@rytass/bpm-core-nestjs-module 0.13.2 → 0.13.4

package/src/lib/workflow-webhook/workflow-webhook-secret-cipher.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowWebhookSecretCipher = void 0;
+exports.parseWorkflowWebhookSecretKey = parseWorkflowWebhookSecretKey;
+const node_crypto_1 = require("node:crypto");
+const ALGORITHM = 'aes-256-gcm';
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+const KEY_BYTES = 32;
+const ENVELOPE_PREFIX = 'v1:';
+/**
+ * Reads `workflowWebhookSecretEncryptionKey`: 32 bytes as 64 hex characters or
+ * base64. Anything else throws at boot, because a key that silently decodes
+ * to the wrong length would encrypt everything with a key nobody can
+ * reproduce. The message never echoes the key.
+ */
+function parseWorkflowWebhookSecretKey(value) {
+    const trimmed = value.trim();
+    const decoded = /^[0-9a-fA-F]{64}$/u.test(trimmed)
+        ? Buffer.from(trimmed, 'hex')
+        : /^[A-Za-z0-9+/]+={0,2}$/u.test(trimmed)
+            ? Buffer.from(trimmed, 'base64')
+            : null;
+    if (!decoded || decoded.length !== KEY_BYTES) {
+        throw new Error('workflowWebhookSecretEncryptionKey must be 32 bytes, as 64 hex characters or base64');
+    }
+    return decoded;
+}
+/**
+ * AES-256-GCM for the header values and signing secrets of database-managed
+ * webhook endpoints (ADR 18 §3.13). The envelope is
+ * `v1:<base64(iv | tag | ciphertext)>`, so a future key or algorithm change
+ * can tell old values apart. Decryption fails loudly on a wrong key or a
+ * tampered value instead of returning garbage.
+ */
+class WorkflowWebhookSecretCipher {
+    constructor(key) {
+        this.key = parseWorkflowWebhookSecretKey(key);
+    }
+    encrypt(plaintext) {
+        const iv = (0, node_crypto_1.randomBytes)(IV_BYTES);
+        const cipher = (0, node_crypto_1.createCipheriv)(ALGORITHM, this.key, iv);
+        const ciphertext = Buffer.concat([
+            cipher.update(plaintext, 'utf8'),
+            cipher.final(),
+        ]);
+        return `${ENVELOPE_PREFIX}${Buffer.concat([iv, cipher.getAuthTag(), ciphertext]).toString('base64')}`;
+    }
+    decrypt(envelope) {
+        if (!envelope.startsWith(ENVELOPE_PREFIX)) {
+            throw new Error('Unsupported webhook secret envelope');
+        }
+        const raw = Buffer.from(envelope.slice(ENVELOPE_PREFIX.length), 'base64');
+        if (raw.length < IV_BYTES + TAG_BYTES) {
+            throw new Error('Malformed webhook secret envelope');
+        }
+        const decipher = (0, node_crypto_1.createDecipheriv)(ALGORITHM, this.key, raw.subarray(0, IV_BYTES));
+        decipher.setAuthTag(raw.subarray(IV_BYTES, IV_BYTES + TAG_BYTES));
+        return Buffer.concat([
+            decipher.update(raw.subarray(IV_BYTES + TAG_BYTES)),
+            decipher.final(),
+        ]).toString('utf8');
+    }
+}
+exports.WorkflowWebhookSecretCipher = WorkflowWebhookSecretCipher;
+//# sourceMappingURL=workflow-webhook-secret-cipher.js.map

package/src/lib/workflow-webhook/workflow-webhook-secret-cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook-secret-cipher.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/workflow-webhook-secret-cipher.ts"],"names":[],"mappings":";;;AAcA,sEAeC;AA7BD,6CAA4E;AAE5E,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B;;;;;GAKG;AACH,SAAgB,6BAA6B,CAAC,KAAa;IACzD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;QAChD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC;QAC7B,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC;YACvC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;YAChC,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAa,2BAA2B;IAGtC,YAAY,GAAW;QACrB,IAAI,CAAC,GAAG,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,CAAC,SAAiB;QACvB,MAAM,EAAE,GAAG,IAAA,yBAAW,EAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;YAChC,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QAEH,OAAO,GAAG,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxG,CAAC;IAED,OAAO,CAAC,QAAgB;QACtB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;QAE1E,IAAI,GAAG,CAAC,MAAM,GAAG,QAAQ,GAAG,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAC/B,SAAS,EACT,IAAI,CAAC,GAAG,EACR,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAC1B,CAAC;QAEF,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC;QAElE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;YACnD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;CACF;AA1CD,kEA0CC"}

