@objectstack/plugin-approvals 17.0.0-rc.0 → 17.0.0-rc.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-approvals",
-  "version": "17.0.0-rc.0",
+  "version": "17.0.0-rc.2",
   "license": "Apache-2.0",
   "description": "Multi-step approval engine for ObjectStack — sys_approval_process + sys_approval_request + sys_approval_action + IApprovalService.",
   "main": "dist/index.js",
@@ -13,19 +13,20 @@
     }
   },
   "dependencies": {
-    "@objectstack/core": "17.0.0-rc.0",
-    "@objectstack/formula": "17.0.0-rc.0",
-    "@objectstack/platform-objects": "17.0.0-rc.0",
-    "@objectstack/spec": "17.0.0-rc.0",
-    "@objectstack/metadata-core": "17.0.0-rc.0"
+    "@objectstack/core": "17.0.0-rc.2",
+    "@objectstack/formula": "17.0.0-rc.2",
+    "@objectstack/metadata-core": "17.0.0-rc.2",
+    "@objectstack/platform-objects": "17.0.0-rc.2",
+    "@objectstack/spec": "17.0.0-rc.2",
+    "@objectstack/types": "17.0.0-rc.2"
   },
   "devDependencies": {
-    "@types/node": "^26.1.1",
+    "@types/node": "^26.1.2",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
-    "@objectstack/objectql": "17.0.0-rc.0",
-    "@objectstack/trigger-record-change": "17.0.0-rc.0",
-    "@objectstack/service-automation": "17.0.0-rc.0"
+    "@objectstack/objectql": "17.0.0-rc.2",
+    "@objectstack/service-automation": "17.0.0-rc.2",
+    "@objectstack/trigger-record-change": "17.0.0-rc.2"
   },
   "keywords": [
     "objectstack",
@@ -34,8 +35,14 @@
     "workflow",
     "process"
   ],
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md"
+  ],
   "scripts": {
     "build": "tsup --config ../../../tsup.config.ts",
+    "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests"
   }
 }

package/.turbo/turbo-build.log

@@ -1,22 +0,0 @@
-
-> @objectstack/plugin-approvals@17.0.0-rc.0 build /home/runner/work/objectstack/objectstack/packages/plugins/plugin-approvals
-> tsup --config ../../../tsup.config.ts
-
-CLI Building entry: src/index.ts
-CLI Using tsconfig: tsconfig.json
-CLI tsup v8.5.1
-CLI Using tsup config: /home/runner/work/objectstack/objectstack/tsup.config.ts
-CLI Target: es2020
-CLI Cleaning output folder
-ESM Build start
-CJS Build start
-ESM dist/index.mjs     221.37 KB
-ESM dist/index.mjs.map 393.68 KB
-ESM ⚡️ Build success in 287ms
-CJS dist/index.js     223.23 KB
-CJS dist/index.js.map 394.99 KB
-CJS ⚡️ Build success in 297ms
-DTS Build start
-DTS ⚡️ Build success in 7923ms
-DTS dist/index.d.mts 434.23 KB
-DTS dist/index.d.ts  434.23 KB

package/scripts/i18n-extract.config.ts

@@ -1,38 +0,0 @@
-// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
-
-/**
- * Build-time only config for `os i18n extract` (ADR-0029 D8). Not deployed.
- * The plugin owns the i18n extraction for the objects it owns; the
- * `translations` baseline is this plugin's OWN generated bundles so re-running
- * `--merge` preserves every hand-translated string. (Initial zh-CN/ja-JP/es-ES
- * strings were seeded from @objectstack/platform-objects.)
- *
- *   os i18n extract packages/plugins/plugin-approvals/scripts/i18n-extract.config.ts \
- *     --locales=zh-CN,ja-JP,es-ES --fill=default --objects-only --no-metadata-forms \
- *     --out=packages/plugins/plugin-approvals/src/translations
- *
- * `--no-metadata-forms` because the Studio metadata-form baseline is owned by
- * `@objectstack/platform-objects` — this plugin translates only the objects it
- * owns, so it must not commit a second copy. Add `--check` to run the same
- * command as a drift gate.
