@objectstack/plugin-approvals 17.0.0-rc.0 → 17.0.0-rc.2

package/src/sys-approval-request.object.ts

@@ -1,413 +0,0 @@
-// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
-
-import { ObjectSchema, Field } from '@objectstack/spec/data';
-
-/**
- * sys_approval_request — Live approval instance.
- *
- * ADR-0019: opened by a flow's **Approval node** when the run reaches it; the
- * run suspends until a decision is recorded. The row's lifecycle:
- *
- *   `pending` → (per-approver decisions) → `approved` | `rejected`
- *   `pending` → recalled by submitter → `recalled`
- *
- * `flow_run_id` / `flow_node_id` tie the request back to the suspended run so a
- * decision can resume it; `current_step` mirrors the node id. `node_config_json`
- * snapshots the Approval node config (approvers / behaviour) the request was
- * opened with.
- *
- * `payload_json` captures a snapshot of the target record at submission
- * time — used by notifications so they can render before the record is
- * locked or changed.
- *
- * @namespace sys
- */
-export const SysApprovalRequest = ObjectSchema.create({
-  name: 'sys_approval_request',
-  label: 'Approval Request',
-  pluralLabel: 'Approval Requests',
-  icon: 'inbox',
-  isSystem: true,
-  managedBy: 'engine-owned',
-  description: 'Live approval instance tracked per submission',
-  displayNameField: 'id',
-  nameField: 'id', // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
-  titleFormat: '{process_name} · {record_id}',
-  highlightFields: ['process_name', 'object_name', 'record_id', 'status', 'current_step', 'submitter_id', 'updated_at'],
-
-  // Curated built-in list views — render as segmented tabs in the console.
-  // Filters use {current_user_id} substitution wired by the console.
-  listViews: {
-    my_pending: {
-      type: 'grid',
-      name: 'my_pending',
-      label: 'My Pending',
-      data: { provider: 'object', object: 'sys_approval_request' },
-      columns: ['process_name', 'object_name', 'record_id', 'current_step', 'submitter_id', 'updated_at'],
-      filter: [
-        { field: 'status', operator: 'equals', value: 'pending' },
-        { field: 'pending_approvers', operator: 'contains', value: '{current_user_id}' },
-      ],
-      sort: [{ field: 'updated_at', order: 'desc' }],
-      pagination: { pageSize: 25 },
-      emptyState: { title: 'No pending approvals', message: 'You\'re all caught up.' },
-    },
-    submitted_by_me: {
-      type: 'grid',
-      name: 'submitted_by_me',
-      label: 'I Submitted',
-      data: { provider: 'object', object: 'sys_approval_request' },
-      columns: ['process_name', 'object_name', 'record_id', 'status', 'current_step', 'updated_at'],
-      filter: [{ field: 'submitter_id', operator: 'equals', value: '{current_user_id}' }],
-      sort: [{ field: 'updated_at', order: 'desc' }],
-      pagination: { pageSize: 25 },
-    },
-    completed: {
-      type: 'grid',
-      name: 'completed',
-      label: 'Completed',
-      data: { provider: 'object', object: 'sys_approval_request' },
-      columns: ['process_name', 'object_name', 'record_id', 'status', 'submitter_id', 'completed_at'],
-      filter: [{ field: 'status', operator: 'in', value: ['approved', 'rejected', 'recalled'] }],
-      sort: [{ field: 'completed_at', order: 'desc' }],
-      pagination: { pageSize: 25 },
-    },
-    all_requests: {
-      type: 'grid',
-      name: 'all_requests',
-      label: 'All',
-      data: { provider: 'object', object: 'sys_approval_request' },
-      columns: ['process_name', 'object_name', 'record_id', 'status', 'current_step', 'submitter_id', 'updated_at'],
-      sort: [{ field: 'updated_at', order: 'desc' }],
-      pagination: { pageSize: 50 },
-    },
-  },
-
-  fields: {
-    id: Field.text({ label: 'Request ID', required: true, readonly: true, group: 'System' }),
-
-    organization_id: Field.lookup('sys_organization', {
-      label: 'Organization',
-      required: false,
-      group: 'System',
-      description: 'Tenant that owns this approval request (propagated from submitter context)',
-    }),
-
-    process_name: Field.text({
-      label: 'Source',
-      required: true,
-      maxLength: 100,
-      description: 'Origin of the request — `flow:<flowName|nodeId>` for node-driven approvals',
-      group: 'Target',
-    }),
-
-    object_name: Field.text({
-      label: 'Object',
-      required: true,
-      maxLength: 100,
-      group: 'Target',
-    }),
-
-    record_id: Field.text({
-      label: 'Record ID',
-      required: true,
-      maxLength: 100,
-      group: 'Target',
-    }),
-
-    submitter_id: Field.lookup('sys_user', {
-      label: 'Submitter',
-      required: false,
-      group: 'Target',
-    }),
-
-    submitter_comment: Field.textarea({
-      label: 'Submitter Comment',
-      required: false,
-      group: 'Target',
-    }),
-
-    status: Field.select(
-      // Keep in sync with `ApprovalStatus` (spec/contracts). `returned` =
-      // sent back for revision (ADR-0044) — terminal for this round.
