@objectstack/plugin-approvals 16.1.0 → 17.0.0-rc.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-approvals",
-  "version": "16.1.0",
+  "version": "17.0.0-rc.0",
   "license": "Apache-2.0",
   "description": "Multi-step approval engine for ObjectStack — sys_approval_process + sys_approval_request + sys_approval_action + IApprovalService.",
   "main": "dist/index.js",
@@ -13,17 +13,19 @@
     }
   },
   "dependencies": {
-    "@objectstack/core": "16.1.0",
-    "@objectstack/formula": "16.1.0",
-    "@objectstack/metadata-core": "16.1.0",
-    "@objectstack/platform-objects": "16.1.0",
-    "@objectstack/spec": "16.1.0"
+    "@objectstack/core": "17.0.0-rc.0",
+    "@objectstack/formula": "17.0.0-rc.0",
+    "@objectstack/platform-objects": "17.0.0-rc.0",
+    "@objectstack/spec": "17.0.0-rc.0",
+    "@objectstack/metadata-core": "17.0.0-rc.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
-    "@objectstack/service-automation": "16.1.0"
+    "@objectstack/objectql": "17.0.0-rc.0",
+    "@objectstack/trigger-record-change": "17.0.0-rc.0",
+    "@objectstack/service-automation": "17.0.0-rc.0"
   },
   "keywords": [
     "objectstack",

package/scripts/i18n-extract.config.ts

@@ -8,8 +8,13 @@
  * strings were seeded from @objectstack/platform-objects.)
  *
  *   os i18n extract packages/plugins/plugin-approvals/scripts/i18n-extract.config.ts \
- *     --locales=zh-CN,ja-JP,es-ES --fill=default --objects-only \
+ *     --locales=zh-CN,ja-JP,es-ES --fill=default --objects-only --no-metadata-forms \
  *     --out=packages/plugins/plugin-approvals/src/translations
+ *
+ * `--no-metadata-forms` because the Studio metadata-form baseline is owned by
+ * `@objectstack/platform-objects` — this plugin translates only the objects it
+ * owns, so it must not commit a second copy. Add `--check` to run the same
+ * command as a drift gate.
  */
 
 import { defineStack } from '@objectstack/spec';

