@rytass/bpm-core-nestjs-module 0.1.1 → 0.1.3

package/src/lib/signature/signature.service.ts

@@ -0,0 +1,205 @@
+import { createHash, createHmac } from 'crypto';
+import { Inject, Injectable, Optional } from '@nestjs/common';
+import { EntityManager, Repository } from 'typeorm';
+import { ApprovalInstanceEntity } from '../workflow-engine/approval-instance.entity';
+import { TaskDecisionActionEnum } from '../workflow-engine/workflow-engine.enums';
+import { TaskEntity } from '../workflow-engine/task.entity';
+import { SignatureEntity } from './signature.entity';
+import {
+  BPMResolvedSignatureOptions,
+  BPM_SIGNATURE_OPTIONS,
+  DEFAULT_BPM_SIGNATURE_OPTIONS,
+} from './signature-options';
+import { SignatureVerificationObject } from './signature-verification.object';
+
+const SIGNATURE_ALGORITHM = 'HMAC-SHA256';
+
+export interface SignTaskDecisionInput {
+  readonly action: TaskDecisionActionEnum;
+  readonly comment: string | null;
+  readonly decidedAt: Date;
+  readonly instance: ApprovalInstanceEntity;
+  readonly returnToNodeId: string | null;
+  readonly signerMemberId: string;
+  readonly task: TaskEntity;
+  readonly transferToMemberId: string | null;
+}
+
+@Injectable()
+export class SignatureService {
+  constructor(
+    @Optional()
+    @Inject(BPM_SIGNATURE_OPTIONS)
+    private readonly signatureOptions: BPMResolvedSignatureOptions = DEFAULT_BPM_SIGNATURE_OPTIONS,
+  ) {}
+
+  async signTaskDecision(
+    manager: EntityManager,
+    input: SignTaskDecisionInput,
+  ): Promise<SignatureEntity> {
+    const signatureRepository = manager.getRepository(SignatureEntity);
+    const previousSignature = await this.readLatestSignature(
+      signatureRepository,
+      input.instance.id,
+    );
+    const payload = buildTaskDecisionSignedPayload(input);
+    const signedPayloadHash = hashStableJson(payload);
+    const keyVersion = this.signatureOptions.currentKeyVersion;
+    const signature = await signHash(
+      signedPayloadHash,
+      keyVersion,
+      this.signatureOptions,
+    );
+
+    return signatureRepository.save(
+      signatureRepository.create({
+        algorithm: SIGNATURE_ALGORITHM,
+        instanceId: input.instance.id,
+        keyVersion,
+        previousSignatureHash: previousSignature?.signedPayloadHash ?? null,
+        signedAt: input.decidedAt,
+        signedPayload: payload,
+        signedPayloadHash,
+        signature,
+        signerMemberId: input.signerMemberId,
+        taskId: input.task.id,
+        timestampToken:
+          await this.signatureOptions.timestampProvider.createTimestampToken({
+            signedAt: input.decidedAt,
+            signedPayloadHash,
+          }),
+      }),
+    );
+  }
+
+  async listSignatures(
+    signatureRepository: Repository<SignatureEntity>,
+    instanceId: string,
+  ): Promise<readonly SignatureEntity[]> {
+    return signatureRepository.find({
+      order: { signedAt: 'ASC', id: 'ASC' },
+      where: { instanceId },
+    });
+  }
+
+  async verifyInstanceSignatureChain(
+    signatureRepository: Repository<SignatureEntity>,
+    instanceId: string,
+  ): Promise<SignatureVerificationObject> {
+    const signatures = await this.listSignatures(
+      signatureRepository,
+      instanceId,
+    );
+    const errors = (
+      await Promise.all(
+        signatures.map((signature, index) =>
+          verifySignatureAt(
+            signature,
+            signatures[index - 1] ?? null,
+            this.signatureOptions,
+          ),
+        ),
+      )
+    ).flatMap((signatureErrors) => signatureErrors);
+
+    return Object.assign(new SignatureVerificationObject(), {
+      checkedCount: signatures.length,
+      errors,
+      instanceId,
+      valid: errors.length === 0,
+    });
+  }
+
+  private async readLatestSignature(
+    signatureRepository: Repository<SignatureEntity>,
+    instanceId: string,
+  ): Promise<SignatureEntity | null> {
+    return signatureRepository.findOne({
+      order: { signedAt: 'DESC', id: 'DESC' },
+      where: { instanceId },
+    });
+  }
+}
+
+function buildTaskDecisionSignedPayload(
+  input: SignTaskDecisionInput,
+): Readonly<Record<string, unknown>> {
+  return {
+    action: input.action,
+    comment: input.comment,
+    decidedAt: input.decidedAt.toISOString(),
+    formDataHash: hashStableJson(input.instance.formData),
+    instanceId: input.instance.id,
+    nodeId: input.task.nodeId,
+    returnToNodeId: input.returnToNodeId,
+    signerMemberId: input.signerMemberId,
+    taskId: input.task.id,
+    transferToMemberId: input.transferToMemberId,
+  };
+}
+
+async function verifySignatureAt(
+  signature: SignatureEntity,
+  previousSignature: SignatureEntity | null,
+  options: BPMResolvedSignatureOptions,
+): Promise<readonly string[]> {
+  const payloadHash = hashStableJson(signature.signedPayload);
+  const expectedSignature = await signHash(
+    payloadHash,
+    signature.keyVersion,
+    options,
+  );
+  const expectedPreviousHash = previousSignature?.signedPayloadHash ?? null;
+
+  return [
+    payloadHash === signature.signedPayloadHash
+      ? null
+      : `Signature ${signature.id} payload hash mismatch`,
+    expectedSignature === signature.signature
+      ? null
+      : `Signature ${signature.id} HMAC mismatch`,
+    expectedPreviousHash === signature.previousSignatureHash
+      ? null
+      : `Signature ${signature.id} previous hash mismatch`,
+  ].filter(isPresentText);
+}
+
+async function signHash(
+  signedPayloadHash: string,
+  keyVersion: number,
+  options: BPMResolvedSignatureOptions,
+): Promise<string> {
+  const key = await options.keyProvider.readKey(keyVersion);
+
+  if (!key) {
+    throw new Error(`Unsupported signature key version: ${keyVersion}`);
+  }
+
+  return createHmac('sha256', key).update(signedPayloadHash).digest('base64');
+}
+
+function hashStableJson(value: unknown): string {
+  return createHash('sha256').update(stableStringify(value)).digest('hex');
+}
+
+function stableStringify(value: unknown): string {
+  if (value === null || typeof value !== 'object') {
+    return JSON.stringify(value);
+  }
+
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify).join(',')}]`;
+  }
+
+  return `{${Object.entries(value as Readonly<Record<string, unknown>>)
+    .sort(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey))
+    .map(
+      ([key, entryValue]) =>
+        `${JSON.stringify(key)}:${stableStringify(entryValue)}`,
+    )
+    .join(',')}}`;
+}
+
+function isPresentText(value: string | null): value is string {
+  return typeof value === 'string' && value.length > 0;
+}