-      ['pending', 'approved', 'rejected', 'recalled', 'returned'],
-      {
-        label: 'Status',
-        required: true,
-        defaultValue: 'pending',
-        description: 'Lifecycle state of the request',
-        group: 'State',
-      },
-    ),
-
-    current_step: Field.text({
-      label: 'Current Step',
-      required: false,
-      maxLength: 100,
-      description: 'Machine name of the step awaiting approval',
-      group: 'State',
-    }),
-
-    current_step_index: Field.number({
-      label: 'Current Step Index',
-      required: false,
-      defaultValue: 0,
-      group: 'State',
-    }),
-
-    pending_approvers: Field.textarea({
-      label: 'Pending Approvers',
-      required: false,
-      description: 'Comma-separated user ids who can act on the current step',
-      group: 'State',
-    }),
-
-    payload_json: Field.textarea({
-      label: 'Snapshot',
-      required: false,
-      description: 'Record snapshot at submission time',
-      group: 'State',
-    }),
-
-    // ── ADR-0019: approval-as-flow-node correlation ──────────────────
-    // When a request is opened by an Approval *node* (rather than a standalone
-    // process), these tie it back to the suspended flow run so a decision can
-    // resume it. Null for legacy process-driven requests.
-    flow_run_id: Field.text({
-      label: 'Flow Run',
-      required: false,
-      maxLength: 100,
-      readonly: true,
-      description: 'Suspended automation run id this request gates (ADR-0019). The decision resumes it.',
-      group: 'State',
-    }),
-
-    flow_node_id: Field.text({
-      label: 'Flow Node',
-      required: false,
-      maxLength: 100,
-      readonly: true,
-      description: 'Approval node id within the flow that opened this request (ADR-0019).',
-      group: 'State',
-    }),
-
-    node_config_json: Field.textarea({
-      label: 'Node Config',
-      required: false,
-      readonly: true,
-      description: 'Snapshot of the Approval node config (approvers/behavior) for node-driven requests (ADR-0019).',
-      group: 'State',
-    }),
-
-    completed_at: Field.datetime({
-      label: 'Completed At',
-      required: false,
-      group: 'State',
-    }),
-
-    created_at: Field.datetime({
-      label: 'Created At',
-      required: true,
-      defaultValue: 'NOW()',
-      readonly: true,
-      group: 'System',
-    }),
-
-    updated_at: Field.datetime({ label: 'Updated At', required: false, group: 'System' }),
-  },
-
-  indexes: [
-    // Look up "is there a pending request for this record?" — common
-    // guard on submit and on edit-while-locked checks.
-    { fields: ['object_name', 'record_id'] },
-    { fields: ['status', 'object_name'] },
-    // Status-windowed listings (escalation sweep, "All" tab ordering).
-    // "My approvals" matching no longer scans this table: the service keeps
-    // a normalized per-approver index in `sys_approval_approver` (#1745) and
-    // resolves approver filters there; `pending_approvers` stays the
-    // human-readable CSV source of truth only.