package/src/approval-actor-impersonation.test.ts

@@ -0,0 +1,330 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The acting identity on an approval is the AUTHENTICATED CALLER, never a
+ * request-body field.
+ *
+ * Every mutating entrypoint on the service takes an `actorId` and — before this
+ * suite — authorized *that value* rather than the caller behind it. The REST
+ * routes fill it from `body.actorId ?? body.actor_id ?? context.userId`, so the
+ * body won. An authenticated user could therefore name any pending approver and
+ * have that approver's decision recorded, finalized, and the owning flow resumed
+ * — or name a request's submitter and recall it.
+ *
+ * #3783 drew exactly this line for the *data-write* identity (see the
+ * `actingUserId` docblock in the service) and left the authorization side
+ * body-driven, calling a mislabelled audit row "tolerable". It is not merely a
+ * label: `pending_approvers.includes(input.actorId)` is the authorization gate
+ * itself, so naming someone else does not just misattribute the row — it is how
+ * you get through the door.
+ *
+ * The tests below are all "mallory is logged in, names someone else". Each one
+ * must be FORBIDDEN. The final block is the load-bearing negative: the two
+ * legitimate callers that supply an actor with no session behind them — the SLA
+ * sweep (a reserved sentinel) and the ADR-0043 action link (a single-use token
+ * cryptographically bound to one approver) — must keep working, or the fix has
+ * simply broken the feature instead of securing it.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import { ApprovalService, SLA_ACTOR_ID } from './approval-service.js';
+
+interface FakeRow { [k: string]: any }
+
+/** Equality/`$in`/`$ne`/`$contains` WHERE matcher — mirrors approval-service.test.ts. */
+function makeFakeEngine() {
+  const tables: Record<string, FakeRow[]> = {};
+  const ensure = (n: string) => (tables[n] ??= []);
+
+  function matches(row: FakeRow, filter: any): boolean {
+    if (!filter || typeof filter !== 'object') return true;
+    for (const [k, v] of Object.entries(filter)) {
+      if (k === '$or') {
+        if (!(v as any[]).some(sub => matches(row, sub))) return false;
+        continue;
+      }
+      const rv = row[k];
+      if (v != null && typeof v === 'object' && '$in' in (v as any)) {
+        if (!(v as any).$in.includes(rv)) return false;
+        continue;
+      }
+      if (v != null && typeof v === 'object' && '$ne' in (v as any)) {
+        if (rv === (v as any).$ne) return false;
+        continue;
+      }
+      if (v != null && typeof v === 'object' && '$contains' in (v as any)) {
+        if (!String(rv ?? '').includes(String((v as any).$contains))) return false;
+        continue;
+      }
+      if (rv !== v) return false;
+    }
+    return true;
+  }
+
+  return {
+    _tables: tables,
+    async find(object: string, options?: any) {
+      const rows = ensure(object).filter(r => matches(r, options?.filter ?? options?.where));
+      if (options?.orderBy?.[0]) {
+        const { field, order } = options.orderBy[0];
+        rows.sort((a, b) => {
+          const av = a[field]; const bv = b[field];
+          if (av === bv) return 0;
+          const cmp = av > bv ? 1 : -1;
+          return order === 'desc' ? -cmp : cmp;
+        });
+      }
+      const start = options?.offset ?? 0;
+      return rows.slice(start, start + (options?.limit ?? 1000));
+    },
+    async insert(object: string, data: any) {
+      ensure(object).push({ ...data });
+      return { ...data };
+    },
+    async update(object: string, idOrData: any, _opts?: any) {
+      const data = typeof idOrData === 'object' ? idOrData : _opts;
+      const id = typeof idOrData === 'object' ? idOrData.id : idOrData;
+      const table = ensure(object);
+      const i = table.findIndex(r => r.id === id);
+      if (i >= 0) table[i] = { ...table[i], ...data };
+      return table[i];
+    },
+    async delete(object: string, options?: any) {
+      const table = ensure(object);
+      const id = options?.where?.id ?? options?.id;
+      const i = table.findIndex(r => r.id === id);
+      if (i >= 0) table.splice(i, 1);
+      return { id };
+    },
+    registerHook() {},
+    unregisterHooksByPackage() { return 0; },
+  };
+}
+
+/** The submitter, and the approver whose slot is up for grabs. */
+const SUBMITTER = 'alice';
+const APPROVER = 'bob';
+/** Authenticated, ordinary, and on neither side of the request. */
+const MALLORY = { userId: 'mallory', tenantId: 't1', positions: [], permissions: [] } as any;
+const ALICE = { userId: SUBMITTER, tenantId: 't1', positions: [], permissions: [] } as any;