package/src/lib/template/approval-template-category.entity.ts

@@ -0,0 +1,40 @@
+import { Field, ID, Int, ObjectType } from '@nestjs/graphql';
+import {
+  Column,
+  CreateDateColumn,
+  Entity,
+  PrimaryGeneratedColumn,
+  UpdateDateColumn,
+} from 'typeorm';
+
+@Entity('approval_template_categories')
+@ObjectType('ApprovalTemplateCategory')
+export class ApprovalTemplateCategoryEntity {
+  @PrimaryGeneratedColumn('uuid')
+  @Field(() => ID)
+  id!: string;
+
+  @Column('text')
+  @Field()
+  name!: string;
+
+  @Column('text', { nullable: true })
+  @Field(() => String, { nullable: true })
+  description!: string | null;
+
+  @Column('boolean', { default: true, name: 'is_active' })
+  @Field()
+  isActive!: boolean;
+
+  @Column('int', { default: 0, name: 'sort_order' })
+  @Field(() => Int)
+  sortOrder!: number;
+
+  @CreateDateColumn({ name: 'created_at', type: 'timestamptz' })
+  @Field()
+  createdAt!: Date;
+
+  @UpdateDateColumn({ name: 'updated_at', type: 'timestamptz' })
+  @Field()
+  updatedAt!: Date;
+}