-    { fields: ['status', 'updated_at'] },
-    { fields: ['submitter_id', 'status'] },
-  ],
-
-  // Server-declared decision actions (objectui#2678 P2-4). The console's
-  // generic action runtime renders and executes these wherever this object is
-  // surfaced — the approvals inbox included — so new decision capabilities
-  // (and their params) ship as metadata, not as hand-written buttons. Each
-  // targets the existing approvals REST route; `{id}` resolves from the row
-  // and `actorId` defaults to the caller server-side. The service remains the
-  // authority on who may act; `visible` gates on the server-computed
-  // per-viewer block (#3310): approver actions on `record.viewer.can_act`
-  // (the caller is a current pending approver — same check the service
-  // authorizes a decision with, so position/team approvers resolve correctly),
-  // submitter actions on `record.viewer.is_submitter`. The core decision levers
-  // (approve/reject/reassign) additionally OR in `record.viewer.can_override`
-  // (#3424) so a platform/tenant admin can rescue a request routed to an
-  // unstaffed position — otherwise undecidable, locking the record forever — by
-  // approving, rejecting, or reassigning it to a real approver. `viewer` is
-  // attached by getRequest/listRequests; where it is absent the predicate fails
-  // closed.
-  actions: [
-    {
-      name: 'approval_approve',
-      label: 'Approve',
-      icon: 'check-circle',
-      // Primary decision — the console renders this filled/highlighted so it
-      // stands out from the secondary levers in the drawer's action bar,
-      // matching the mobile card hierarchy (objectui#2762 P1-5).
-      variant: 'primary',
-      type: 'api',
-      method: 'POST',
-      target: '/api/v1/approvals/requests/{id}/approve',
-      params: [
-        { name: 'comment', label: 'Comment', type: 'textarea', required: false },
-        // Decision attachments (#3266). The console renders `type:'file'` params
-        // through the shared upload widget and POSTs the resolved `attachments:
-        // string[]`; the decision route persists them on `sys_approval_action`.
-        { name: 'attachments', label: 'Attachments', type: 'file', multiple: true, required: false },
-      ],
-      visible: 'record.viewer.can_act || record.viewer.can_override',
-      locations: ['record_section', 'list_item'],
-      successMessage: 'Approved.',
-      refreshAfter: true,
-    },
-    {
-      name: 'approval_reject',
-      label: 'Reject',
-      icon: 'x-circle',
-      // Destructive decision — rendered in the console's danger styling so it
-      // reads as the irreversible action it is (objectui#2762 P1-5).
-      variant: 'danger',
-      type: 'api',
-      method: 'POST',
-      target: '/api/v1/approvals/requests/{id}/reject',
-      params: [
-        { name: 'comment', label: 'Comment', type: 'textarea', required: false },
-        { name: 'attachments', label: 'Attachments', type: 'file', multiple: true, required: false },
-      ],
-      visible: 'record.viewer.can_act || record.viewer.can_override',
-      confirmText: 'Reject this request? A rejection is final for every approver.',
-      locations: ['record_section', 'list_item'],
-      successMessage: 'Rejected.',
-      refreshAfter: true,
-    },
-    {
-      name: 'approval_reassign',
-      label: 'Reassign',
-      icon: 'arrow-right-left',
-      type: 'api',
-      method: 'POST',
-      target: '/api/v1/approvals/requests/{id}/reassign',
-      params: [
-        // Field-backed on `submitter_id` (the object's only `sys_user` lookup):
-        // the console resolves its lookup config (`reference_to: sys_user`) so the
-        // dialog renders a real user picker, while `name: 'to'` overrides the
-        // request-body key to the `to` the reassign route expects. This is a
-        // config-borrow, not a submitter pre-fill (`defaultFromRow` stays off).
-        { field: 'submitter_id', name: 'to', label: 'New approver', required: true, helpText: 'User to hand this step to' },
-        { name: 'comment', label: 'Comment', type: 'textarea', required: false },
-      ],
-      visible: 'record.viewer.can_act || record.viewer.can_override',
-      locations: ['record_section'],
-      successMessage: 'Reassigned.',
-      refreshAfter: true,
-    },
-
-    // ── Approver secondary decisions ────────────────────────────────
-    // Send back for revision / request more info (ADR-0044). Both are approver
-    // actions, so `visible` gates on `record.viewer.can_act` (a current pending
-    // approver) — same as approve/reject. The service stays the authority.
