@objectstack/plugin-approvals 16.0.0-rc.0 → 16.0.0

package/dist/index.d.ts

@@ -220,7 +220,7 @@ declare const SysApprovalRequest: Omit<{
     pluralLabel?: string | undefined;
     description?: string | undefined;
     icon?: string | undefined;
-    managedBy?: "platform" | "system" | "config" | "append-only" | "better-auth" | undefined;
+    managedBy?: "platform" | "system" | "config" | "engine-owned" | "append-only" | "better-auth" | undefined;
     ownership?: "none" | "org" | "user" | undefined;
     userActions?: {
         create?: boolean | undefined;
@@ -418,7 +418,7 @@ declare const SysApprovalRequest: Omit<{
         }[] | undefined;
         filter?: {
             field: string;
-            operator: string;
+            operator: "in" | "contains" | "after" | "starts_with" | "ends_with" | "not_in" | "not_contains" | "between" | "is_null" | "is_not_null" | "is_empty" | "is_not_empty" | "equals" | "not_equals" | "greater_than" | "less_than" | "greater_than_or_equal" | "less_than_or_equal" | "before";
             value?: string | number | boolean | (string | number)[] | null | undefined;
         }[] | undefined;
         description?: string | undefined;
@@ -577,7 +577,7 @@ declare const SysApprovalRequest: Omit<{
             view?: string | undefined;
             filter?: {
                 field: string;
-                operator: string;
+                operator: "in" | "contains" | "after" | "starts_with" | "ends_with" | "not_in" | "not_contains" | "between" | "is_null" | "is_not_null" | "is_empty" | "is_not_empty" | "equals" | "not_equals" | "greater_than" | "less_than" | "greater_than_or_equal" | "less_than_or_equal" | "before";
                 value?: string | number | boolean | (string | number)[] | null | undefined;
             }[] | undefined;
             order?: number | undefined;
@@ -833,7 +833,7 @@ declare const SysApprovalRequest: Omit<{
     readonly pluralLabel: "Approval Requests";
     readonly icon: "inbox";
     readonly isSystem: true;
-    readonly managedBy: "system";
+    readonly managedBy: "engine-owned";
     readonly description: "Live approval instance tracked per submission";
     readonly displayNameField: "id";
     readonly nameField: "id";
@@ -3349,8 +3349,14 @@ declare const SysApprovalRequest: Omit<{
             readonly label: "Comment";
             readonly type: "textarea";
             readonly required: false;
+        }, {
+            readonly name: "attachments";
+            readonly label: "Attachments";
+            readonly type: "file";
+            readonly multiple: true;
+            readonly required: false;
         }];
-        readonly visible: "record.status == \"pending\"";
+        readonly visible: "record.viewer.can_act";
         readonly locations: ["record_section", "list_item"];
         readonly successMessage: "Approved.";
         readonly refreshAfter: true;
@@ -3366,8 +3372,14 @@ declare const SysApprovalRequest: Omit<{
             readonly label: "Comment";
             readonly type: "textarea";
             readonly required: false;
+        }, {
+            readonly name: "attachments";
+            readonly label: "Attachments";
+            readonly type: "file";
+            readonly multiple: true;
+            readonly required: false;
         }];
-        readonly visible: "record.status == \"pending\"";
+        readonly visible: "record.viewer.can_act";
         readonly confirmText: "Reject this request? A rejection is final for every approver.";
         readonly locations: ["record_section", "list_item"];
         readonly successMessage: "Rejected.";
@@ -3391,7 +3403,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: false;
         }];
-        readonly visible: "record.status == \"pending\"";
+        readonly visible: "record.viewer.can_act";
         readonly locations: ["record_section"];
         readonly successMessage: "Reassigned.";
         readonly refreshAfter: true;
@@ -3408,7 +3420,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: false;
         }];
-        readonly visible: "record.status == \"pending\"";
+        readonly visible: "record.viewer.can_act";
         readonly locations: ["record_section"];
         readonly successMessage: "Sent back for revision.";
         readonly refreshAfter: true;
@@ -3425,7 +3437,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: true;
         }];
-        readonly visible: "record.status == \"pending\"";
+        readonly visible: "record.viewer.can_act";
