@open-mercato/core 0.6.2-develop.3400.2.d948268f50 → 0.6.2-develop.3406.1.2b403f40da

package/src/modules/sales/workflows.ts

@@ -0,0 +1,184 @@
+/**
+ * Sales Module — Code-Based Workflow Definitions
+ *
+ * Order approval workflow shipped with the sales module.
+ */
+
+import { defineWorkflow, createWorkflowsModuleConfig } from '@open-mercato/shared/modules/workflows'
+
+const orderApproval = defineWorkflow({
+  workflowId: 'sales.order-approval',
+  workflowName: 'Sales Order Approval Workflow',
+  description: 'Approval workflow for sales orders requiring authorization before processing',
+  metadata: { category: 'Sales', tags: ['sales', 'approval', 'order'], icon: 'check-circle' },
+  steps: [
+    { stepId: 'start', stepName: 'Start', stepType: 'START', description: 'Initialize order approval workflow' },
+    {
+      stepId: 'pending_approval',
+      stepName: 'Pending Approval',
+      stepType: 'USER_TASK',
+      description: 'Order awaiting approval decision',
+      userTaskConfig: {
+        formSchema: {
+          type: 'object',
+          required: ['decision'],
+          properties: {
+            comments: { type: 'string', title: 'Comments', description: 'Optional comments for the decision' },
+            decision: { enum: ['approve', 'reject'], type: 'string', title: 'Decision', description: 'Approve or reject the order' },
+          },
+        },
+        slaDuration: 'PT24H',
+      },
+    },
+    { stepId: 'approved', stepName: 'Approved', stepType: 'AUTOMATED', description: 'Order has been approved' },
+    { stepId: 'rejected', stepName: 'Rejected', stepType: 'AUTOMATED', description: 'Order has been rejected' },
+    { stepId: 'end', stepName: 'Complete', stepType: 'END', description: 'Workflow complete' },
+  ] as const,
+  transitions: [
+    {
+      transitionId: 'start_to_pending',
+      transitionName: 'Submit for Approval',
+      fromStepId: 'start',
+      toStepId: 'pending_approval',
+      trigger: 'auto',
+      priority: 100,
+      continueOnActivityFailure: true,
+      activities: [
+        {
+          activityId: 'set_pending_status',
+          activityName: 'Set Order to Pending Approval',
+          activityType: 'UPDATE_ENTITY',
+          async: false,
+          config: {
+            commandId: 'sales.orders.update',
+            statusDictionary: 'sales.order_status',
+            input: { id: '{{context.id}}', statusValue: 'pending_approval' },
+          },
+          retryPolicy: { maxAttempts: 3, initialIntervalMs: 1000, backoffCoefficient: 2, maxIntervalMs: 10000 },
+        },
+        {
+          activityId: 'emit_approval_requested',
+          activityName: 'Emit Approval Requested Event',
+          activityType: 'EMIT_EVENT',
+          async: true,
+          config: {
+            eventName: 'sales.order.approval.requested',
+            payload: { orderId: '{{context.id}}', workflowInstanceId: '{{workflow.instanceId}}' },
+          },
+        },
+      ],
+    },
+    {
+      transitionId: 'pending_approval_to_approved',
+      transitionName: 'Approve Order',
+      fromStepId: 'pending_approval',
+      toStepId: 'approved',
+      trigger: 'auto',
+      priority: 100,
+      preConditions: [{ ruleId: 'workflow_order_approval_check_approved', required: true }],
+      continueOnActivityFailure: true,
+      activities: [
+        {
+          activityId: 'set_approved_status',
+          activityName: 'Set Order to Approved',
+          activityType: 'UPDATE_ENTITY',
+          async: false,
+          config: {