-    {
-      name: 'approval_send_back',
-      label: 'Send back',
-      icon: 'corner-up-left',
-      type: 'api',
-      method: 'POST',
-      target: '/api/v1/approvals/requests/{id}/revise',
-      params: [
-        { name: 'comment', label: 'Reason', type: 'textarea', required: false },
-      ],
-      visible: 'record.viewer.can_act',
-      locations: ['record_section'],
-      successMessage: 'Sent back for revision.',
-      refreshAfter: true,
-    },
-    {
-      name: 'approval_request_info',
-      label: 'Request info',
-      icon: 'help-circle',
-      type: 'api',
-      method: 'POST',
-      target: '/api/v1/approvals/requests/{id}/request-info',
-      params: [
-        { name: 'comment', label: 'What do you need?', type: 'textarea', required: true },
-      ],
-      visible: 'record.viewer.can_act',
-      locations: ['record_section'],
-      successMessage: 'Information requested.',
-      refreshAfter: true,
-    },
-
-    // ── Submitter continuity actions ────────────────────────────────
-    // Remind / recall (pending) and resubmit / recall (returned). These are the
-    // submitter's own levers, so `visible` gates on `record.viewer.is_submitter`
-    // (server-computed on the current viewer). The service re-checks ownership;
-    // the predicate keeps a non-submitter from ever seeing a button they cannot
-    // use.
-    {
-      name: 'approval_remind',
-      label: 'Send reminder',
-      icon: 'bell-ring',
-      type: 'api',
-      method: 'POST',
-      target: '/api/v1/approvals/requests/{id}/remind',
-      params: [
-        { name: 'comment', label: 'Note', type: 'textarea', required: false },
-      ],
-      visible: 'record.status == "pending" && record.viewer.is_submitter',
-      locations: ['record_section'],
-      successMessage: 'Reminder sent.',
-      refreshAfter: true,
-    },
-    {
-      name: 'approval_recall',
-      label: 'Recall',
-      icon: 'undo-2',
-      type: 'api',
-      method: 'POST',
-      target: '/api/v1/approvals/requests/{id}/recall',
-      params: [
-        { name: 'comment', label: 'Comment', type: 'textarea', required: false },
-      ],
-      // Recall applies while the request is live for the submitter — pending
-      // (withdraw) or returned (abandon the revision instead of resubmitting).
-      visible: '(record.status == "pending" || record.status == "returned") && record.viewer.is_submitter',
-      confirmText: 'Recall this request? Approvers can no longer act on it and the record is unlocked.',
-      locations: ['record_section'],
-      successMessage: 'Recalled.',
-      refreshAfter: true,
-    },
-    {
-      name: 'approval_resubmit',
-      label: 'Resubmit',
-      icon: 'refresh-cw',
-      type: 'api',
-      method: 'POST',
-      target: '/api/v1/approvals/requests/{id}/resubmit',
-      params: [
-        { name: 'comment', label: 'What changed?', type: 'textarea', required: false },
-      ],
-      visible: 'record.status == "returned" && record.viewer.is_submitter',
-      locations: ['record_section'],
-      successMessage: 'Resubmitted.',
-      refreshAfter: true,
-    },
-  ],
-
-  enable: {
-    // [ADR-0103] Engine-owned: the approval engine owns the request lifecycle
-    // (SYSTEM_CTX); users act via domain actions (Submit/Approve/Recall), never
-    // generic CRUD. Reads stay open.
-    apiMethods: ['get', 'list'],
-  },
-});

package/src/sys-approval-token.object.ts

@@ -1,101 +0,0 @@
-// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
-
-import { ObjectSchema, Field } from '@objectstack/spec/data';
-
-/**
- * sys_approval_token — single-use actionable-link tokens (ADR-0043).
- *
- * One row per issued approve/reject link. Only the SHA-256 **hash** of the
- * raw token is stored — a database leak yields no usable links. A token is
- * dead once any of these holds: `consumed_at` set, `expires_at` passed, the
- * request left `pending`, or the bound approver no longer holds a slot
- * (the last two are re-checked at redemption, not materialized here).