- */
-
-import { defineStack } from '@objectstack/spec';
-import { SysApprovalRequest } from '../src/sys-approval-request.object.js';
-import { SysApprovalAction } from '../src/sys-approval-action.object.js';
-import { SysApprovalDelegation } from '../src/sys-approval-delegation.object.js';
-import { enObjects } from '../src/translations/en.objects.generated.js';
-import { zhCNObjects } from '../src/translations/zh-CN.objects.generated.js';
-import { jaJPObjects } from '../src/translations/ja-JP.objects.generated.js';
-import { esESObjects } from '../src/translations/es-ES.objects.generated.js';
-
-export default defineStack({
-  name: 'plugin-approvals-i18n-extract',
-  objects: [SysApprovalRequest, SysApprovalAction, SysApprovalDelegation] as any,
-  translations: [
-    { en: { objects: enObjects } },
-    { 'zh-CN': { objects: zhCNObjects } },
-    { 'ja-JP': { objects: jaJPObjects } },
-    { 'es-ES': { objects: esESObjects } },
-  ],
-});

package/src/action-link-pages.ts

@@ -1,102 +0,0 @@
-// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
-
-/**
- * Session-less HTML for the actionable-link confirm/result pages (ADR-0043).
- *
- * Deliberately tiny and dependency-free: these pages are reached from an
- * email or IM message by a bearer with no session, so they must not assume
- * the Console bundle, auth state, or client-side i18n. Static bilingual
- * (EN / 中文) copy keeps them readable for the demo audience without a
- * locale negotiation step.
- *
- * The GET page NEVER mutates — the decision happens only on the POST form
- * submit (mail-gateway link prefetchers must not approve requests).
- */
-
-import type { ApprovalRequestRow, ApprovalActionKind } from '@objectstack/spec/contracts';
-
-function esc(s: unknown): string {
-  return String(s ?? '')
-    .replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;')
-    .replaceAll('"', '&quot;').replaceAll("'", '&#39;');
-}
-
-function shell(title: string, body: string): string {
-  return `<!doctype html>
-<html lang="en"><head><meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<meta name="robots" content="noindex">
-<title>${esc(title)}</title>
-<style>
-  body{font:15px/1.6 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"PingFang SC","Microsoft YaHei",sans-serif;
-       background:#f6f7f9;color:#1a202c;margin:0;display:flex;min-height:100vh;align-items:center;justify-content:center}
-  .card{background:#fff;border:1px solid #e2e8f0;border-radius:12px;max-width:440px;width:calc(100% - 32px);
-        padding:28px 32px;box-shadow:0 1px 3px rgba(0,0,0,.06)}
-  h1{font-size:18px;margin:0 0 4px}
-  .sub{color:#64748b;font-size:13px;margin:0 0 20px}
-  .row{display:flex;justify-content:space-between;gap:12px;padding:7px 0;border-bottom:1px solid #f1f5f9;font-size:14px}
-  .row b{font-weight:600;text-align:right}
-  .k{color:#64748b}
-  .actions{margin-top:22px;display:flex;gap:10px}
-  button{flex:1;padding:10px 16px;border-radius:8px;border:1px solid transparent;font-size:15px;font-weight:600;cursor:pointer}
-  .approve{background:#059669;color:#fff}
-  .reject{background:#fff;color:#dc2626;border-color:#fca5a5}
-  .badge{display:inline-block;padding:2px 10px;border-radius:999px;font-size:12px;font-weight:600;margin-bottom:14px}
-  .ok{background:#ecfdf5;color:#047857}.warn{background:#fffbeb;color:#b45309}.err{background:#fef2f2;color:#b91c1c}
-  a{color:#2563eb;text-decoration:none}
-  .foot{margin-top:18px;font-size:12px;color:#94a3b8}
-</style></head><body><div class="card">${body}</div></body></html>`;
-}
-
-function summaryRows(req: ApprovalRequestRow): string {
-  const rows: Array<[string, string]> = [
-    ['Process · 流程', req.process_label || req.process_name],
-    ['Step · 步骤', req.step_label || req.current_step || '—'],
-    ['Record · 记录', req.record_title || req.record_id],
-    ['Object · 对象', req.object_label || req.object_name],
-    ['Requester · 申请人', req.submitter_name || req.submitter_id || '—'],
-  ];
-  return rows.map(([k, v]) => `<div class="row"><span class="k">${esc(k)}</span><b>${esc(v)}</b></div>`).join('');
