@open-mercato/core 0.7.1-develop.7193.1.910a5b0a1e → 0.7.1-develop.7194.1.ab4fc81f82

package/dist/modules/workflows/lib/workflow-command-enablement.js

@@ -0,0 +1,57 @@
+const UNSET_WORKFLOW_COMMAND_POLICY = {
+  enabledCommandIds: null
+};
+function normalizeIds(values) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    if (typeof value !== "string") continue;
+    const trimmed = value.trim();
+    if (trimmed.length > 0) seen.add(trimmed);
+  }
+  return [...seen];
+}
+function parseStoredEnabledCommandIds(value) {
+  if (!Array.isArray(value)) return null;
+  return normalizeIds(value);
+}
+function findCatalogueEntry(catalogue, commandId) {
+  return catalogue.find((command) => command.commandId === commandId) ?? null;
+}
+function isWorkflowCommandEnabled(command, policy) {
+  if (policy.enabledCommandIds === null) return command.defaultEnabled === true;
+  return policy.enabledCommandIds.includes(command.commandId);
+}
+function resolveEnabledWorkflowCommand(catalogue, policy, commandId) {
+  const command = findCatalogueEntry(catalogue, commandId);
+  if (!command) return null;
+  return isWorkflowCommandEnabled(command, policy) ? command : null;
+}
+function resolveWorkflowCommandCatalogue(catalogue, policy) {
+  return catalogue.map((command) => ({
+    commandId: command.commandId,
+    requiredFeatures: [...command.requiredFeatures],
+    labelKey: command.labelKey ?? null,
+    enabled: isWorkflowCommandEnabled(command, policy),
+    defaultEnabled: command.defaultEnabled === true
+  }));
+}
+function mergeEnabledCommandIds(submitted, stored, catalogue) {
+  const catalogueIds = new Set(catalogue.map((command) => command.commandId));
+  const kept = normalizeIds(submitted).filter((commandId) => catalogueIds.has(commandId));
+  const retained = normalizeIds(stored ?? []).filter((commandId) => !catalogueIds.has(commandId));
+  return [.../* @__PURE__ */ new Set([...kept, ...retained])];
+}
+function findUncataloguedCommandIds(submitted, catalogue) {
+  const catalogueIds = new Set(catalogue.map((command) => command.commandId));
+  return normalizeIds(submitted).filter((commandId) => !catalogueIds.has(commandId));
+}
+export {
+  UNSET_WORKFLOW_COMMAND_POLICY,
+  findUncataloguedCommandIds,
+  isWorkflowCommandEnabled,
+  mergeEnabledCommandIds,
+  parseStoredEnabledCommandIds,
+  resolveEnabledWorkflowCommand,
+  resolveWorkflowCommandCatalogue
+};
+//# sourceMappingURL=workflow-command-enablement.js.map

package/dist/modules/workflows/lib/workflow-command-enablement.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/workflows/lib/workflow-command-enablement.ts"],
+  "sourcesContent": ["/**\n * Tier 2 of the UPDATE_ENTITY authorization model: which of the commands the\n * CODE declares possible are SWITCHED ON for this tenant.\n *\n * ## The three gates, and why there are three\n *\n * `executeUpdateEntity` runs a command only when ALL of the following hold:\n *\n * 1. **Catalogue** \u2014 the command was declared through\n *    `registerWorkflowSafeCommands`. Only the owning module can state that a\n *    command is safe to run unattended and which ACL feature it needs, so that\n *    fact stays in code and an administrator can never type an arbitrary id.\n * 2. **Tenant enablement** \u2014 THIS module, decided here. A catalogue entry is a\n *    CANDIDATE; a human ticks it before any workflow can reach it.\n * 3. **Actor features** \u2014 the workflow's acting user holds the declared\n *    `requiredFeatures`. Unchanged, and deliberately still last: enabling a\n *    command for a tenant is not a grant of it to everybody in that tenant.\n *\n * Dropping any one of them collapses the model. In particular gate 2 without\n * gate 1 would be \"let an admin name any of the ~275 commands\", which is the\n * design the maintainer rejected.