- *
- * @namespace sys
- */
-export const SysApprovalToken = ObjectSchema.create({
-  name: 'sys_approval_token',
-  label: 'Approval Action Token',
-  pluralLabel: 'Approval Action Tokens',
-  icon: 'key',
-  isSystem: true,
-  managedBy: 'engine-owned',
-  description: 'Single-use tokens behind actionable approval links',
-  displayNameField: 'id',
-  nameField: 'id', // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
-
-  fields: {
-    id: Field.text({ label: 'Token ID', required: true, readonly: true, group: 'System' }),
-
-    organization_id: Field.lookup('sys_organization', {
-      label: 'Organization',
-      required: false,
-      group: 'System',
-    }),
-
-    token_hash: Field.text({
-      label: 'Token Hash',
-      required: true,
-      maxLength: 100,
-      readonly: true,
-      description: 'SHA-256 hex of the raw token — the raw value is never stored',
-      group: 'Token',
-    }),
-
-    request_id: Field.text({
-      label: 'Request',
-      required: true,
-      maxLength: 100,
-      readonly: true,
-      group: 'Token',
-    }),
-
-    action: Field.select(['approve', 'reject'], {
-      label: 'Action',
-      required: true,
-      readonly: true,
-      group: 'Token',
-    }),
-
-    approver_id: Field.text({
-      label: 'Approver',
-      required: true,
-      maxLength: 200,
-      readonly: true,
-      description: 'Identity the token is bound to; the decision is audited as this approver',
-      group: 'Token',
-    }),
-
-    expires_at: Field.datetime({
-      label: 'Expires At',
-      required: true,
-      readonly: true,
-      group: 'Lifecycle',
-    }),
-
-    consumed_at: Field.datetime({
-      label: 'Consumed At',
-      required: false,
-      group: 'Lifecycle',
-    }),
-
-    created_at: Field.datetime({
-      label: 'Created At',
-      required: true,
-      defaultValue: 'NOW()',
-      readonly: true,
-      group: 'System',
-    }),
-  },
-
-  indexes: [
-    { fields: ['token_hash'] },
-    { fields: ['request_id'] },
-  ],
-
-  enable: {
-    // [ADR-0103] Engine-owned: one-time email-approval tokens are minted and
-    // consumed by the approval engine (SYSTEM_CTX), never via the data API.
-    apiMethods: ['get', 'list'],
-  },
-});

package/src/translations/bundle-ownership.test.ts

@@ -1,48 +0,0 @@
-// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
-//
-// Bundle-ownership guard (#2834 ⑤ / ADR-0029 D8): this package's generated
-// object-translation bundles must carry ONLY objects its extract config
-// (`scripts/i18n-extract.config.ts`) actually imports. When an object moves to
-// another package, its translations move with it — a leftover copy here
-// silently DIES on the next `os i18n extract` run, taking curated translations
-// with it (the sys_audit_log incident). This test turns that silent loss into a
-// red build: an object present in the bundle but not in the ownership list below
-// means either (a) the extract config gained an object — add it here — or (b) a
-// moved/removed object's keys were left behind — remove them from the bundles
-// (or migrate them to the owning package), then keep this list in sync.
-//
-// NB: this package defines more approval objects (sys_approval_approver,
-// sys_approval_token) that the extract config deliberately does NOT translate —
-// they are absent from both the config and the bundles, so they are correctly
-// out of scope here.
-
-import { describe, it, expect } from 'vitest';
-import { enObjects } from './en.objects.generated.js';
-
-// Objects the extract config (scripts/i18n-extract.config.ts) imports —
-// keep the two lists in sync when adding/moving objects.
-const OWNED_OBJECTS = new Set([
-  'sys_approval_request',
-  'sys_approval_action',
-  'sys_approval_delegation',
-]);
-
-describe('objects translation bundle ownership (ADR-0029 D8)', () => {
-  it('the en bundle contains no objects owned by other packages', () => {
-    const strays = Object.keys(enObjects).filter((o) => !OWNED_OBJECTS.has(o));
-    expect(
-      strays,
-      `bundle carries objects this package's extract config does not own: ${strays.join(', ')} — ` +
-        'their curated translations would be silently deleted on the next `os i18n extract`. ' +
-        'Remove the dead block from the four locale bundles, or add the object to the extract config + this list.',
-    ).toEqual([]);
-  });
-
-  it('every owned object is present in the bundle (extract config regression)', () => {
-    const missing = [...OWNED_OBJECTS].filter((o) => !(o in enObjects));
-    expect(
-      missing,
-      `objects the extract config should emit are missing from the bundle: ${missing.join(', ')} — was an import dropped from scripts/i18n-extract.config.ts?`,
-    ).toEqual([]);
-  });
-});