         readonly locations: ["record_section"];
         readonly successMessage: "Information requested.";
         readonly refreshAfter: true;
@@ -3442,7 +3454,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: false;
         }];
-        readonly visible: "record.status == \"pending\" && record.submitter_id == ctx.user.id";
+        readonly visible: "record.status == \"pending\" && record.viewer.is_submitter";
         readonly locations: ["record_section"];
         readonly successMessage: "Reminder sent.";
         readonly refreshAfter: true;
@@ -3459,7 +3471,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: false;
         }];
-        readonly visible: "(record.status == \"pending\" || record.status == \"returned\") && record.submitter_id == ctx.user.id";
+        readonly visible: "(record.status == \"pending\" || record.status == \"returned\") && record.viewer.is_submitter";
         readonly confirmText: "Recall this request? Approvers can no longer act on it and the record is unlocked.";
         readonly locations: ["record_section"];
         readonly successMessage: "Recalled.";
@@ -3477,7 +3489,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: false;
         }];
-        readonly visible: "record.status == \"returned\" && record.submitter_id == ctx.user.id";
+        readonly visible: "record.status == \"returned\" && record.viewer.is_submitter";
         readonly locations: ["record_section"];
         readonly successMessage: "Resubmitted.";
         readonly refreshAfter: true;
@@ -3694,7 +3706,7 @@ declare const SysApprovalAction: Omit<{
     pluralLabel?: string | undefined;
     description?: string | undefined;
     icon?: string | undefined;
-    managedBy?: "platform" | "system" | "config" | "append-only" | "better-auth" | undefined;
+    managedBy?: "platform" | "system" | "config" | "engine-owned" | "append-only" | "better-auth" | undefined;
     ownership?: "none" | "org" | "user" | undefined;
     userActions?: {
         create?: boolean | undefined;
@@ -3892,7 +3904,7 @@ declare const SysApprovalAction: Omit<{
         }[] | undefined;
         filter?: {
             field: string;
-            operator: string;
+            operator: "in" | "contains" | "after" | "starts_with" | "ends_with" | "not_in" | "not_contains" | "between" | "is_null" | "is_not_null" | "is_empty" | "is_not_empty" | "equals" | "not_equals" | "greater_than" | "less_than" | "greater_than_or_equal" | "less_than_or_equal" | "before";
             value?: string | number | boolean | (string | number)[] | null | undefined;
         }[] | undefined;
         description?: string | undefined;
@@ -4051,7 +4063,7 @@ declare const SysApprovalAction: Omit<{
             view?: string | undefined;
             filter?: {
                 field: string;
-                operator: string;
+                operator: "in" | "contains" | "after" | "starts_with" | "ends_with" | "not_in" | "not_contains" | "between" | "is_null" | "is_not_null" | "is_empty" | "is_not_empty" | "equals" | "not_equals" | "greater_than" | "less_than" | "greater_than_or_equal" | "less_than_or_equal" | "before";
                 value?: string | number | boolean | (string | number)[] | null | undefined;
             }[] | undefined;
             order?: number | undefined;
@@ -5940,7 +5952,7 @@ declare const SysApprovalApprover: Omit<{
     pluralLabel?: string | undefined;
     description?: string | undefined;
     icon?: string | undefined;
-    managedBy?: "platform" | "system" | "config" | "append-only" | "better-auth" | undefined;
+    managedBy?: "platform" | "system" | "config" | "engine-owned" | "append-only" | "better-auth" | undefined;
     ownership?: "none" | "org" | "user" | undefined;
     userActions?: {
         create?: boolean | undefined;
@@ -6138,7 +6150,7 @@ declare const SysApprovalApprover: Omit<{
         }[] | undefined;
         filter?: {
             field: string;
-            operator: string;
+            operator: "in" | "contains" | "after" | "starts_with" | "ends_with" | "not_in" | "not_contains" | "between" | "is_null" | "is_not_null" | "is_empty" | "is_not_empty" | "equals" | "not_equals" | "greater_than" | "less_than" | "greater_than_or_equal" | "less_than_or_equal" | "before";
             value?: string | number | boolean | (string | number)[] | null | undefined;
         }[] | undefined;
         description?: string | undefined;
@@ -6297,7 +6309,7 @@ declare const SysApprovalApprover: Omit<{