package/src/lib/template/approval-template-version.entity.ts

@@ -0,0 +1,82 @@
+import { WorkflowDefinition } from '@rytass/bpm-core-shared/workflow';
+import { Field, ID, Int, ObjectType } from '@nestjs/graphql';
+import {
+  Column,
+  CreateDateColumn,
+  Entity,
+  PrimaryGeneratedColumn,
+  UpdateDateColumn,
+} from 'typeorm';
+import { ApprovalTemplateVersionStatusEnum } from './template.enums';
+
+@Entity('approval_template_versions')
+@ObjectType('ApprovalTemplateVersion')
+export class ApprovalTemplateVersionEntity {
+  @PrimaryGeneratedColumn('uuid')
+  @Field(() => ID)
+  id!: string;
+
+  @Column('uuid', { name: 'template_id' })
+  @Field(() => ID)
+  templateId!: string;
+
+  @Column('int')
+  @Field(() => Int)
+  version!: number;
+
+  @Column('text')
+  @Field(() => ApprovalTemplateVersionStatusEnum)
+  status!: ApprovalTemplateVersionStatusEnum;
+
+  @Column('jsonb', { name: 'workflow_definition' })
+  workflowDefinition!: WorkflowDefinition;
+
+  @Column('uuid', { name: 'form_definition_version_id', nullable: true })
+  @Field(() => ID, { nullable: true })
+  formDefinitionVersionId!: string | null;
+
+  @Column('text', { name: 'initiator_policy_cel', nullable: true })
+  @Field(() => String, { nullable: true })
+  initiatorPolicyCel!: string | null;
+
+  @Column('jsonb', { name: 'notification_config', nullable: true })
+  notificationConfig!: Readonly<Record<string, unknown>> | null;
+
+  @Column('jsonb', { name: 'sla_defaults', nullable: true })
+  slaDefaults!: Readonly<Record<string, unknown>> | null;
+
+  @Column('timestamptz', { name: 'published_at', nullable: true })
+  @Field(() => Date, { nullable: true })
+  publishedAt!: Date | null;
+
+  @Column('text', { name: 'published_by_member_id', nullable: true })
+  @Field(() => String, { nullable: true })
+  publishedByMemberId!: string | null;
+
+  @Column('timestamptz', { name: 'archived_at', nullable: true })
+  @Field(() => Date, { nullable: true })
+  archivedAt!: Date | null;
+
+  @CreateDateColumn({ name: 'created_at', type: 'timestamptz' })
+  @Field()
+  createdAt!: Date;
+
+  @UpdateDateColumn({ name: 'updated_at', type: 'timestamptz' })
+  @Field()
+  updatedAt!: Date;
+
+  @Field(() => String)
+  get workflowDefinitionJson(): string {
+    return JSON.stringify(this.workflowDefinition);
+  }
+
+  @Field(() => String, { nullable: true })
+  get notificationConfigJson(): string | null {
+    return this.notificationConfig ? JSON.stringify(this.notificationConfig) : null;
+  }
+
+  @Field(() => String, { nullable: true })
+  get slaDefaultsJson(): string | null {
+    return this.slaDefaults ? JSON.stringify(this.slaDefaults) : null;
+  }
+}