package/src/lib/workflow-webhook/workflow-webhook.errors.d.ts

@@ -0,0 +1,35 @@
+import { BadRequestException } from '@nestjs/common';
+export declare const BPM_WORKFLOW_WEBHOOK_ERROR_CODES: {
+    readonly BINDING_INCOMPATIBLE: "WORKFLOW_WEBHOOK_BINDING_INCOMPATIBLE";
+    /** A database endpoint cannot be managed: the source is not enabled. */
+    readonly DATABASE_SOURCE_DISABLED: "WORKFLOW_WEBHOOK_DATABASE_SOURCE_DISABLED";
+    /** A database endpoint was saved with a key a registered endpoint uses. */
+    readonly ENDPOINT_KEY_CONFLICT: "WORKFLOW_WEBHOOK_ENDPOINT_KEY_CONFLICT";
+    /** The saved endpoint's shape is invalid (key, version, parameters, headers). */
+    readonly ENDPOINT_INVALID: "WORKFLOW_WEBHOOK_ENDPOINT_INVALID";
+    /**
+     * An existing endpoint version's parameters were changed; a new contract
+     * needs a new version so in-flight templates keep theirs.
+     */
+    readonly ENDPOINT_CONTRACT_CHANGED: "WORKFLOW_WEBHOOK_ENDPOINT_CONTRACT_CHANGED";
+    readonly ENDPOINT_DEPRECATED: "WORKFLOW_WEBHOOK_ENDPOINT_DEPRECATED";
+    /** A database endpoint an administrator disabled. */
+    readonly ENDPOINT_DISABLED: "WORKFLOW_WEBHOOK_ENDPOINT_DISABLED";
+    readonly ENDPOINT_MISSING: "WORKFLOW_WEBHOOK_ENDPOINT_MISSING";
+    readonly PARAMETER_REQUIRED: "WORKFLOW_WEBHOOK_PARAMETER_REQUIRED";
+    readonly PARAMETER_UNKNOWN: "WORKFLOW_WEBHOOK_PARAMETER_UNKNOWN";
+    readonly REGISTRY_MISSING: "WORKFLOW_WEBHOOK_REGISTRY_MISSING";
+    /** Test sends for one endpoint came too close together. */
+    readonly TEST_RATE_LIMITED: "WORKFLOW_WEBHOOK_TEST_RATE_LIMITED";
+    /**
+     * The endpoint's URL is outside `workflowWebhookAllowedUrlPatterns`.
+     * Raised when a database-managed endpoint is saved (P6) and again before
+     * every delivery attempt (P2), so tightening the list stops queued work.
+     */
+    readonly URL_NOT_ALLOWED: "WORKFLOW_WEBHOOK_URL_NOT_ALLOWED";
+};
+export type BPMWorkflowWebhookErrorCode = (typeof BPM_WORKFLOW_WEBHOOK_ERROR_CODES)[keyof typeof BPM_WORKFLOW_WEBHOOK_ERROR_CODES];
+export declare class BPMWorkflowWebhookException extends BadRequestException {
+    readonly code: BPMWorkflowWebhookErrorCode;
+    constructor(code: BPMWorkflowWebhookErrorCode, detail?: string);
+}