+const SYS = { isSystem: true, positions: [], permissions: [] } as any;
+
+function nodeConfig(approvers: string[], extra: Record<string, any> = {}) {
+  return {
+    approvers: approvers.map(v => ({ type: 'user' as const, value: v })),
+    behavior: 'first_response' as const,
+    ...extra,
+  };
+}
+
+function openInput(approvers: string[], extra: Record<string, any> = {}, configExtra: Record<string, any> = {}) {
+  return {
+    object: 'opportunity',
+    recordId: 'opp1',
+    runId: 'run_1',
+    nodeId: 'approve_step',
+    flowName: 'deal_approval',
+    config: nodeConfig(approvers, configExtra),
+    record: { id: 'opp1', amount: 100 },
+    ...extra,
+  };
+}
+
+/**
+ * Enough automation surface for the send-back path's ADR-0044 guards to pass,
+ * so a `sendBack` / `resubmit` test fails on the ACTOR check or not at all —
+ * never on a missing `revise` out-edge.
+ */
+function makeAutomationStub() {
+  const resumed: any[] = [];
+  const cancelled: string[] = [];
+  return {
+    resumed,
+    cancelled,
+    async getFlow() {
+      return {
+        name: 'deal_approval',
+        nodes: [{ id: 'approve_step', type: 'approval' }, { id: 'wait_revision', type: 'wait' }],
+        edges: [
+          { id: 'e1', source: 'approve_step', target: 'ok', label: 'approve' },
+          { id: 'e2', source: 'approve_step', target: 'no', label: 'reject' },
+          { id: 'e3', source: 'approve_step', target: 'wait_revision', label: 'revise' },
+          { id: 'e4', source: 'wait_revision', target: 'approve_step', label: 'resubmit', type: 'back' },
+        ],
+      };
+    },
+    async resume(runId: string, signal: any) { resumed.push({ runId, signal }); },
+    async cancelRun(runId: string) { cancelled.push(runId); },
+  };
+}
+
+describe('approvals: the actor is the authenticated caller, not a body field', () => {
+  let engine: ReturnType<typeof makeFakeEngine>;
+  let svc: ApprovalService;
+  let n = 0;
+  const baseTime = new Date('2026-01-15T10:00:00Z').getTime();
+
+  beforeEach(() => {
+    engine = makeFakeEngine();
+    n = 0;
+    svc = new ApprovalService({
+      engine: engine as any,
+      clock: { now: () => new Date(baseTime + (n++) * 1000) },
+    });
+  });
+
+  /** Open a request submitted by alice and pending on bob. */
+  const open = (approvers = [APPROVER], configExtra: Record<string, any> = {}) =>
+    svc.openNodeRequest(openInput(approvers, {}, configExtra), ALICE);
+
+  // ── the decision itself ─────────────────────────────────────────
+
+  it('decideNode: mallory cannot approve by naming the pending approver', async () => {
+    const req = await open();
+    await expect(
+      svc.decideNode(req.id, { decision: 'approve', actorId: APPROVER }, MALLORY),
+    ).rejects.toThrow(/FORBIDDEN/);
+  });
+
+  it('decideNode: a refused impersonation writes no audit row and leaves the request pending', async () => {
+    const req = await open();
+    await expect(
+      svc.decideNode(req.id, { decision: 'approve', actorId: APPROVER }, MALLORY),
+    ).rejects.toThrow(/FORBIDDEN/);
+
+    const decisions = (engine._tables['sys_approval_action'] ?? [])
+      .filter((a: any) => a.action === 'approve' || a.action === 'reject');
+    expect(decisions).toHaveLength(0);
+    expect(engine._tables['sys_approval_request'][0].status).toBe('pending');
+  });
+
+  it('decideNode: mallory cannot reject by naming the pending approver', async () => {
+    const req = await open();
+    await expect(
+      svc.decideNode(req.id, { decision: 'reject', actorId: APPROVER, comment: 'no' }, MALLORY),
+    ).rejects.toThrow(/FORBIDDEN/);
+  });
+
+  it('decide: the flow is not resumed by an impersonated decision', async () => {
+    const resumed: any[] = [];
+    svc.attachAutomation({ async resume(runId: string, signal: any) { resumed.push({ runId, signal }); } } as any);
+    const req = await open();
+    await expect(
+      svc.decide(req.id, { decision: 'approve', actorId: APPROVER }, MALLORY),
+    ).rejects.toThrow(/FORBIDDEN/);
+    expect(resumed).toHaveLength(0);
+  });
+
+  it('decideNode: a unanimous slate cannot be filled by one user naming the others', async () => {
+    const req = await open(['bob', 'carol'], { behavior: 'unanimous' });
+    const asBob = { userId: 'bob', tenantId: 't1', positions: [], permissions: [] } as any;
+    const first = await svc.decideNode(req.id, { decision: 'approve', actorId: 'bob' }, asBob);
+    expect(first.finalized).toBe(false);
+    // Bob holds a slot, so he clears the "is a pending approver" gate — but the
+    // slot he clears it with is his own, not carol's.
+    await expect(