\n *\n * ## Why an absent setting is not \"nothing enabled\"\n *\n * Before this file existed, every catalogue entry was reachable. Exactly one\n * command was ever in the catalogue (`sales.orders.update`), so \"all-off by\n * default\" would break the shipped `sales.order-approval` workflow and its\n * gallery template, while \"all-on by default\" would silently hand every tenant\n * the ability to have workflows mutate products and customers the moment a new\n * candidate is declared.\n *\n * So an absent setting resolves to the entries whose declaration carries\n * `defaultEnabled: true` \u2014 the grandfather clause, reserved for commands that\n * were ALREADY reachable before this gate existed. Everything declared from now\n * on omits the flag and is therefore off until a human ticks it. A tenant with\n * no stored row behaves byte-identically to how it behaved before.\n *\n * ## Purity\n *\n * Nothing here reads a database, a container or a clock. The impure read\n * happens once per request in `lib/workflow-command-settings.ts` and the\n * decision is these functions, in the same shape `lib/task-visibility.ts` and\n * its `-request` companion use.\n */\n\nimport type { WorkflowSafeCommandDefinition } from './workflow-safe-commands'\n\n/**\n * The tenant's stored answer, already read.\n *\n * `enabledCommandIds: null` means the tenant has never saved the setting \u2014 NOT\n * that it saved an empty list. An empty array is a deliberate \"nothing is\n * enabled\" and must not be confused with the grandfathered default, which is\n * why this is a nullable list rather than a set with a sentinel.\n */\nexport type WorkflowCommandEnablementPolicy = {\n  enabledCommandIds: readonly string[] | null\n}\n\n/** The policy for a tenant with no stored row. */\nexport const UNSET_WORKFLOW_COMMAND_POLICY: WorkflowCommandEnablementPolicy = {\n  enabledCommandIds: null,\n}\n\n/** One catalogue entry plus this tenant's answer for it. */\nexport type WorkflowCommandAvailability = {\n  commandId: string\n  requiredFeatures: string[]\n  /** i18n key supplied by the owning module; absent means \"render the id\". */\n  labelKey: string | null\n  enabled: boolean\n  /**\n   * Whether the declaration carries the grandfather clause. Surfaced so the\n   * settings UI can explain why a row is ticked in a tenant that never saved.\n   */\n  defaultEnabled: boolean\n}\n\nfunction normalizeIds(values: readonly unknown[]): string[] {\n  const seen = new Set<string>()\n  for (const value of values) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (trimmed.length > 0) seen.add(trimmed)\n  }\n  return [...seen]\n}\n\n/**\n * Turn whatever is stored in `module_configs` into a policy.\n *\n * An absent, null or structurally wrong value all resolve to the UNSET policy,\n * i.e. to the grandfathered set. That is the conservative direction: a broken\n * row can never widen what a tenant may execute beyond what it could execute\n * before the setting existed, and it can never silently disable a command that\n * already works. Non-string members are dropped rather than failing the whole\n * read \u2014 a single bad element must not reopen the grandfathered set.\n */\nexport function parseStoredEnabledCommandIds(value: unknown): readonly string[] | null {\n  if (!Array.isArray(value)) return null\n  return normalizeIds(value)\n}\n\nfunction findCatalogueEntry(\n  catalogue: readonly WorkflowSafeCommandDefinition[],\n  commandId: string,\n): WorkflowSafeCommandDefinition | null {\n  return catalogue.find((command) => command.commandId === commandId) ?? null\n}\n\n/**\n * Gate 2 for one already-catalogued command.\n *\n * Takes the DEFINITION, not an id, so a caller cannot accidentally ask about a\n * command that is not in the catalogue and get a `true` back \u2014 gate 1 is\n * discharged by having the definition at all.\n */\nexport function isWorkflowCommandEnabled(\n  command: WorkflowSafeCommandDefinition,\n  policy: WorkflowCommandEnablementPolicy,\n): boolean {\n  if (policy.enabledCommandIds === null) return command.defaultEnabled === true\n  return policy.enabledCommandIds.includes(command.commandId)\n}\n\n/**\n * Gates 1 and 2 together: the definition to execute, or `null`.