package/src/lib/workflow-webhook/workflow-webhook.errors.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BPMWorkflowWebhookException = exports.BPM_WORKFLOW_WEBHOOK_ERROR_CODES = void 0;
+const common_1 = require("@nestjs/common");
+exports.BPM_WORKFLOW_WEBHOOK_ERROR_CODES = {
+    BINDING_INCOMPATIBLE: 'WORKFLOW_WEBHOOK_BINDING_INCOMPATIBLE',
+    /** A database endpoint cannot be managed: the source is not enabled. */
+    DATABASE_SOURCE_DISABLED: 'WORKFLOW_WEBHOOK_DATABASE_SOURCE_DISABLED',
+    /** A database endpoint was saved with a key a registered endpoint uses. */
+    ENDPOINT_KEY_CONFLICT: 'WORKFLOW_WEBHOOK_ENDPOINT_KEY_CONFLICT',
+    /** The saved endpoint's shape is invalid (key, version, parameters, headers). */
+    ENDPOINT_INVALID: 'WORKFLOW_WEBHOOK_ENDPOINT_INVALID',
+    /**
+     * An existing endpoint version's parameters were changed; a new contract
+     * needs a new version so in-flight templates keep theirs.
+     */
+    ENDPOINT_CONTRACT_CHANGED: 'WORKFLOW_WEBHOOK_ENDPOINT_CONTRACT_CHANGED',
+    ENDPOINT_DEPRECATED: 'WORKFLOW_WEBHOOK_ENDPOINT_DEPRECATED',
+    /** A database endpoint an administrator disabled. */
+    ENDPOINT_DISABLED: 'WORKFLOW_WEBHOOK_ENDPOINT_DISABLED',
+    ENDPOINT_MISSING: 'WORKFLOW_WEBHOOK_ENDPOINT_MISSING',
+    PARAMETER_REQUIRED: 'WORKFLOW_WEBHOOK_PARAMETER_REQUIRED',
+    PARAMETER_UNKNOWN: 'WORKFLOW_WEBHOOK_PARAMETER_UNKNOWN',
+    REGISTRY_MISSING: 'WORKFLOW_WEBHOOK_REGISTRY_MISSING',
+    /** Test sends for one endpoint came too close together. */
+    TEST_RATE_LIMITED: 'WORKFLOW_WEBHOOK_TEST_RATE_LIMITED',
+    /**
+     * The endpoint's URL is outside `workflowWebhookAllowedUrlPatterns`.
+     * Raised when a database-managed endpoint is saved (P6) and again before
+     * every delivery attempt (P2), so tightening the list stops queued work.
+     */
+    URL_NOT_ALLOWED: 'WORKFLOW_WEBHOOK_URL_NOT_ALLOWED',
+};
+class BPMWorkflowWebhookException extends common_1.BadRequestException {
+    constructor(code, detail) {
+        super({ code, message: detail ? `${code}: ${detail}` : code });
+        this.code = code;
+    }
+}
+exports.BPMWorkflowWebhookException = BPMWorkflowWebhookException;
+//# sourceMappingURL=workflow-webhook.errors.js.map

package/src/lib/workflow-webhook/workflow-webhook.errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook.errors.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/workflow-webhook.errors.ts"],"names":[],"mappings":";;;AAAA,2CAAqD;AAExC,QAAA,gCAAgC,GAAG;IAC9C,oBAAoB,EAAE,uCAAuC;IAC7D,wEAAwE;IACxE,wBAAwB,EAAE,2CAA2C;IACrE,2EAA2E;IAC3E,qBAAqB,EAAE,wCAAwC;IAC/D,iFAAiF;IACjF,gBAAgB,EAAE,mCAAmC;IACrD;;;OAGG;IACH,yBAAyB,EAAE,4CAA4C;IACvE,mBAAmB,EAAE,sCAAsC;IAC3D,qDAAqD;IACrD,iBAAiB,EAAE,oCAAoC;IACvD,gBAAgB,EAAE,mCAAmC;IACrD,kBAAkB,EAAE,qCAAqC;IACzD,iBAAiB,EAAE,oCAAoC;IACvD,gBAAgB,EAAE,mCAAmC;IACrD,2DAA2D;IAC3D,iBAAiB,EAAE,oCAAoC;IACvD;;;;OAIG;IACH,eAAe,EAAE,kCAAkC;CAC3C,CAAC;AAKX,MAAa,2BAA4B,SAAQ,4BAAmB;IAGlE,YAAY,IAAiC,EAAE,MAAe;QAC5D,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,kEAOC"}

package/src/lib/workflow-webhook/workflow-webhook.module.d.ts

@@ -0,0 +1,9 @@
+import { DynamicModule, Provider } from '@nestjs/common';
+import { ModuleMetadata } from '@nestjs/common/interfaces';
+import { BPMWorkflowWebhookRegistry } from './workflow-webhook.types';
+export interface WorkflowWebhookModuleOptions extends Pick<ModuleMetadata, 'imports'> {
+    readonly registryProvider?: Provider<BPMWorkflowWebhookRegistry>;
+}
+export declare class WorkflowWebhookModule {
+    static forRoot(options?: WorkflowWebhookModuleOptions): DynamicModule;
+}