+      svc.decideNode(req.id, { decision: 'approve', actorId: 'carol' }, asBob),
+    ).rejects.toThrow(/FORBIDDEN/);
+    expect(engine._tables['sys_approval_request'][0].status).toBe('pending');
+  });
+
+  // ── the submitter-only moves ────────────────────────────────────
+
+  it('recall: mallory cannot withdraw the request by naming its submitter', async () => {
+    const req = await open();
+    await expect(
+      svc.recall(req.id, { actorId: SUBMITTER, comment: 'gone' }, MALLORY),
+    ).rejects.toThrow(/FORBIDDEN/);
+    expect(engine._tables['sys_approval_request'][0].status).toBe('pending');
+  });
+
+  it('resubmit: mallory cannot resubmit a returned request by naming its submitter', async () => {
+    svc.attachAutomation(makeAutomationStub() as any);
+    const req = await open();
+    const asBob = { userId: APPROVER, tenantId: 't1', positions: [], permissions: [] } as any;
+    await svc.sendBack(req.id, { actorId: APPROVER, comment: 'fix it' }, asBob);
+    expect(engine._tables['sys_approval_request'][0].status).toBe('returned');
+    await expect(
+      svc.resubmit(req.id, { actorId: SUBMITTER, comment: 'done' }, MALLORY),
+    ).rejects.toThrow(/FORBIDDEN/);
+  });
+
+  it('sendBack: mallory cannot return the request by naming the pending approver', async () => {
+    const req = await open();
+    await expect(
+      svc.sendBack(req.id, { actorId: APPROVER, comment: 'revise' }, MALLORY),
+    ).rejects.toThrow(/FORBIDDEN/);
+    expect(engine._tables['sys_approval_request'][0].status).toBe('pending');
+  });
+
+  // ── the thread moves ────────────────────────────────────────────
+
+  it('reassign: mallory cannot move the slot by naming its holder', async () => {
+    const req = await open();
+    await expect(
+      svc.reassign(req.id, { actorId: APPROVER, to: 'mallory' }, MALLORY),
+    ).rejects.toThrow(/FORBIDDEN/);
+    expect(engine._tables['sys_approval_request'][0].pending_approvers).toBe(APPROVER);
+  });
+
+  it('requestInfo: mallory cannot post as the pending approver', async () => {
+    const req = await open();
+    await expect(
+      svc.requestInfo(req.id, { actorId: APPROVER, comment: 'send the contract' }, MALLORY),
+    ).rejects.toThrow(/FORBIDDEN/);
+  });
+
+  it('comment: mallory cannot post to the thread as the submitter', async () => {
+    const req = await open();
+    await expect(
+      svc.comment(req.id, { actorId: SUBMITTER, comment: 'looks fine to me' }, MALLORY),
+    ).rejects.toThrow(/FORBIDDEN/);
+  });
+
+  it('remind: mallory cannot nudge as the submitter', async () => {
+    const req = await open();
+    await expect(
+      svc.remind(req.id, { actorId: SUBMITTER }, MALLORY),
+    ).rejects.toThrow(/FORBIDDEN/);
+  });
+
+  // ── the legitimate paths must survive ───────────────────────────
+  //
+  // Without these, "reject every actorId that isn't the caller" would pass the
+  // suite above by breaking the SLA sweep and the emailed action link — the two
+  // callers that hold a trustworthy actor with no session behind it.
+
+  it('the real approver still decides their own slot', async () => {
+    const req = await open();
+    const asBob = { userId: APPROVER, tenantId: 't1', positions: [], permissions: [] } as any;
+    const out = await svc.decideNode(req.id, { decision: 'approve', actorId: APPROVER }, asBob);
+    expect(out.finalized).toBe(true);
+    expect(out.request.status).toBe('approved');
+    const row = (engine._tables['sys_approval_action'] ?? []).find((a: any) => a.action === 'approve');
+    expect(row.actor_id).toBe(APPROVER);
+  });
+
+  it('the real submitter still recalls their own request', async () => {
+    const req = await open();
+    const out = await svc.recall(req.id, { actorId: SUBMITTER }, ALICE);
+    expect(out.request.status).toBe('recalled');
+  });
+
+  it('a system context may still name an actor with no session behind it (SLA sweep)', async () => {
+    const req = await open();
+    const out = await svc.decideNode(req.id, { decision: 'approve', actorId: SLA_ACTOR_ID }, SYS);
+    expect(out.finalized).toBe(true);
+    const row = (engine._tables['sys_approval_action'] ?? []).find((a: any) => a.action === 'approve');
+    expect(row.actor_id).toBe(SLA_ACTOR_ID);
+  });
+
+  it('a privileged admin may still override a stuck request', async () => {
+    const req = await open(['position:cfo']);
+    const admin = {
+      userId: 'root', tenantId: 't1', positions: [], permissions: ['admin_full_access'],
+    } as any;
+    const out = await svc.decideNode(req.id, { decision: 'approve', actorId: 'root' }, admin);
+    expect(out.finalized).toBe(true);
+    expect(out.request.status).toBe('approved');
+  });
+});