-}
-
-/** GET page: summary + a POST form. Rendering only — no mutation. */
-export function renderConfirmPage(input: {
-  request: ApprovalRequestRow;
-  action: Extract<ApprovalActionKind, 'approve' | 'reject'>;
-  approverId: string;
-  token: string;
-  actPath: string;
-}): string {
-  const approving = input.action === 'approve';
-  const verb = approving ? 'Approve · 通过' : 'Reject · 拒绝';
-  return shell(`${verb} — Approval`, `
-    <h1>${approving ? '✅ Approve this request?' : '⛔ Reject this request?'}</h1>
-    <p class="sub">${approving ? '确认通过该审批请求？' : '确认拒绝该审批请求？'}
-      Acting as · 操作身份：<b>${esc(input.approverId)}</b></p>
-    ${summaryRows(input.request)}
-    <form method="post" action="${esc(input.actPath)}" class="actions">
-      <input type="hidden" name="token" value="${esc(input.token)}">
-      <button type="submit" class="${approving ? 'approve' : 'reject'}">${verb}</button>
-    </form>
-    <p class="foot">This link is single-use and expires automatically. · 此链接一次有效，过期自动失效。</p>`);
-}
-
-const RESULT_COPY: Record<string, { cls: string; title: string; body: string }> = {
-  approved:     { cls: 'ok',   title: '✅ Approved · 已通过',  body: 'The decision was recorded. · 审批结果已记录。' },
-  rejected:     { cls: 'ok',   title: '⛔ Rejected · 已拒绝',  body: 'The decision was recorded. · 审批结果已记录。' },
-  invalid:      { cls: 'err',  title: 'Invalid link · 链接无效', body: 'This link is not recognized. · 无法识别该链接。' },
-  expired:      { cls: 'warn', title: 'Link expired · 链接已过期', body: 'Ask the requester to send a new reminder. · 请让申请人重新发送催办。' },
-  consumed:     { cls: 'warn', title: 'Already used · 链接已使用', body: 'This link was already used once. · 该链接已被使用过。' },
-  not_pending:  { cls: 'warn', title: 'Already decided · 请求已处理', body: 'This request is no longer pending. · 该请求已不在待审批状态。' },
-  not_approver: { cls: 'warn', title: 'No longer your approval · 已不在你名下', body: 'This approval was handed to someone else. · 该审批已转由他人处理。' },
-};
-
-/** Terminal page for every redemption outcome (and stale GETs). */
-export function renderResultPage(kind: keyof typeof RESULT_COPY, request?: ApprovalRequestRow): string {
-  const copy = RESULT_COPY[kind] ?? RESULT_COPY.invalid;
-  return shell(copy.title, `
-    <span class="badge ${copy.cls}">${esc(copy.title)}</span>
-    ${request ? summaryRows(request) : ''}
-    <p>${esc(copy.body)}</p>
-    <p class="foot"><a href="/system/approvals">Open the Approvals Inbox · 打开审批中心</a></p>`);
-}

package/src/approval-actor-impersonation.test.ts

@@ -1,330 +0,0 @@
-// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
-
-/**
- * The acting identity on an approval is the AUTHENTICATED CALLER, never a
- * request-body field.
- *
- * Every mutating entrypoint on the service takes an `actorId` and — before this
- * suite — authorized *that value* rather than the caller behind it. The REST
- * routes fill it from `body.actorId ?? body.actor_id ?? context.userId`, so the
- * body won. An authenticated user could therefore name any pending approver and
- * have that approver's decision recorded, finalized, and the owning flow resumed
- * — or name a request's submitter and recall it.
- *
- * #3783 drew exactly this line for the *data-write* identity (see the
- * `actingUserId` docblock in the service) and left the authorization side
- * body-driven, calling a mislabelled audit row "tolerable". It is not merely a
- * label: `pending_approvers.includes(input.actorId)` is the authorization gate
- * itself, so naming someone else does not just misattribute the row — it is how
- * you get through the door.
- *
- * The tests below are all "mallory is logged in, names someone else". Each one
- * must be FORBIDDEN. The final block is the load-bearing negative: the two
- * legitimate callers that supply an actor with no session behind them — the SLA
- * sweep (a reserved sentinel) and the ADR-0043 action link (a single-use token
- * cryptographically bound to one approver) — must keep working, or the fix has
- * simply broken the feature instead of securing it.