+            commandId: 'sales.orders.update',
+            statusDictionary: 'sales.order_status',
+            input: { id: '{{context.id}}', statusValue: 'approved' },
+          },
+          retryPolicy: { maxAttempts: 3, initialIntervalMs: 1000, backoffCoefficient: 2, maxIntervalMs: 10000 },
+        },
+        {
+          activityId: 'emit_order_approved',
+          activityName: 'Emit Order Approved Event',
+          activityType: 'EMIT_EVENT',
+          async: true,
+          config: {
+            eventName: 'sales.order.approval.approved',
+            payload: {
+              orderId: '{{context.id}}',
+              workflowInstanceId: '{{workflow.instanceId}}',
+              approvedBy: '{{context.completedBy}}',
+              comments: '{{context.comments}}',
+            },
+          },
+        },
+      ],
+    },
+    {
+      transitionId: 'pending_approval_to_rejected',
+      transitionName: 'Reject Order',
+      fromStepId: 'pending_approval',
+      toStepId: 'rejected',
+      trigger: 'auto',
+      priority: 90,
+      preConditions: [{ ruleId: 'workflow_order_approval_check_rejected', required: true }],
+      continueOnActivityFailure: true,
+      activities: [
+        {
+          activityId: 'set_rejected_status',
+          activityName: 'Set Order to Rejected',
+          activityType: 'UPDATE_ENTITY',
+          async: false,
+          config: {
+            commandId: 'sales.orders.update',
+            statusDictionary: 'sales.order_status',
+            input: { id: '{{context.id}}', statusValue: 'rejected' },
+          },
+          retryPolicy: { maxAttempts: 3, initialIntervalMs: 1000, backoffCoefficient: 2, maxIntervalMs: 10000 },
+        },
+        {
+          activityId: 'emit_order_rejected',
+          activityName: 'Emit Order Rejected Event',
+          activityType: 'EMIT_EVENT',
+          async: true,
+          config: {
+            eventName: 'sales.order.approval.rejected',
+            payload: {
+              orderId: '{{context.id}}',
+              workflowInstanceId: '{{workflow.instanceId}}',
+              rejectedBy: '{{context.completedBy}}',
+              comments: '{{context.comments}}',
+            },
+          },
+        },
+      ],
+    },
+    {
+      transitionId: 'approved_to_end',
+      transitionName: 'Complete After Approval',
+      fromStepId: 'approved',
+      toStepId: 'end',
+      trigger: 'auto',
+      priority: 100,
+      continueOnActivityFailure: true,
+    },
+    {
+      transitionId: 'rejected_to_end',
+      transitionName: 'Complete After Rejection',
+      fromStepId: 'rejected',
+      toStepId: 'end',
+      trigger: 'auto',
+      priority: 100,
+      continueOnActivityFailure: true,
+    },
+  ],
+  triggers: [{
+    triggerId: 'order_approval_trigger',
+    name: 'Order Approval Trigger',
+    description: 'Triggers when a new sales order is created',
+    eventPattern: 'sales.orders.created',
+    config: { entityType: 'SalesOrder' },
+    enabled: true,
+    priority: 0,
+  }],
+})
+
+export const workflowsConfig = createWorkflowsModuleConfig({
+  moduleId: 'sales',
+  workflows: [orderApproval],
+})
+
+export default workflowsConfig

package/src/modules/workflows/api/definitions/[id]/customize/route.ts

@@ -0,0 +1,197 @@
+/**
+ * Customize Code-Based Workflow Definition
+ *
+ * POST /api/workflows/definitions/[id]/customize
+ *
+ * Creates a DB override row for a code-based workflow definition, seeded from
+ * the current code registry values. The id param must be of the form
+ * "code:<workflowId>".