             view?: string | undefined;
             filter?: {
                 field: string;
-                operator: string;
+                operator: "in" | "contains" | "after" | "starts_with" | "ends_with" | "not_in" | "not_contains" | "between" | "is_null" | "is_not_null" | "is_empty" | "is_not_empty" | "equals" | "not_equals" | "greater_than" | "less_than" | "greater_than_or_equal" | "less_than_or_equal" | "before";
                 value?: string | number | boolean | (string | number)[] | null | undefined;
             }[] | undefined;
             order?: number | undefined;
@@ -6553,7 +6565,7 @@ declare const SysApprovalApprover: Omit<{
     readonly pluralLabel: "Approval Approvers";
     readonly icon: "users";
     readonly isSystem: true;
-    readonly managedBy: "system";
+    readonly managedBy: "engine-owned";
     readonly description: "Normalized pending-approver rows for indexed inbox queries";
     readonly displayNameField: "id";
     readonly nameField: "id";
@@ -7457,7 +7469,7 @@ declare const SysApprovalDelegation: Omit<{
     pluralLabel?: string | undefined;
     description?: string | undefined;
     icon?: string | undefined;
-    managedBy?: "platform" | "system" | "config" | "append-only" | "better-auth" | undefined;
+    managedBy?: "platform" | "system" | "config" | "engine-owned" | "append-only" | "better-auth" | undefined;
     ownership?: "none" | "org" | "user" | undefined;
     userActions?: {
         create?: boolean | undefined;
@@ -7655,7 +7667,7 @@ declare const SysApprovalDelegation: Omit<{
         }[] | undefined;
         filter?: {
             field: string;
-            operator: string;
+            operator: "in" | "contains" | "after" | "starts_with" | "ends_with" | "not_in" | "not_contains" | "between" | "is_null" | "is_not_null" | "is_empty" | "is_not_empty" | "equals" | "not_equals" | "greater_than" | "less_than" | "greater_than_or_equal" | "less_than_or_equal" | "before";
             value?: string | number | boolean | (string | number)[] | null | undefined;
         }[] | undefined;
         description?: string | undefined;
@@ -7814,7 +7826,7 @@ declare const SysApprovalDelegation: Omit<{
             view?: string | undefined;
             filter?: {
                 field: string;
-                operator: string;
+                operator: "in" | "contains" | "after" | "starts_with" | "ends_with" | "not_in" | "not_contains" | "between" | "is_null" | "is_not_null" | "is_empty" | "is_not_empty" | "equals" | "not_equals" | "greater_than" | "less_than" | "greater_than_or_equal" | "less_than_or_equal" | "before";
                 value?: string | number | boolean | (string | number)[] | null | undefined;
             }[] | undefined;
             order?: number | undefined;
@@ -9780,6 +9792,16 @@ declare class ApprovalService implements IApprovalService {
      * Display-only and best-effort — errors leave the row untouched.
      */
     private attachDecisionProgress;
+    /**
+     * Attach the per-viewer capability block (#3310) from the caller's context.
+     * `can_act` mirrors the exact authorization the decision methods enforce — the
+     * caller's user id is in the resolved `pending_approvers` while the request is
+     * still `pending` (position/team/manager approvers are already resolved to
+     * concrete user ids at open time, so a plain membership test is faithful).
+     * `is_submitter` is a straight owner check. System/tokenless contexts get a
+     * both-false block. Cheap + synchronous — safe on list reads.
+     */
+    private attachViewers;
     /**
      * Derive approval-step progress from the owning flow's graph (single-read
      * enrichment only — list reads skip it). Walks from the start node

package/dist/index.js

@@ -880,7 +880,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
   pluralLabel: "Approval Requests",
   icon: "inbox",
   isSystem: true,
-  managedBy: "system",
+  managedBy: "engine-owned",
   description: "Live approval instance tracked per submission",
   displayNameField: "id",
   nameField: "id",
@@ -1068,8 +1068,12 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
   // (and their params) ship as metadata, not as hand-written buttons. Each
   // targets the existing approvals REST route; `{id}` resolves from the row
   // and `actorId` defaults to the caller server-side. The service remains the
-  // authority on who may act (pending-approver check) — `visible` only trims
-  // the obvious non-pending case.