package/src/approval-node.test.ts

@@ -154,6 +154,46 @@ describe('Approval node bridge (ADR-0019)', () => {
     expect(paused.runId).toBeDefined();
   });
 
+  // ── resume authorization gate (#3801) ───────────────────────────────
+  //
+  // `POST /automation/:name/runs/:runId/resume` reaches
+  // `AutomationEngine.resume` with a caller-supplied signal. Before the gate,
+  // the only thing between that route and the approvals rules was convention —
+  // a comment in the showcase. These pin the enforcement.
+
+  it('declares the approval node resumable only by its owning service', () => {
+    const approval = automation.getActionDescriptors().find(d => d.type === 'approval');
+    expect(approval!.resumeAuthority).toBe('service');
+  });
+
+  it('refuses a raw engine resume of an approval pause, leaving the request untouched', async () => {
+    registerDecisionFlow(automation, [{ type: 'user', value: 'u1' }]);
+    const paused = await automation.execute('deal_approval', {
+      object: 'crm_deal', record: { id: 'd1' }, userId: 'submitter',
+    });
+    const request = (await fake.find('sys_approval_request', { where: { status: 'pending' } }))[0];
+
+    // Exactly the signal the resume route builds from `{ branchLabel }`.
+    const refused = await automation.resume(paused.runId!, {
+      branchLabel: 'approve', output: { decision: 'approve' },
+    });
+
+    expect(refused).toMatchObject({ success: false, code: 'forbidden' });
+    // The approve branch did NOT run…
+    expect(marks).toHaveLength(0);
+    // …the request is still pending, with no decision recorded…
+    const stillPending = (await fake.find('sys_approval_request', { where: { id: request.id } }))[0];
+    expect(stillPending.status).toBe('pending');
+    const actions = await fake.find('sys_approval_action', { where: { request_id: request.id } });
+    expect(actions.map((a: any) => a.action)).toEqual(['submit']);
+    // …and the run is still parked, so the real decision can still land.
+    expect(automation.listSuspendedRuns()).toHaveLength(1);
+
+    const out = await service.decide(request.id, { decision: 'approve', actorId: 'u1' }, SYSTEM_CTX);
+    expect(out).toMatchObject({ finalized: true, resumed: true });
+    expect(marks).toEqual(['on_approved']);
+  });
+
   it('resumes down the reject branch on rejection', async () => {
     registerDecisionFlow(automation, [{ type: 'user', value: 'u1' }]);
     await automation.execute('deal_approval', { object: 'crm_deal', record: { id: 'd1' } });
@@ -193,4 +233,124 @@ describe('Approval node bridge (ADR-0019)', () => {
       service.decideNode(request.id, { decision: 'approve', actorId: 'intruder' }, { isSystem: false, positions: [], permissions: [] } as any),
     ).rejects.toThrow(/FORBIDDEN/);
   });
+
+  // ── #3447 P2: dynamic approvers end-to-end ────────────────────────
+  //
+  // The issue's headline scenario as one flow: the first approver PICKS the
+  // next step's approvers in their decision, the next approval node resolves
+  // them from `vars.*` at entry — no record-field detour, no snapshot staleness.
+
+  it('decide outputs feed the NEXT approval node via vars.<nodeId>.<key> (#3447 P2)', async () => {
+    automation.registerFlow('two_stage', {
+      name: 'two_stage',
+      label: 'Two Stage',
+      type: 'autolaunched',
+      nodes: [
+        { id: 'start', type: 'start', label: 'Start' },
+        {
+          id: 'lead_review', type: 'approval', label: 'Lead Review',
+          config: { approvers: [{ type: 'user', value: 'lead' }], decisionOutputs: ['next_reviewers'] },
+        },
+        {
+          id: 'co_sign', type: 'approval', label: 'Co-sign',
+          config: {
+            approvers: [{ type: 'expression', value: 'vars.lead_review.next_reviewers' }],
+            behavior: 'unanimous',
+          },
+        },
+        { id: 'on_approved', type: 'mark', label: 'Approved' },
+        { id: 'on_rejected', type: 'mark', label: 'Rejected' },
+      ],
+      edges: [
+        { id: 'e1', source: 'start', target: 'lead_review' },
+        { id: 'e2', source: 'lead_review', target: 'co_sign', label: 'approve' },
+        { id: 'e3', source: 'lead_review', target: 'on_rejected', label: 'reject' },
+        { id: 'e4', source: 'co_sign', target: 'on_approved', label: 'approve' },