package/src/lib/template/approval-template.entity.ts

@@ -0,0 +1,64 @@
+import { Field, ID, ObjectType } from '@nestjs/graphql';
+import {
+  Column,
+  CreateDateColumn,
+  DeleteDateColumn,
+  Entity,
+  JoinColumn,
+  ManyToOne,
+  PrimaryGeneratedColumn,
+  UpdateDateColumn,
+} from 'typeorm';
+import { ApprovalTemplateCategoryEntity } from './approval-template-category.entity';
+
+@Entity('approval_templates')
+@ObjectType('ApprovalTemplate')
+export class ApprovalTemplateEntity {
+  @PrimaryGeneratedColumn('uuid')
+  @Field(() => ID)
+  id!: string;
+
+  @Column('text')
+  @Field()
+  name!: string;
+
+  @Column('text', { nullable: true })
+  @Field(() => String, { nullable: true })
+  description!: string | null;
+
+  @Column('text', { nullable: true })
+  @Field(() => String, { nullable: true })
+  category!: string | null;
+
+  @Column('uuid', { name: 'category_id', nullable: true })
+  @Field(() => ID, { nullable: true })
+  categoryId?: string | null;
+
+  @ManyToOne(() => ApprovalTemplateCategoryEntity, {
+    nullable: true,
+    onDelete: 'SET NULL',
+  })
+  @JoinColumn({ name: 'category_id' })
+  @Field(() => ApprovalTemplateCategoryEntity, { nullable: true })
+  categoryDetail?: ApprovalTemplateCategoryEntity | null;
+
+  @Column('uuid', { name: 'current_version_id', nullable: true })
+  @Field(() => ID, { nullable: true })
+  currentVersionId!: string | null;
+
+  @DeleteDateColumn({ name: 'deleted_at', type: 'timestamptz' })
+  @Field(() => Date, { nullable: true })
+  deletedAt!: Date | null;
+
+  @CreateDateColumn({ name: 'created_at', type: 'timestamptz' })
+  @Field()
+  createdAt!: Date;
+
+  @UpdateDateColumn({ name: 'updated_at', type: 'timestamptz' })
+  @Field()
+  updatedAt!: Date;
+
+  @Column('text', { name: 'created_by_member_id', nullable: true })
+  @Field(() => String, { nullable: true })
+  createdByMemberId!: string | null;
+}

package/src/lib/template/dto/approval-template.input.ts

@@ -0,0 +1,147 @@
+import { Field, ID, InputType, Int } from '@nestjs/graphql';
+import {
+  IsBoolean,
+  IsInt,
+  IsOptional,
+  IsString,
+  IsUUID,
+} from 'class-validator';
+
+@InputType()
+export class CreateApprovalTemplateInput {
+  @Field()
+  @IsString()
+  name!: string;
+
+  @Field(() => String, { nullable: true })
+  @IsOptional()
+  @IsString()
+  description!: string | null;
+
+  @Field(() => String, { nullable: true })
+  @IsOptional()
+  @IsString()
+  category!: string | null;
+
+  @Field(() => ID, { nullable: true })
+  @IsOptional()
+  @IsUUID()
+  categoryId!: string | null;
+
+  @Field(() => String, { nullable: true })
+  @IsOptional()
+  @IsString()
+  createdByMemberId!: string | null;
+
+  @Field(() => ID, { nullable: true })
+  @IsOptional()
+  @IsUUID()
+  formDefinitionVersionId!: string | null;
+}
+
+@InputType()
+export class UpdateApprovalTemplateInput {
+  @Field(() => ID)
+  @IsUUID()
+  id!: string;
+
+  @Field(() => String, { nullable: true })
+  @IsOptional()
+  @IsString()
+  name!: string | null;
+
+  @Field(() => String, { nullable: true })
+  @IsOptional()
+  @IsString()
+  description!: string | null;
+
+  @Field(() => String, { nullable: true })
+  @IsOptional()
+  @IsString()
+  category!: string | null;
+
+  @Field(() => ID, { nullable: true })
+  @IsOptional()
+  @IsUUID()
+  categoryId!: string | null;
+}
+
+@InputType()
+export class CreateApprovalTemplateCategoryInput {
+  @Field()
+  @IsString()
+  name!: string;
+
+  @Field(() => String, { nullable: true })
+  @IsOptional()
+  @IsString()
+  description!: string | null;
+
+  @Field(() => Boolean, { nullable: true })
+  @IsBoolean()
+  @IsOptional()
+  isActive!: boolean | null;
+
+  @Field(() => Int, { nullable: true })
+  @IsInt()
+  @IsOptional()
+  sortOrder!: number | null;
+}
+
+@InputType()
+export class UpdateApprovalTemplateCategoryInput {
+  @Field(() => ID)
+  @IsUUID()
+  id!: string;
+
+  @Field(() => String, { nullable: true })
+  @IsOptional()
+  @IsString()
+  name!: string | null;
+
+  @Field(() => String, { nullable: true })
+  @IsOptional()
+  @IsString()
+  description!: string | null;
+
+  @Field(() => Boolean, { nullable: true })
+  @IsBoolean()
+  @IsOptional()
+  isActive!: boolean | null;
+
+  @Field(() => Int, { nullable: true })
+  @IsInt()
+  @IsOptional()
+  sortOrder!: number | null;
+}
+
+@InputType()
+export class UpdateApprovalTemplateDraftInput {
+  @Field(() => ID)
+  @IsUUID()
+  versionId!: string;
+
+  @Field()
+  @IsString()
+  workflowDefinitionJson!: string;
+
+  @Field(() => ID, { nullable: true })
+  @IsOptional()
+  @IsUUID()
+  formDefinitionVersionId!: string | null;
+
+  @Field(() => String, { nullable: true })
+  @IsOptional()
+  @IsString()
+  initiatorPolicyCel!: string | null;
+
+  @Field(() => String, { nullable: true })
+  @IsOptional()
+  @IsString()
+  notificationConfigJson!: string | null;
+
+  @Field(() => String, { nullable: true })
+  @IsOptional()
+  @IsString()
+  slaDefaultsJson!: string | null;
+}