+  // authority on who may act; `visible` gates on the server-computed
+  // per-viewer block (#3310): approver actions on `record.viewer.can_act`
+  // (the caller is a current pending approver — same check the service
+  // authorizes a decision with, so position/team approvers resolve correctly),
+  // submitter actions on `record.viewer.is_submitter`. `viewer` is attached by
+  // getRequest/listRequests; where it is absent the predicate fails closed.
   actions: [
     {
       name: "approval_approve",
@@ -1079,9 +1083,13 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       method: "POST",
       target: "/api/v1/approvals/requests/{id}/approve",
       params: [
-        { name: "comment", label: "Comment", type: "textarea", required: false }
+        { name: "comment", label: "Comment", type: "textarea", required: false },
+        // Decision attachments (#3266). The console renders `type:'file'` params
+        // through the shared upload widget and POSTs the resolved `attachments:
+        // string[]`; the decision route persists them on `sys_approval_action`.
+        { name: "attachments", label: "Attachments", type: "file", multiple: true, required: false }
       ],
-      visible: 'record.status == "pending"',
+      visible: "record.viewer.can_act",
       locations: ["record_section", "list_item"],
       successMessage: "Approved.",
       refreshAfter: true
@@ -1094,9 +1102,10 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       method: "POST",
       target: "/api/v1/approvals/requests/{id}/reject",
       params: [
-        { name: "comment", label: "Comment", type: "textarea", required: false }
+        { name: "comment", label: "Comment", type: "textarea", required: false },
+        { name: "attachments", label: "Attachments", type: "file", multiple: true, required: false }
       ],
-      visible: 'record.status == "pending"',
+      visible: "record.viewer.can_act",
       confirmText: "Reject this request? A rejection is final for every approver.",
       locations: ["record_section", "list_item"],
       successMessage: "Rejected.",
@@ -1118,15 +1127,15 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
         { field: "submitter_id", name: "to", label: "New approver", required: true, helpText: "User to hand this step to" },
         { name: "comment", label: "Comment", type: "textarea", required: false }
       ],
-      visible: 'record.status == "pending"',
+      visible: "record.viewer.can_act",
       locations: ["record_section"],
       successMessage: "Reassigned.",
       refreshAfter: true
     },
     // ── Approver secondary decisions ────────────────────────────────
     // Send back for revision / request more info (ADR-0044). Both are approver
-    // actions on a pending request; the service is the authority on who may act,
-    // so `visible` only trims the non-pending case (matching approve/reject).
+    // actions, so `visible` gates on `record.viewer.can_act` (a current pending
+    // approver) — same as approve/reject. The service stays the authority.
     {
       name: "approval_send_back",
       label: "Send back",
@@ -1137,7 +1146,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       params: [
         { name: "comment", label: "Reason", type: "textarea", required: false }
       ],
-      visible: 'record.status == "pending"',
+      visible: "record.viewer.can_act",
       locations: ["record_section"],
       successMessage: "Sent back for revision.",
       refreshAfter: true
@@ -1152,17 +1161,17 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       params: [
         { name: "comment", label: "What do you need?", type: "textarea", required: true }
       ],
-      visible: 'record.status == "pending"',
+      visible: "record.viewer.can_act",
       locations: ["record_section"],
       successMessage: "Information requested.",
       refreshAfter: true
     },
     // ── Submitter continuity actions ────────────────────────────────
     // Remind / recall (pending) and resubmit / recall (returned). These are the
-    // submitter's own levers, so `visible` gates on `submitter_id == ctx.user.id`
-    // — the current user is exposed via the console's predicate scope. The
-    // service re-checks ownership; the predicate keeps a non-submitter from ever
-    // seeing a button they cannot use.