+ */
+
+import { NextRequest, NextResponse } from 'next/server'
+import { z } from 'zod'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'
+import { WorkflowDefinition } from '../../../../data/entities'
+import { serializeWorkflowDefinition } from '../../serialize'
+import { getCodeWorkflow } from '../../../../lib/code-registry'
+
+export const metadata = {
+  requireAuth: true,
+  requireFeatures: ['workflows.definitions.edit'],
+}
+
+interface RouteContext {
+  params: Promise<{
+    id: string
+  }>
+}
+
+export async function POST(request: NextRequest, context: RouteContext) {
+  try {
+    const params = await context.params
+    const container = await createRequestContainer()
+    const em = container.resolve('em')
+    const auth = await getAuthFromRequest(request)
+
+    if (!auth) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
+    const tenantId = auth.tenantId
+    const organizationId = scope?.selectedId ?? auth.orgId
+
+    if (!params.id.startsWith('code:')) {
+      return NextResponse.json(
+        { error: 'Customize is only supported for code-based workflow definitions' },
+        { status: 400 },
+      )
+    }
+
+    const workflowId = params.id.slice(5)
+    const codeDef = getCodeWorkflow(workflowId)
+    if (!codeDef) {
+      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })
+    }
+
+    const guardResult = await validateCrudMutationGuard(container, {
+      tenantId: tenantId ?? '',
+      organizationId: organizationId ?? null,
+      userId: auth.sub ?? '',
+      resourceKind: 'workflows.definition',
+      resourceId: params.id,
+      operation: 'custom',
+      requestMethod: 'POST',
+      requestHeaders: request.headers,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
+    const existingOverride = await em.findOne(WorkflowDefinition, {
+      workflowId: codeDef.workflowId,
+      tenantId,
+    })
+
+    let saved: WorkflowDefinition
+    if (existingOverride) {
+      existingOverride.deletedAt = null
+      existingOverride.workflowName = codeDef.workflowName
+      existingOverride.description = codeDef.description
+      existingOverride.version = codeDef.version
+      existingOverride.definition = codeDef.definition
+      existingOverride.metadata = codeDef.metadata ?? null
+      existingOverride.enabled = codeDef.enabled
+      existingOverride.codeWorkflowId = codeDef.workflowId
+      existingOverride.updatedBy = auth.sub
+      existingOverride.updatedAt = new Date()
+      await em.flush()
+      saved = existingOverride
+    } else {
+      const override = em.create(WorkflowDefinition, {
+        workflowId: codeDef.workflowId,
+        workflowName: codeDef.workflowName,
+        description: codeDef.description,
+        version: codeDef.version,
+        definition: codeDef.definition,
+        metadata: codeDef.metadata,
+        enabled: codeDef.enabled,
+        codeWorkflowId: codeDef.workflowId,
+        tenantId,
+        organizationId,
+        createdBy: auth.sub,
+        updatedBy: auth.sub,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      })
+      em.persist(override)
+      await em.flush()
+      saved = override
+    }
+
+    if (guardResult?.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(container, {
+        tenantId: tenantId ?? '',
+        organizationId: organizationId ?? null,
+        userId: auth.sub ?? '',
+        resourceKind: 'workflows.definition',
+        resourceId: String(saved.id),
+        operation: 'custom',
+        requestMethod: 'POST',
+        requestHeaders: request.headers,
+        metadata: guardResult.metadata,
+      })
+    }
+
+    try {
+      const eventBus = container.resolve('eventBus') as
+        | { emitEvent(event: string, payload: unknown, options?: unknown): Promise<void> }
+        | undefined
+      if (eventBus && typeof eventBus.emitEvent === 'function') {
+        await eventBus.emitEvent(
+          'workflows.definition.customized',
+          {
+            id: saved.id,
+            workflowId: saved.workflowId,
+            codeWorkflowId: saved.codeWorkflowId ?? null,
+            tenantId: saved.tenantId,
+            organizationId: saved.organizationId,
+            userId: auth.sub ?? null,
+          },
+          { tenantId: saved.tenantId, organizationId: saved.organizationId, persistent: true },
+        )
+      }
+    } catch (eventError) {
+      console.error('Failed to emit workflows.definition.customized event:', eventError)
+    }
+
+    return NextResponse.json({
+      data: serializeWorkflowDefinition(saved),
+      message: 'Workflow definition customized successfully',
