage: "Recalled.",
@@ -1181,7 +1190,7 @@ var SysApprovalRequest = ObjectSchema.create({
       params: [
         { name: "comment", label: "What changed?", type: "textarea", required: false }
       ],
-      visible: 'record.status == "returned" && record.submitter_id == ctx.user.id',
+      visible: 'record.status == "returned" && record.viewer.is_submitter',
       locations: ["record_section"],
       successMessage: "Resubmitted.",
       refreshAfter: true
@@ -1319,7 +1328,7 @@ var SysApprovalApprover = ObjectSchema3.create({
   pluralLabel: "Approval Approvers",
   icon: "users",
   isSystem: true,
-  managedBy: "system",
+  managedBy: "engine-owned",
   description: "Normalized pending-approver rows for indexed inbox queries",
   displayNameField: "id",
   nameField: "id",
@@ -3328,6 +3337,7 @@ var _ApprovalService = class _ApprovalService {
     const rows = await this.engine.find("sys_approval_request", findOpts);
     const list = Array.isArray(rows) ? rows.map(rowFromRequest) : [];
     await this.enrichRows(list);
+    this.attachViewers(list, context);
     return list;
   }
   async countRequests(filter, context) {
@@ -3369,6 +3379,7 @@ var _ApprovalService = class _ApprovalService {
     await this.enrichRows([row]);
     await this.attachFlowSteps(row);
     await this.attachDecisionProgress(row, rows[0]);
+    this.attachViewers([row], context);
     return row;
   }
   /**
@@ -3416,6 +3427,25 @@ var _ApprovalService = class _ApprovalService {
     } catch {
     }
   }
+  /**
+   * Attach the per-viewer capability block (#3310) from the caller's context.
+   * `can_act` mirrors the exact authorization the decision methods enforce — the
+   * caller's user id is in the resolved `pending_approvers` while the request is
+   * still `pending` (position/team/manager approvers are already resolved to
+   * concrete user ids at open time, so a plain membership test is faithful).
+   * `is_submitter` is a straight owner check. System/tokenless contexts get a
+   * both-false block. Cheap + synchronous — safe on list reads.
+   */
+  attachViewers(rows, context) {
+    const uid2 = context?.userId != null ? String(context.userId) : null;
+    for (const row of rows) {
+      const pending = row.pending_approvers ?? [];
+      row.viewer = {
+        can_act: row.status === "pending" && !!uid2 && pending.includes(uid2),
+        is_submitter: !!uid2 && row.submitter_id != null && String(row.submitter_id) === uid2
+      };
+    }
+  }
   /**
    * Derive approval-step progress from the owning flow's graph (single-read
    * enrichment only — list reads skip it). Walks from the start node
@@ -3484,7 +3514,7 @@ var SysApprovalToken = ObjectSchema5.create({
   pluralLabel: "Approval Action Tokens",
   icon: "key",
   isSystem: true,
-  managedBy: "system",
+  managedBy: "engine-owned",
   description: "Single-use tokens behind actionable approval links",
   displayNameField: "id",
   nameField: "id",