+        { id: 'e5', source: 'co_sign', target: 'on_rejected', label: 'reject' },
+      ],
+    });
+
+    const paused = await automation.execute('two_stage', {
+      object: 'crm_deal', record: { id: 'd1' }, userId: 'submitter',
+    });
+    expect(paused.status).toBe('paused');
+
+    // The lead approves AND hands the co-reviewers to the flow.
+    const first = (await fake.find('sys_approval_request', { where: { status: 'pending' } }))[0];
+    await service.decide(first.id, {
+      decision: 'approve', actorId: 'lead', outputs: { next_reviewers: ['u2', 'u3'] },
+    }, SYSTEM_CTX);
+
+    // The co-sign node resolved its slate from the lead's decision outputs.
+    const second = (await fake.find('sys_approval_request', { where: { status: 'pending' } }))[0];
+    expect(second).toBeDefined();
+    expect(second.flow_node_id).toBe('co_sign');
+    expect(String(second.pending_approvers).split(',').sort()).toEqual(['u2', 'u3']);
+    expect(marks).toHaveLength(0);
+
+    // Both picked reviewers sign off → the run completes down `approve`.
+    await service.decide(second.id, { decision: 'approve', actorId: 'u2' }, SYSTEM_CTX);
+    await service.decide(second.id, { decision: 'approve', actorId: 'u3' }, SYSTEM_CTX);
+    expect(marks).toEqual(['on_approved']);
+    expect(automation.listSuspendedRuns()).toHaveLength(0);
+  });
+
+  it('expression current.* resolves against the LIVE row at node entry (#3447 P2)', async () => {
+    fake.tables.set('crm_deal', [{ id: 'd1', reviewers: ['u7', 'u8'] }]);
+    registerDecisionFlow(automation, [{ type: 'expression', value: 'current.reviewers' }], 'unanimous');
+    // The trigger snapshot carries an EMPTY reviewers field — only the live
+    // row names them, exactly the mid-flow-written-field shape of the issue.
+    await automation.execute('deal_approval', {
+      object: 'crm_deal', record: { id: 'd1', reviewers: [] }, userId: 'submitter',
+    });
+    const request = (await fake.find('sys_approval_request', { where: { status: 'pending' } }))[0];
+    expect(String(request.pending_approvers).split(',').sort()).toEqual(['u7', 'u8']);
+  });
+
+  it("onEmptyApprovers 'auto_approve' completes down the approve edge without suspending (#3447 P2)", async () => {
+    automation.registerFlow('auto_ok', {
+      name: 'auto_ok',
+      label: 'Auto OK',
+      type: 'autolaunched',
+      nodes: [
+        { id: 'start', type: 'start', label: 'Start' },
+        {
+          id: 'gate', type: 'approval', label: 'Gate',
+          config: {
+            // Present-but-empty (a missing key would fail loudly instead).
+            approvers: [{ type: 'expression', value: 'trigger.reviewers' }],
+            onEmptyApprovers: 'auto_approve',
+          },
+        },
+        { id: 'on_approved', type: 'mark', label: 'Approved' },
+        { id: 'on_rejected', type: 'mark', label: 'Rejected' },
+      ],
+      edges: [
+        { id: 'e1', source: 'start', target: 'gate' },
+        { id: 'e2', source: 'gate', target: 'on_approved', label: 'approve' },
+        { id: 'e3', source: 'gate', target: 'on_rejected', label: 'reject' },
+      ],
+    });
+
+    const result = await automation.execute('auto_ok', {
+      object: 'crm_deal', record: { id: 'd1', reviewers: [] }, userId: 'submitter',
+    });
+
+    // No pause, no request row — the empty slate waved through, down `approve`
+    // ONLY (the branchLabel wiring; unlabelled traversal would hit both marks).
+    expect(result.status).not.toBe('paused');
+    expect(marks).toEqual(['on_approved']);
+    expect(await fake.find('sys_approval_request', {})).toHaveLength(0);
+    expect(automation.listSuspendedRuns()).toHaveLength(0);
+  });
+
+  it('an expression referencing `record` fails the node loudly, not as an empty slate (#3447 P2)', async () => {
+    registerDecisionFlow(automation, [{ type: 'expression', value: 'record.reviewers' }]);
+    const result = await automation.execute('deal_approval', {
+      object: 'crm_deal', record: { id: 'd1', reviewers: ['u1'] }, userId: 'submitter',
+    });
+    expect(result.success).toBe(false);
+    expect(String(result.error ?? '')).toMatch(/current\.<field>|current\./);
+    expect(await fake.find('sys_approval_request', {})).toHaveLength(0);
+  });
 });