\n *\n * The single answer the runtime asks for. A command absent from the catalogue\n * and a command present but not ticked are both `null` here \u2014 they differ only\n * in the message the caller reports, never in the outcome.\n */\nexport function resolveEnabledWorkflowCommand(\n  catalogue: readonly WorkflowSafeCommandDefinition[],\n  policy: WorkflowCommandEnablementPolicy,\n  commandId: string,\n): WorkflowSafeCommandDefinition | null {\n  const command = findCatalogueEntry(catalogue, commandId)\n  if (!command) return null\n  return isWorkflowCommandEnabled(command, policy) ? command : null\n}\n\n/** The whole catalogue with this tenant's answer attached, in catalogue order. */\nexport function resolveWorkflowCommandCatalogue(\n  catalogue: readonly WorkflowSafeCommandDefinition[],\n  policy: WorkflowCommandEnablementPolicy,\n): WorkflowCommandAvailability[] {\n  return catalogue.map((command) => ({\n    commandId: command.commandId,\n    requiredFeatures: [...command.requiredFeatures],\n    labelKey: command.labelKey ?? null,\n    enabled: isWorkflowCommandEnabled(command, policy),\n    defaultEnabled: command.defaultEnabled === true,\n  }))\n}\n\n/**\n * The ids a settings write must persist.\n *\n * Two rules, both about not losing a tenant's answer:\n *\n * - Submitted ids outside the catalogue are DROPPED, never stored. Gate 1 makes\n *   them unexecutable anyway, so storing one would only manufacture a row that\n *   looks like a grant and is not.\n * - Stored ids outside the CURRENT catalogue are KEPT. A module can be absent\n *   from a given process (an optional peer, a temporarily disabled module), and\n *   a settings save from a UI that could not list its commands must not silently\n *   untick them.\n */\nexport function mergeEnabledCommandIds(\n  submitted: readonly string[],\n  stored: readonly string[] | null,\n  catalogue: readonly WorkflowSafeCommandDefinition[],\n): string[] {\n  const catalogueIds = new Set(catalogue.map((command) => command.commandId))\n  const kept = normalizeIds(submitted).filter((commandId) => catalogueIds.has(commandId))\n  const retained = normalizeIds(stored ?? []).filter((commandId) => !catalogueIds.has(commandId))\n  return [...new Set([...kept, ...retained])]\n}\n\n/** Ids a settings write asked for that the catalogue does not declare. */\nexport function findUncataloguedCommandIds(\n  submitted: readonly string[],\n  catalogue: readonly WorkflowSafeCommandDefinition[],\n): string[] {\n  const catalogueIds = new Set(catalogue.map((command) => command.commandId))\n  return normalizeIds(submitted).filter((commandId) => !catalogueIds.has(commandId))\n}\n"],
+  "mappings": "AA4DO,MAAM,gCAAiE;AAAA,EAC5E,mBAAmB;AACrB;AAgBA,SAAS,aAAa,QAAsC;AAC1D,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,QAAQ,SAAS,EAAG,MAAK,IAAI,OAAO;AAAA,EAC1C;AACA,SAAO,CAAC,GAAG,IAAI;AACjB;AAYO,SAAS,6BAA6B,OAA0C;AACrF,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,SAAO,aAAa,KAAK;AAC3B;AAEA,SAAS,mBACP,WACA,WACsC;AACtC,SAAO,UAAU,KAAK,CAAC,YAAY,QAAQ,cAAc,SAAS,KAAK;AACzE;AASO,SAAS,yBACd,SACA,QACS;AACT,MAAI,OAAO,sBAAsB,KAAM,QAAO,QAAQ,mBAAmB;AACzE,SAAO,OAAO,kBAAkB,SAAS,QAAQ,SAAS;AAC5D;AASO,SAAS,8BACd,WACA,QACA,WACsC;AACtC,QAAM,UAAU,mBAAmB,WAAW,SAAS;AACvD,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,yBAAyB,SAAS,MAAM,IAAI,UAAU;AAC/D;AAGO,SAAS,gCACd,WACA,QAC+B;AAC/B,SAAO,UAAU,IAAI,CAAC,aAAa;AAAA,IACjC,WAAW,QAAQ;AAAA,IACnB,kBAAkB,CAAC,GAAG,QAAQ,gBAAgB;AAAA,IAC9C,UAAU,QAAQ,YAAY;AAAA,IAC9B,SAAS,yBAAyB,SAAS,MAAM;AAAA,IACjD,gBAAgB,QAAQ,mBAAmB;AAAA,EAC7C,EAAE;AACJ;AAeO,SAAS,uBACd,WACA,QACA,WACU;AACV,QAAM,eAAe,IAAI,IAAI,UAAU,IAAI,CAAC,YAAY,QAAQ,SAAS,CAAC;AAC1E,QAAM,OAAO,aAAa,SAAS,EAAE,OAAO,CAAC,cAAc,aAAa,IAAI,SAAS,CAAC;AACtF,QAAM,WAAW,aAAa,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,aAAa,IAAI,SAAS,CAAC;AAC9F,SAAO,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC;AAC5C;AAGO,SAAS,2BACd,WACA,WACU;AACV,QAAM,eAAe,IAAI,IAAI,UAAU,IAAI,CAAC,YAAY,QAAQ,SAAS,CAAC;AAC1E,SAAO,aAAa,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC,aAAa,IAAI,SAAS,CAAC;AACnF;",