package/src/lib/template/template.enums.ts

@@ -0,0 +1,30 @@
+import { registerEnumType } from '@nestjs/graphql';
+
+export enum ApprovalTemplateVersionStatusEnum {
+  ARCHIVED = 'ARCHIVED',
+  DRAFT = 'DRAFT',
+  PUBLISHED = 'PUBLISHED',
+}
+
+export enum ApprovalTemplateListStatusEnum {
+  DRAFT = 'DRAFT',
+  PUBLISHED = 'PUBLISHED',
+}
+
+export enum ApprovalTemplateCategoryStatusEnum {
+  ACTIVE = 'ACTIVE',
+  ALL = 'ALL',
+  INACTIVE = 'INACTIVE',
+}
+
+registerEnumType(ApprovalTemplateVersionStatusEnum, {
+  name: 'ApprovalTemplateVersionStatus',
+});
+
+registerEnumType(ApprovalTemplateListStatusEnum, {
+  name: 'ApprovalTemplateListStatus',
+});
+
+registerEnumType(ApprovalTemplateCategoryStatusEnum, {
+  name: 'ApprovalTemplateCategoryStatus',
+});

package/src/lib/template/template.module.ts

@@ -0,0 +1,25 @@
+import { Module } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+import { ConditionModule } from '../condition/condition.module';
+import { FormDefinitionVersionEntity } from '../form/form-definition-version.entity';
+import { ApprovalTemplateCategoryEntity } from './approval-template-category.entity';
+import { ApprovalTemplateEntity } from './approval-template.entity';
+import { ApprovalTemplateVersionEntity } from './approval-template-version.entity';
+import { TemplateMutations } from './template.mutations';
+import { TemplateQueries } from './template.queries';
+import { TemplateService } from './template.service';
+
+@Module({
+  imports: [
+    ConditionModule,
+    TypeOrmModule.forFeature([
+      ApprovalTemplateCategoryEntity,
+      ApprovalTemplateEntity,
+      ApprovalTemplateVersionEntity,
+      FormDefinitionVersionEntity,
+    ]),
+  ],
+  providers: [TemplateMutations, TemplateQueries, TemplateService],
+  exports: [TemplateService],
+})
+export class TemplateModule {}