+    // submitter's own levers, so `visible` gates on `record.viewer.is_submitter`
+    // (server-computed on the current viewer). The service re-checks ownership;
+    // the predicate keeps a non-submitter from ever seeing a button they cannot
+    // use.
     {
       name: "approval_remind",
       label: "Send reminder",
@@ -1173,7 +1182,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       params: [
         { name: "comment", label: "Note", type: "textarea", required: false }
       ],
-      visible: 'record.status == "pending" && record.submitter_id == ctx.user.id',
+      visible: 'record.status == "pending" && record.viewer.is_submitter',
       locations: ["record_section"],
       successMessage: "Reminder sent.",
       refreshAfter: true
@@ -1190,7 +1199,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       ],
       // Recall applies while the request is live for the submitter — pending
       // (withdraw) or returned (abandon the revision instead of resubmitting).
-      visible: '(record.status == "pending" || record.status == "returned") && record.submitter_id == ctx.user.id',
+      visible: '(record.status == "pending" || record.status == "returned") && record.viewer.is_submitter',
       confirmText: "Recall this request? Approvers can no longer act on it and the record is unlocked.",
       locations: ["record_section"],
       successMessage: "Recalled.",
@@ -1206,7 +1215,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       params: [
         { name: "comment", label: "What changed?", type: "textarea", required: false }
       ],
-      visible: 'record.status == "returned" && record.submitter_id == ctx.user.id',
+      visible: 'record.status == "returned" && record.viewer.is_submitter',
       locations: ["record_section"],
       successMessage: "Resubmitted.",
       refreshAfter: true
@@ -1344,7 +1353,7 @@ var SysApprovalApprover = import_data3.ObjectSchema.create({
   pluralLabel: "Approval Approvers",
   icon: "users",
   isSystem: true,
-  managedBy: "system",
+  managedBy: "engine-owned",
   description: "Normalized pending-approver rows for indexed inbox queries",
   displayNameField: "id",
   nameField: "id",
@@ -3350,6 +3359,7 @@ var _ApprovalService = class _ApprovalService {
     const rows = await this.engine.find("sys_approval_request", findOpts);
     const list = Array.isArray(rows) ? rows.map(rowFromRequest) : [];
     await this.enrichRows(list);
+    this.attachViewers(list, context);
     return list;
   }
   async countRequests(filter, context) {
@@ -3391,6 +3401,7 @@ var _ApprovalService = class _ApprovalService {
     await this.enrichRows([row]);
     await this.attachFlowSteps(row);
     await this.attachDecisionProgress(row, rows[0]);
+    this.attachViewers([row], context);
     return row;
   }
   /**
@@ -3438,6 +3449,25 @@ var _ApprovalService = class _ApprovalService {
     } catch {
     }
   }
+  /**
+   * Attach the per-viewer capability block (#3310) from the caller's context.
+   * `can_act` mirrors the exact authorization the decision methods enforce — the
+   * caller's user id is in the resolved `pending_approvers` while the request is
+   * still `pending` (position/team/manager approvers are already resolved to
+   * concrete user ids at open time, so a plain membership test is faithful).
+   * `is_submitter` is a straight owner check. System/tokenless contexts get a
+   * both-false block. Cheap + synchronous — safe on list reads.
+   */
+  attachViewers(rows, context) {
+    const uid2 = context?.userId != null ? String(context.userId) : null;
+    for (const row of rows) {
+      const pending = row.pending_approvers ?? [];
+      row.viewer = {
+        can_act: row.status === "pending" && !!uid2 && pending.includes(uid2),
+        is_submitter: !!uid2 && row.submitter_id != null && String(row.submitter_id) === uid2
+      };
+    }
+  }
   /**
    * Derive approval-step progress from the owning flow's graph (single-read
    * enrichment only — list reads skip it). Walks from the start node
@@ -3506,7 +3536,7 @@ var SysApprovalToken = import_data5.ObjectSchema.create({
   pluralLabel: "Approval Action Tokens",
   icon: "key",
   isSystem: true,
-  managedBy: "system",
+  managedBy: "engine-owned",
   description: "Single-use tokens behind actionable approval links",
   displayNameField: "id",
   nameField: "id",