package/src/approval-node.ts

@@ -38,6 +38,12 @@ export interface ApprovalAutomationSurface {
       error?: string;
       suspend?: boolean;
       correlation?: string;
+      /**
+       * #3447 P2: walk this labelled out-edge on normal (non-suspend)
+       * completion — how an `onEmptyApprovers: 'auto_approve'` node continues
+       * down `approve` without a decision. Mirrors NodeExecutionResult.
+       */
+      branchLabel?: string;
     }>;
   }): void;
   resume?(runId: string, signal?: { output?: Record<string, unknown>; branchLabel?: string }): Promise<unknown>;
@@ -50,6 +56,29 @@ interface MinimalLogger {
 
 const SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] } as const;
 
+/**
+ * Rebuild the nested object the engine's CEL conditions see from the flow's
+ * flat variable Map — dotted keys (`get_rec.record`) become nested paths, so an
+ * `expression` approver's `vars.get_rec.record.owner_id` reads exactly like a
+ * condition's. Mirrors the engine's own evaluateCondition rebuild; kept local
+ * because this plugin deliberately does not depend on service-automation.
+ */
+function nestVariables(variables: Map<string, unknown>): Record<string, unknown> {
+  const vars: Record<string, unknown> = {};
+  for (const [key, value] of variables) {
+    const segs = key.split('.');
+    let cursor = vars;
+    for (let i = 0; i < segs.length - 1; i++) {
+      if (typeof cursor[segs[i]] !== 'object' || cursor[segs[i]] === null) {
+        cursor[segs[i]] = {};
+      }
+      cursor = cursor[segs[i]] as Record<string, unknown>;
+    }
+    cursor[segs[segs.length - 1]] = value;
+  }
+  return vars;
+}
+
 /**
  * Register the `approval` node executor on the automation engine. Idempotent at
  * the engine level (re-registering replaces). Safe to skip when no automation
@@ -75,6 +104,15 @@ export function registerApprovalNode(
       // Human decision: the run suspends here awaiting an external reply.
       supportsPause: true,
       isAsync: true,
+      // #3801: this pause is NOT resumable through the generic run-resume
+      // route. Continuing an approval is a side effect of a DECISION, and the
+      // decision is the thing that must be authorized (the approver slate),
+      // recorded (`sys_approval_action`) and mirrored (the status field) —
+      // all of which lives in `ApprovalService.decide`. The engine now refuses
+      // any resume of an approval suspension that does not carry the service's
+      // in-process marker, so "decide via the approvals API, never a raw engine
+      // resume" is enforced rather than merely documented.
+      resumeAuthority: 'service',
       // Publish the node's config contract (ADR-0018 §configSchema) so the
       // Studio flow designer renders the Approval property form from the engine
       // rather than a hardcoded client form — the engine owns the shape.
@@ -116,6 +154,10 @@ export function registerApprovalNode(
           submitterId: context?.userId ?? null,
           record,
           organizationId: context?.organizationId ?? context?.tenantId ?? null,
+          // #3447 P2: flow variables (nested, as CEL conditions see them) — the
+          // `vars.*` root for `expression` approvers; `record` above doubles as
+          // their `trigger.*` snapshot root.
+          variables: nestVariables(variables),
         }, {
           ...SYSTEM_CTX,
           userId: context?.userId,
@@ -123,6 +165,21 @@ export function registerApprovalNode(
           tenantId: context?.tenantId,
         } as unknown as SharingExecutionContext);
 
+        // #3447 P2: empty slate + onEmptyApprovers: 'auto_approve' — nobody to
+        // ask, no request row. Complete (don't suspend) straight down the
+        // `approve` edge; `autoApproved` on the output keeps the waved-through
+        // hop distinguishable from a human decision in the run trace.
+        if ('autoApproved' in request) {
+          logger?.info?.('[approvals] approval node auto-approved (empty approver slate)', {
+            node: node.id, run: String(runId),
+          });
+          return {
+            success: true,
+            branchLabel: 'approve',
+            output: { decision: 'approve', autoApproved: true },
+          };
+        }
+
         logger?.info?.('[approvals] approval node suspended run', {
           node: node.id, request: request.id, run: String(runId),
         });