package/src/lib/template/template.mutations.ts

@@ -0,0 +1,106 @@
+import { Args, Mutation, Resolver } from '@nestjs/graphql';
+import { BPMCurrentMemberId, BPMDesignerOnly } from '../bpm-auth';
+import { ApprovalTemplateCategoryEntity } from './approval-template-category.entity';
+import { ApprovalTemplateEntity } from './approval-template.entity';
+import { ApprovalTemplateVersionEntity } from './approval-template-version.entity';
+import {
+  CreateApprovalTemplateCategoryInput,
+  CreateApprovalTemplateInput,
+  UpdateApprovalTemplateCategoryInput,
+  UpdateApprovalTemplateDraftInput,
+  UpdateApprovalTemplateInput,
+} from './dto/approval-template.input';
+import { TemplateService } from './template.service';
+
+@Resolver()
+@BPMDesignerOnly()
+export class TemplateMutations {
+  constructor(private readonly templateService: TemplateService) {}
+
+  @Mutation(() => ApprovalTemplateEntity)
+  async createApprovalTemplate(
+    @Args('input') input: CreateApprovalTemplateInput,
+    @BPMCurrentMemberId() currentMemberId: string,
+  ): Promise<ApprovalTemplateEntity> {
+    return this.templateService.createApprovalTemplate({
+      ...input,
+      createdByMemberId: currentMemberId,
+    });
+  }
+
+  @Mutation(() => ApprovalTemplateEntity)
+  async updateApprovalTemplate(
+    @Args('input') input: UpdateApprovalTemplateInput,
+  ): Promise<ApprovalTemplateEntity> {
+    return this.templateService.updateApprovalTemplate(input);
+  }
+
+  @Mutation(() => ApprovalTemplateCategoryEntity)
+  async createApprovalTemplateCategory(
+    @Args('input') input: CreateApprovalTemplateCategoryInput,
+  ): Promise<ApprovalTemplateCategoryEntity> {
+    return this.templateService.createApprovalTemplateCategory(input);
+  }
+
+  @Mutation(() => ApprovalTemplateCategoryEntity)
+  async updateApprovalTemplateCategory(
+    @Args('input') input: UpdateApprovalTemplateCategoryInput,
+  ): Promise<ApprovalTemplateCategoryEntity> {
+    return this.templateService.updateApprovalTemplateCategory(input);
+  }
+
+  @Mutation(() => ApprovalTemplateCategoryEntity)
+  async activateApprovalTemplateCategory(
+    @Args('id', { type: () => String }) id: string,
+  ): Promise<ApprovalTemplateCategoryEntity> {
+    return this.templateService.activateApprovalTemplateCategory(id);
+  }
+
+  @Mutation(() => ApprovalTemplateCategoryEntity)
+  async deactivateApprovalTemplateCategory(
+    @Args('id', { type: () => String }) id: string,
+  ): Promise<ApprovalTemplateCategoryEntity> {
+    return this.templateService.deactivateApprovalTemplateCategory(id);
+  }
+
+  @Mutation(() => ApprovalTemplateCategoryEntity)
+  async deleteApprovalTemplateCategory(
+    @Args('id', { type: () => String }) id: string,
+  ): Promise<ApprovalTemplateCategoryEntity> {
+    return this.templateService.deleteApprovalTemplateCategory(id);
+  }
+
+  @Mutation(() => ApprovalTemplateVersionEntity)
+  async updateApprovalTemplateDraft(
+    @Args('input') input: UpdateApprovalTemplateDraftInput,
+  ): Promise<ApprovalTemplateVersionEntity> {
+    return this.templateService.updateApprovalTemplateDraft(input);
+  }
+
+  @Mutation(() => ApprovalTemplateVersionEntity)
+  async forkApprovalTemplate(
+    @Args('templateId', { type: () => String }) templateId: string,
+  ): Promise<ApprovalTemplateVersionEntity> {
+    return this.templateService.forkApprovalTemplate(templateId);
+  }
+
+  @Mutation(() => ApprovalTemplateVersionEntity)
+  async publishApprovalTemplateVersion(
+    @Args('versionId', { type: () => String }) versionId: string,
+    @Args('publishedByMemberId', { nullable: true, type: () => String })
+    publishedByMemberId?: string,
+    @BPMCurrentMemberId() currentMemberId?: string,
+  ): Promise<ApprovalTemplateVersionEntity> {
+    return this.templateService.publishApprovalTemplateVersion(
+      versionId,
+      currentMemberId ?? publishedByMemberId,
+    );
+  }
+
+  @Mutation(() => ApprovalTemplateVersionEntity)
+  async rollbackApprovalTemplateVersion(
+    @Args('versionId', { type: () => String }) versionId: string,
+  ): Promise<ApprovalTemplateVersionEntity> {
+    return this.templateService.rollbackApprovalTemplateVersion(versionId);
+  }
+}