+  "names": []
+}

package/dist/modules/workflows/lib/workflow-command-settings.js

@@ -0,0 +1,54 @@
+import {
+  parseStoredEnabledCommandIds,
+  UNSET_WORKFLOW_COMMAND_POLICY
+} from "./workflow-command-enablement.js";
+const WORKFLOWS_COMMAND_CONFIG_MODULE = "workflows";
+const UPDATE_ENTITY_ENABLED_COMMANDS_KEY = "update_entity_enabled_commands";
+async function readEnabledWorkflowCommandIds(moduleConfigService, tenantId) {
+  if (!moduleConfigService) return null;
+  try {
+    const value = await moduleConfigService.getValue(
+      WORKFLOWS_COMMAND_CONFIG_MODULE,
+      UPDATE_ENTITY_ENABLED_COMMANDS_KEY,
+      { scope: { tenantId } }
+    );
+    return parseStoredEnabledCommandIds(value);
+  } catch {
+    return null;
+  }
+}
+async function resolveWorkflowCommandEnablementPolicy(moduleConfigService, tenantId) {
+  const enabledCommandIds = await readEnabledWorkflowCommandIds(moduleConfigService, tenantId);
+  return enabledCommandIds === null ? UNSET_WORKFLOW_COMMAND_POLICY : { enabledCommandIds };
+}
+async function writeEnabledWorkflowCommandIds(moduleConfigService, tenantId, commandIds) {
+  await moduleConfigService.setValue(
+    WORKFLOWS_COMMAND_CONFIG_MODULE,
+    UPDATE_ENTITY_ENABLED_COMMANDS_KEY,
+    [...commandIds],
+    { tenantId }
+  );
+}
+function resolveWorkflowCommandConfigService(container) {
+  try {
+    return container.resolve("moduleConfigService") ?? null;
+  } catch {
+    return null;
+  }
+}
+async function resolveWorkflowCommandPolicyForContainer(container, tenantId) {
+  return resolveWorkflowCommandEnablementPolicy(
+    resolveWorkflowCommandConfigService(container),
+    tenantId
+  );
+}
+export {
+  UPDATE_ENTITY_ENABLED_COMMANDS_KEY,
+  WORKFLOWS_COMMAND_CONFIG_MODULE,
+  readEnabledWorkflowCommandIds,
+  resolveWorkflowCommandConfigService,
+  resolveWorkflowCommandEnablementPolicy,
+  resolveWorkflowCommandPolicyForContainer,
+  writeEnabledWorkflowCommandIds
+};
+//# sourceMappingURL=workflow-command-settings.js.map

package/dist/modules/workflows/lib/workflow-command-settings.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/workflows/lib/workflow-command-settings.ts"],
+  "sourcesContent": ["/**\n * The impure half of the UPDATE_ENTITY tenant enablement gate.\n *\n * Shape copied from `lib/task-permission-settings.ts`: one tenant-scoped\n * `module_configs` row under the `workflows` module id, read through\n * `ModuleConfigService` (scoped row \u2192 global row \u2192 not found), decided by the\n * PURE functions in `lib/workflow-command-enablement.ts`.\n *\n * ## Caching\n *\n * There is NO cache here, deliberately. `ModuleConfigService.getValue` already\n * caches through the platform `CacheStrategy` \u2014 tenant-keyed, 60s TTL, tagged\n * `module-config:module:workflows` \u2014 and `setValue` writes the new value\n * through that same key, so the settings page's own save is visible\n * immediately. A second cache in this module would need its own invalidation\n * hook on every write path and could disagree with the settings page about what\n * is enabled, which is the failure mode this gate exists to prevent. On the\n * `UPDATE_ENTITY` hot path this costs one cache read per activity execution and,\n * at most, one indexed single-row `SELECT` per tenant per minute.\n *\n * ## Failure direction\n *\n * A read that cannot happen \u2014 no container, no service, an unparseable row \u2014\n * resolves to the UNSET policy, i.e. the grandfathered set. That is the only\n * answer that neither grants a capability the tenant never ticked nor breaks a\n * workflow that already ran. It is never \"everything enabled\".\n *\n * `tenantId` MUST come from the authenticated context or from the workflow\n * instance, never from request input.