+    })
+  } catch (error) {
+    console.error('Error customizing workflow definition:', error)
+    return NextResponse.json({ error: 'Failed to customize workflow definition' }, { status: 500 })
+  }
+}
+
+export const openApi = {
+  methods: {
+    POST: {
+      summary: 'Customize code-based workflow definition',
+      description: 'Creates a DB override for a code-based workflow definition, seeded from the current code registry values. The id param must be of the form "code:<workflowId>".',
+      tags: ['Workflows'],
+      pathParams: z.object({
+        id: z.string().describe('Must be of the form "code:<workflowId>"'),
+      }),
+      responses: [
+        {
+          status: 200,
+          description: 'Workflow definition customized successfully',
+          example: {
+            data: {
+              id: '123e4567-e89b-12d3-a456-426614174000',
+              workflowId: 'workflows.simple-approval',
+              workflowName: 'Simple Approval Workflow',
+              source: 'code_override',
+            },
+            message: 'Workflow definition customized successfully',
+          },
+        },
+        {
+          status: 400,
+          description: 'Not a code-based id',
+          example: { error: 'Customize is only supported for code-based workflow definitions' },
+        },
+        {
+          status: 404,
+          description: 'Code workflow not found',
+          example: { error: 'Workflow definition not found' },
+        },
+      ],
+    },
+  },
+}

package/src/modules/workflows/api/definitions/[id]/reset-to-code/route.ts

@@ -0,0 +1,252 @@
+/**
+ * Reset Customized Workflow Definition to Code
+ *
+ * POST /api/workflows/definitions/[id]/reset-to-code
+ *
+ * Deletes the DB override row for a code-based workflow definition,
+ * reverting it back to the original code registry version.
+ */
+
+import { NextRequest, NextResponse } from 'next/server'
+import { z } from 'zod'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'
+import { WorkflowDefinition, WorkflowInstance } from '../../../../data/entities'
+import { serializeCodeWorkflowDefinition } from '../../serialize'
+import { getCodeWorkflow } from '../../../../lib/code-registry'
+
+export const metadata = {
+  requireAuth: true,
+  requireFeatures: ['workflows.definitions.edit'],
+}
+
+interface RouteContext {
+  params: Promise<{
+    id: string
+  }>
+}
+
+/**
+ * POST /api/workflows/definitions/[id]/reset-to-code
+ *
+ * Reset a customized code workflow definition back to its original code version.
+ */
+export async function POST(
+  request: NextRequest,
+  context: RouteContext
+) {
+  try {
+    const params = await context.params
+    const container = await createRequestContainer()
+    const em = container.resolve('em')
+    const auth = await getAuthFromRequest(request)
+
+    if (!auth) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
+    const tenantId = auth.tenantId
+    const organizationId = scope?.selectedId ?? auth.orgId
+
+    // Check edit permission
+    const rbacService = container.resolve('rbacService')
+    const hasPermission = await rbacService.userHasAllFeatures(
+      auth.sub,
+      ['workflows.definitions.edit'],
+      {
+        tenantId,
+        organizationId,
+      }
+    )
+
+    if (!hasPermission) {
+      return NextResponse.json(
+        { error: 'Insufficient permissions' },
+        { status: 403 }
+      )
+    }
+
+    // Find existing definition
+    const definition = await em.findOne(WorkflowDefinition, {
+      id: params.id,
+      tenantId,
+      organizationId,
+      deletedAt: null,
+    })
+
+    if (!definition) {
+      return NextResponse.json(
+        { error: 'Workflow definition not found' },
+        { status: 404 }
+      )
+    }
+
+    // Verify this is a code-based override
+    if (!definition.codeWorkflowId) {
+      return NextResponse.json(
+        { error: 'This workflow definition is not a code-based override and cannot be reset' },
+        { status: 400 }
+      )
+    }
+
+    // Check if there are active workflow instances using this definition
+    const activeInstances = await em.count(WorkflowInstance, {
+      definitionId: definition.id,
+      status: { $in: ['RUNNING', 'WAITING'] },
+    })
+
+    if (activeInstances > 0) {
+      return NextResponse.json(
+        {
+          error: `Cannot reset workflow definition with ${activeInstances} active instance(s)`,
+        },
+        { status: 409 }
+      )
+    }
+
+    const guardResult = await validateCrudMutationGuard(container, {
+      tenantId: tenantId ?? '',