- */
-
-import { describe, it, expect, beforeEach } from 'vitest';
-import { ApprovalService, SLA_ACTOR_ID } from './approval-service.js';
-
-interface FakeRow { [k: string]: any }
-
-/** Equality/`$in`/`$ne`/`$contains` WHERE matcher — mirrors approval-service.test.ts. */
-function makeFakeEngine() {
-  const tables: Record<string, FakeRow[]> = {};
-  const ensure = (n: string) => (tables[n] ??= []);
-
-  function matches(row: FakeRow, filter: any): boolean {
-    if (!filter || typeof filter !== 'object') return true;
-    for (const [k, v] of Object.entries(filter)) {
-      if (k === '$or') {
-        if (!(v as any[]).some(sub => matches(row, sub))) return false;
-        continue;
-      }
-      const rv = row[k];
-      if (v != null && typeof v === 'object' && '$in' in (v as any)) {
-        if (!(v as any).$in.includes(rv)) return false;
-        continue;
-      }
-      if (v != null && typeof v === 'object' && '$ne' in (v as any)) {
-        if (rv === (v as any).$ne) return false;
-        continue;
-      }
-      if (v != null && typeof v === 'object' && '$contains' in (v as any)) {
-        if (!String(rv ?? '').includes(String((v as any).$contains))) return false;
-        continue;
-      }
-      if (rv !== v) return false;
-    }
-    return true;
-  }
-
-  return {
-    _tables: tables,
-    async find(object: string, options?: any) {
-      const rows = ensure(object).filter(r => matches(r, options?.filter ?? options?.where));
-      if (options?.orderBy?.[0]) {
-        const { field, order } = options.orderBy[0];
-        rows.sort((a, b) => {
-          const av = a[field]; const bv = b[field];
-          if (av === bv) return 0;
-          const cmp = av > bv ? 1 : -1;
-          return order === 'desc' ? -cmp : cmp;
-        });
-      }
-      const start = options?.offset ?? 0;
-      return rows.slice(start, start + (options?.limit ?? 1000));
-    },
-    async insert(object: string, data: any) {
-      ensure(object).push({ ...data });
-      return { ...data };
-    },
-    async update(object: string, idOrData: any, _opts?: any) {
-      const data = typeof idOrData === 'object' ? idOrData : _opts;
-      const id = typeof idOrData === 'object' ? idOrData.id : idOrData;
-      const table = ensure(object);
-      const i = table.findIndex(r => r.id === id);
-      if (i >= 0) table[i] = { ...table[i], ...data };
-      return table[i];
-    },
-    async delete(object: string, options?: any) {
-      const table = ensure(object);
-      const id = options?.where?.id ?? options?.id;
-      const i = table.findIndex(r => r.id === id);
-      if (i >= 0) table.splice(i, 1);
-      return { id };
-    },
-    registerHook() {},
-    unregisterHooksByPackage() { return 0; },
-  };
-}
-
-/** The submitter, and the approver whose slot is up for grabs. */
-const SUBMITTER = 'alice';
-const APPROVER = 'bob';
-/** Authenticated, ordinary, and on neither side of the request. */
-const MALLORY = { userId: 'mallory', tenantId: 't1', positions: [], permissions: [] } as any;
-const ALICE = { userId: SUBMITTER, tenantId: 't1', positions: [], permissions: [] } as any;
-const SYS = { isSystem: true, positions: [], permissions: [] } as any;
-
-function nodeConfig(approvers: string[], extra: Record<string, any> = {}) {
-  return {
-    approvers: approvers.map(v => ({ type: 'user' as const, value: v })),
-    behavior: 'first_response' as const,
-    ...extra,
-  };
-}
-
-function openInput(approvers: string[], extra: Record<string, any> = {}, configExtra: Record<string, any> = {}) {
-  return {
-    object: 'opportunity',
-    recordId: 'opp1',
-    runId: 'run_1',
-    nodeId: 'approve_step',
-    flowName: 'deal_approval',
-    config: nodeConfig(approvers, configExtra),
-    record: { id: 'opp1', amount: 100 },
-    ...extra,
-  };
-}
-
-/**
- * Enough automation surface for the send-back path's ADR-0044 guards to pass,
- * so a `sendBack` / `resubmit` test fails on the ACTOR check or not at all —
- * never on a missing `revise` out-edge.