\n */\n\nimport {\n  parseStoredEnabledCommandIds,\n  UNSET_WORKFLOW_COMMAND_POLICY,\n  type WorkflowCommandEnablementPolicy,\n} from './workflow-command-enablement'\n\n/** `module_configs.module_id`, shared with the task-permission setting. */\nexport const WORKFLOWS_COMMAND_CONFIG_MODULE = 'workflows'\n\n/** `module_configs.name`. Well within `moduleConfigKeySchema`'s 128 chars. */\nexport const UPDATE_ENTITY_ENABLED_COMMANDS_KEY = 'update_entity_enabled_commands'\n\n/** The `ModuleConfigService` slice this needs, so tests need no container. */\nexport type WorkflowCommandConfigService = {\n  getValue: (\n    moduleId: string,\n    name: string,\n    options?: { defaultValue?: unknown; scope?: { tenantId?: string | null } },\n  ) => Promise<unknown>\n  setValue: (\n    moduleId: string,\n    name: string,\n    value: unknown,\n    scope?: { tenantId?: string | null },\n  ) => Promise<unknown>\n}\n\n/** The container slice the runtime helper below reaches for. */\nexport type WorkflowCommandSettingsContainer = { resolve: <T>(name: string) => T }\n\nexport async function readEnabledWorkflowCommandIds(\n  moduleConfigService: WorkflowCommandConfigService | null | undefined,\n  tenantId: string | null,\n): Promise<readonly string[] | null> {\n  if (!moduleConfigService) return null\n  try {\n    const value = await moduleConfigService.getValue(\n      WORKFLOWS_COMMAND_CONFIG_MODULE,\n      UPDATE_ENTITY_ENABLED_COMMANDS_KEY,\n      { scope: { tenantId } },\n    )\n    return parseStoredEnabledCommandIds(value)\n  } catch {\n    return null\n  }\n}\n\n/** The `policy` argument every decision function takes. */\nexport async function resolveWorkflowCommandEnablementPolicy(\n  moduleConfigService: WorkflowCommandConfigService | null | undefined,\n  tenantId: string | null,\n): Promise<WorkflowCommandEnablementPolicy> {\n  const enabledCommandIds = await readEnabledWorkflowCommandIds(moduleConfigService, tenantId)\n  return enabledCommandIds === null ? UNSET_WORKFLOW_COMMAND_POLICY : { enabledCommandIds }\n}\n\nexport async function writeEnabledWorkflowCommandIds(\n  moduleConfigService: WorkflowCommandConfigService,\n  tenantId: string,\n  commandIds: readonly string[],\n): Promise<void> {\n  await moduleConfigService.setValue(\n    WORKFLOWS_COMMAND_CONFIG_MODULE,\n    UPDATE_ENTITY_ENABLED_COMMANDS_KEY,\n    [...commandIds],\n    { tenantId },\n  )\n}\n\n/**\n * Resolve the config service from a container without letting its absence fail\n * the caller. An absent service reads as the UNSET policy \u2014 see the header.\n */\nexport function resolveWorkflowCommandConfigService(\n  container: WorkflowCommandSettingsContainer,\n): WorkflowCommandConfigService | null {\n  try {\n    return container.resolve<WorkflowCommandConfigService>('moduleConfigService') ?? null\n  } catch {\n    return null\n  }\n}\n\n/** The policy for one workflow run, resolved from its own container + tenant. */\nexport async function resolveWorkflowCommandPolicyForContainer(\n  container: WorkflowCommandSettingsContainer,\n  tenantId: string | null,\n): Promise<WorkflowCommandEnablementPolicy> {\n  return resolveWorkflowCommandEnablementPolicy(\n    resolveWorkflowCommandConfigService(container),\n    tenantId,\n  )\n}\n"],
+  "mappings": "AA+BA;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAGA,MAAM,kCAAkC;AAGxC,MAAM,qCAAqC;AAoBlD,eAAsB,8BACpB,qBACA,UACmC;AACnC,MAAI,CAAC,oBAAqB,QAAO;AACjC,MAAI;AACF,UAAM,QAAQ,MAAM,oBAAoB;AAAA,MACtC;AAAA,MACA;AAAA,MACA,EAAE,OAAO,EAAE,SAAS,EAAE;AAAA,IACxB;AACA,WAAO,6BAA6B,KAAK;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,uCACpB,qBACA,UAC0C;AAC1C,QAAM,oBAAoB,MAAM,8BAA8B,qBAAqB,QAAQ;AAC3F,SAAO,sBAAsB,OAAO,gCAAgC,EAAE,kBAAkB;AAC1F;AAEA,eAAsB,+BACpB,qBACA,UACA,YACe;AACf,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA;AAAA,IACA,CAAC,GAAG,UAAU;AAAA,IACd,EAAE,SAAS;AAAA,EACb;AACF;AAMO,SAAS,oCACd,WACqC;AACrC,MAAI;AACF,WAAO,UAAU,QAAsC,qBAAqB,KAAK;AAAA,EACnF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,yCACpB,WACA,UAC0C;AAC1C,SAAO;AAAA,IACL,oCAAoC,SAAS;AAAA,IAC7C;AAAA,EACF;AACF;",
+  "names": []
+}