+      organizationId: organizationId ?? null,
+      userId: auth.sub ?? '',
+      resourceKind: 'workflows.definition',
+      resourceId: String(definition.id),
+      operation: 'custom',
+      requestMethod: 'POST',
+      requestHeaders: request.headers,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
+    // Look up the original code definition before deleting
+    const codeDef = getCodeWorkflow(definition.codeWorkflowId)
+
+    // Snapshot identifying fields before remove() detaches the entity
+    const removedSnapshot = {
+      id: String(definition.id),
+      workflowId: definition.workflowId,
+      codeWorkflowId: definition.codeWorkflowId,
+      tenantId: definition.tenantId,
+      organizationId: definition.organizationId,
+    }
+
+    // Hard-delete the DB override row
+    em.remove(definition)
+    await em.flush()
+
+    if (guardResult?.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(container, {
+        tenantId: tenantId ?? '',
+        organizationId: organizationId ?? null,
+        userId: auth.sub ?? '',
+        resourceKind: 'workflows.definition',
+        resourceId: removedSnapshot.id,
+        operation: 'custom',
+        requestMethod: 'POST',
+        requestHeaders: request.headers,
+        metadata: guardResult.metadata,
+      })
+    }
+
+    try {
+      const eventBus = container.resolve('eventBus') as
+        | { emitEvent(event: string, payload: unknown, options?: unknown): Promise<void> }
+        | undefined
+      if (eventBus && typeof eventBus.emitEvent === 'function') {
+        await eventBus.emitEvent(
+          'workflows.definition.reset_to_code',
+          {
+            id: removedSnapshot.id,
+            workflowId: removedSnapshot.workflowId,
+            codeWorkflowId: removedSnapshot.codeWorkflowId,
+            tenantId: removedSnapshot.tenantId,
+            organizationId: removedSnapshot.organizationId,
+            userId: auth.sub ?? null,
+          },
+          {
+            tenantId: removedSnapshot.tenantId,
+            organizationId: removedSnapshot.organizationId,
+            persistent: true,
+          },
+        )
+      }
+    } catch (eventError) {
+      console.error('Failed to emit workflows.definition.reset_to_code event:', eventError)
+    }
+
+    if (!codeDef) {
+      return NextResponse.json({
+        message: 'Workflow definition reset to code version (code definition no longer registered)',
+        data: null,
+      })
+    }
+
+    const syntheticId = `code:${codeDef.workflowId}`
+
+    return NextResponse.json({
+      data: serializeCodeWorkflowDefinition(codeDef, syntheticId),
+      message: 'Workflow definition reset to code version',
+    })
+  } catch (error) {
+    console.error('Error resetting workflow definition to code:', error)
+    return NextResponse.json(
+      { error: 'Failed to reset workflow definition to code' },
+      { status: 500 }
+    )
+  }
+}
+
+export const openApi = {
+  methods: {
+    POST: {
+      summary: 'Reset workflow definition to code version',
+      description: 'Deletes the DB override for a code-based workflow definition, reverting it to the original code registry version. Cannot be reset if there are active instances.',
+      tags: ['Workflows'],
+      pathParams: z.object({
+        id: z.string().uuid(),
+      }),
+      responses: [
+        {
+          status: 200,
+          description: 'Workflow definition reset to code version',
+          example: {
+            data: {
+              id: 'code:checkout-flow',
+              workflowId: 'checkout-flow',
+              workflowName: 'Checkout Flow',
+              description: 'Code-defined checkout workflow',
+              version: 1,
+              source: 'code',
+              isCodeBased: true,
+            },
+            message: 'Workflow definition reset to code version',
+          },
+        },
+        {
+          status: 400,
+          description: 'Definition is not a code-based override',
+          example: {
+            error: 'This workflow definition is not a code-based override and cannot be reset',
+          },
+        },
+        {
+          status: 404,
+          description: 'Workflow definition not found',
+          example: {
+            error: 'Workflow definition not found',
+          },
+        },
+        {
+          status: 409,
+          description: 'Cannot reset - active workflow instances exist',
+          example: {
+            error: 'Cannot reset workflow definition with 3 active instance(s)',
+          },
+        },
+      ],
+    },
+  },
+}