- */
-function makeAutomationStub() {
-  const resumed: any[] = [];
-  const cancelled: string[] = [];
-  return {
-    resumed,
-    cancelled,
-    async getFlow() {
-      return {
-        name: 'deal_approval',
-        nodes: [{ id: 'approve_step', type: 'approval' }, { id: 'wait_revision', type: 'wait' }],
-        edges: [
-          { id: 'e1', source: 'approve_step', target: 'ok', label: 'approve' },
-          { id: 'e2', source: 'approve_step', target: 'no', label: 'reject' },
-          { id: 'e3', source: 'approve_step', target: 'wait_revision', label: 'revise' },
-          { id: 'e4', source: 'wait_revision', target: 'approve_step', label: 'resubmit', type: 'back' },
-        ],
-      };
-    },
-    async resume(runId: string, signal: any) { resumed.push({ runId, signal }); },
-    async cancelRun(runId: string) { cancelled.push(runId); },
-  };
-}
-
-describe('approvals: the actor is the authenticated caller, not a body field', () => {
-  let engine: ReturnType<typeof makeFakeEngine>;
-  let svc: ApprovalService;
-  let n = 0;
-  const baseTime = new Date('2026-01-15T10:00:00Z').getTime();
-
-  beforeEach(() => {
-    engine = makeFakeEngine();
-    n = 0;
-    svc = new ApprovalService({
-      engine: engine as any,
-      clock: { now: () => new Date(baseTime + (n++) * 1000) },
-    });
-  });
-
-  /** Open a request submitted by alice and pending on bob. */
-  const open = (approvers = [APPROVER], configExtra: Record<string, any> = {}) =>
-    svc.openNodeRequest(openInput(approvers, {}, configExtra), ALICE);
-
-  // ── the decision itself ─────────────────────────────────────────
-
-  it('decideNode: mallory cannot approve by naming the pending approver', async () => {
-    const req = await open();
-    await expect(
-      svc.decideNode(req.id, { decision: 'approve', actorId: APPROVER }, MALLORY),
-    ).rejects.toThrow(/FORBIDDEN/);
-  });
-
-  it('decideNode: a refused impersonation writes no audit row and leaves the request pending', async () => {
-    const req = await open();
-    await expect(
-      svc.decideNode(req.id, { decision: 'approve', actorId: APPROVER }, MALLORY),
-    ).rejects.toThrow(/FORBIDDEN/);
-
-    const decisions = (engine._tables['sys_approval_action'] ?? [])
-      .filter((a: any) => a.action === 'approve' || a.action === 'reject');
-    expect(decisions).toHaveLength(0);
-    expect(engine._tables['sys_approval_request'][0].status).toBe('pending');
-  });
-
-  it('decideNode: mallory cannot reject by naming the pending approver', async () => {
-    const req = await open();
-    await expect(
-      svc.decideNode(req.id, { decision: 'reject', actorId: APPROVER, comment: 'no' }, MALLORY),
-    ).rejects.toThrow(/FORBIDDEN/);
-  });
-
-  it('decide: the flow is not resumed by an impersonated decision', async () => {
-    const resumed: any[] = [];
-    svc.attachAutomation({ async resume(runId: string, signal: any) { resumed.push({ runId, signal }); } } as any);
-    const req = await open();
-    await expect(
-      svc.decide(req.id, { decision: 'approve', actorId: APPROVER }, MALLORY),
-    ).rejects.toThrow(/FORBIDDEN/);
-    expect(resumed).toHaveLength(0);
-  });
-
-  it('decideNode: a unanimous slate cannot be filled by one user naming the others', async () => {
-    const req = await open(['bob', 'carol'], { behavior: 'unanimous' });
-    const asBob = { userId: 'bob', tenantId: 't1', positions: [], permissions: [] } as any;
-    const first = await svc.decideNode(req.id, { decision: 'approve', actorId: 'bob' }, asBob);
-    expect(first.finalized).toBe(false);
-    // Bob holds a slot, so he clears the "is a pending approver" gate — but the
-    // slot he clears it with is his own, not carol's.
-    await expect(
-      svc.decideNode(req.id, { decision: 'approve', actorId: 'carol' }, asBob),
-    ).rejects.toThrow(/FORBIDDEN/);
-    expect(engine._tables['sys_approval_request'][0].status).toBe('pending');
-  });
-
-  // ── the submitter-only moves ────────────────────────────────────
-
-  it('recall: mallory cannot withdraw the request by naming its submitter', async () => {
-    const req = await open();
-    await expect(
-      svc.recall(req.id, { actorId: SUBMITTER, comment: 'gone' }, MALLORY),
-    ).rejects.toThrow(/FORBIDDEN/);
-    expect(engine._tables['sys_approval_request'][0].status).toBe('pending');
-  });
-
-  it('resubmit: mallory cannot resubmit a returned request by naming its submitter', async () => {
-    svc.attachAutomation(makeAutomationStub() as any);
-    const req = await open();
-    const asBob = { userId: APPROVER, tenantId: 't1', positions: [], permissions: [] } as any;
-    await svc.sendBack(req.id, { actorId: APPROVER, comment: 'fix it' }, asBob);
-    expect(engine._tables['sys_approval_request'][0].status).toBe('returned');
-    await expect(
-      svc.resubmit(req.id, { actorId: SUBMITTER, comment: 'done' }, MALLORY),
-    ).rejects.toThrow(/FORBIDDEN/);
-  });
-
-  it('sendBack: mallory cannot return the request by naming the pending approver', async () => {
-    const req = await open();
-    await expect(
-      svc.sendBack(req.id, { actorId: APPROVER, comment: 'revise' }, MALLORY),
-    ).rejects.toThrow(/FORBIDDEN/);
-    expect(engine._tables['sys_approval_request'][0].status).toBe('pending');
-  });
-
-  // ── the thread moves ────────────────────────────────────────────
-
-  it('reassign: mallory cannot move the slot by naming its holder', async () => {
-    const req = await open();
-    await expect(
-      svc.reassign(req.id, { actorId: APPROVER, to: 'mallory' }, MALLORY),
-    ).rejects.toThrow(/FORBIDDEN/);
-    expect(engine._tables['sys_approval_request'][0].pending_approvers).toBe(APPROVER);
-  });
-
-  it('requestInfo: mallory cannot post as the pending approver', async () => {
-    const req = await open();
-    await expect(
-      svc.requestInfo(req.id, { actorId: APPROVER, comment: 'send the contract' }, MALLORY),
-    ).rejects.toThrow(/FORBIDDEN/);
-  });
-
-  it('comment: mallory cannot post to the thread as the submitter', async () => {
-    const req = await open();
-    await expect(
-      svc.comment(req.id, { actorId: SUBMITTER, comment: 'looks fine to me' }, MALLORY),
-    ).rejects.toThrow(/FORBIDDEN/);
-  });
-
-  it('remind: mallory cannot nudge as the submitter', async () => {
-    const req = await open();
-    await expect(
-      svc.remind(req.id, { actorId: SUBMITTER }, MALLORY),
-    ).rejects.toThrow(/FORBIDDEN/);
-  });
-
-  // ── the legitimate paths must survive ───────────────────────────
-  //
-  // Without these, "reject every actorId that isn't the caller" would pass the
-  // suite above by breaking the SLA sweep and the emailed action link — the two
-  // callers that hold a trustworthy actor with no session behind it.
-
-  it('the real approver still decides their own slot', async () => {
-    const req = await open();
-    const asBob = { userId: APPROVER, tenantId: 't1', positions: [], permissions: [] } as any;
-    const out = await svc.decideNode(req.id, { decision: 'approve', actorId: APPROVER }, asBob);
-    expect(out.finalized).toBe(true);
-    expect(out.request.status).toBe('approved');
-    const row = (engine._tables['sys_approval_action'] ?? []).find((a: any) => a.action === 'approve');
-    expect(row.actor_id).toBe(APPROVER);
-  });
-
-  it('the real submitter still recalls their own request', async () => {
-    const req = await open();
-    const out = await svc.recall(req.id, { actorId: SUBMITTER }, ALICE);
-    expect(out.request.status).toBe('recalled');
-  });
-
-  it('a system context may still name an actor with no session behind it (SLA sweep)', async () => {
-    const req = await open();
-    const out = await svc.decideNode(req.id, { decision: 'approve', actorId: SLA_ACTOR_ID }, SYS);
-    expect(out.finalized).toBe(true);
-    const row = (engine._tables['sys_approval_action'] ?? []).find((a: any) => a.action === 'approve');
-    expect(row.actor_id).toBe(SLA_ACTOR_ID);
-  });
-
-  it('a privileged admin may still override a stuck request', async () => {
-    const req = await open(['position:cfo']);
-    const admin = {
-      userId: 'root', tenantId: 't1', positions: [], permissions: ['admin_full_access'],
-    } as any;
-    const out = await svc.decideNode(req.id, { decision: 'approve', actorId: 'root' }, admin);
-    expect(out.finalized).toBe(true);
-    expect(out.request.status).toBe('approved');
-  });
-});