package/src/lib/workflow-webhook/workflow-webhook.module.js

@@ -0,0 +1,62 @@
+"use strict";
+var WorkflowWebhookModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowWebhookModule = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const activity_log_entity_1 = require("../workflow-engine/activity-log.entity");
+const workflow_webhook_database_source_1 = require("./workflow-webhook-database-source");
+const workflow_webhook_delivery_scheduler_service_1 = require("./workflow-webhook-delivery-scheduler.service");
+const workflow_webhook_delivery_entity_1 = require("./workflow-webhook-delivery.entity");
+const workflow_webhook_delivery_resolver_1 = require("./workflow-webhook-delivery.resolver");
+const workflow_webhook_delivery_service_1 = require("./workflow-webhook-delivery.service");
+const workflow_webhook_delivery_subscriber_1 = require("./workflow-webhook-delivery.subscriber");
+const workflow_webhook_endpoint_admin_resolver_1 = require("./workflow-webhook-endpoint-admin.resolver");
+const workflow_webhook_endpoint_admin_service_1 = require("./workflow-webhook-endpoint-admin.service");
+const workflow_webhook_endpoint_entity_1 = require("./workflow-webhook-endpoint.entity");
+const workflow_webhook_provider_1 = require("./workflow-webhook.provider");
+const workflow_webhook_queries_1 = require("./workflow-webhook.queries");
+const workflow_webhook_service_1 = require("./workflow-webhook.service");
+const workflow_webhook_types_1 = require("./workflow-webhook.types");
+let WorkflowWebhookModule = WorkflowWebhookModule_1 = class WorkflowWebhookModule {
+    static forRoot(options = {}) {
+        const registryProvider = options.registryProvider ?? workflow_webhook_provider_1.defaultWorkflowWebhookRegistryProvider;
+        return {
+            exports: [
+                workflow_webhook_types_1.BPM_WORKFLOW_WEBHOOK_REGISTRY,
+                workflow_webhook_delivery_service_1.WorkflowWebhookDeliveryService,
+                workflow_webhook_service_1.WorkflowWebhookService,
+            ],
+            global: true,
+            imports: [
+                ...(options.imports ?? []),
+                typeorm_1.TypeOrmModule.forFeature([
+                    activity_log_entity_1.ActivityLogEntity,
+                    workflow_webhook_delivery_entity_1.WorkflowWebhookDeliveryEntity,
+                    workflow_webhook_endpoint_entity_1.WorkflowWebhookEndpointAuditEntity,
+                    workflow_webhook_endpoint_entity_1.WorkflowWebhookEndpointEntity,
+                ]),
+            ],
+            module: WorkflowWebhookModule_1,
+            providers: [
+                registryProvider,
+                workflow_webhook_database_source_1.DatabaseWorkflowWebhookEndpointSource,
+                workflow_webhook_endpoint_admin_resolver_1.WorkflowWebhookEndpointAdminResolver,
+                workflow_webhook_endpoint_admin_service_1.WorkflowWebhookEndpointAdminService,
+                workflow_webhook_delivery_resolver_1.WorkflowWebhookDeliveryResolver,
+                workflow_webhook_delivery_scheduler_service_1.WorkflowWebhookDeliverySchedulerService,
+                workflow_webhook_delivery_service_1.WorkflowWebhookDeliveryService,
+                workflow_webhook_delivery_subscriber_1.WorkflowWebhookDeliverySubscriber,
+                workflow_webhook_queries_1.WorkflowWebhookQueries,
+                workflow_webhook_service_1.WorkflowWebhookService,
+            ],
+        };
+    }
+};
+exports.WorkflowWebhookModule = WorkflowWebhookModule;
+exports.WorkflowWebhookModule = WorkflowWebhookModule = WorkflowWebhookModule_1 = tslib_1.__decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({})
+], WorkflowWebhookModule);
+//# sourceMappingURL=workflow-webhook.module.js.map

package/src/lib/workflow-webhook/workflow-webhook.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook.module.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/workflow-webhook.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAAyE;AAEzE,6CAAgD;AAChD,gFAA2E;AAC3E,yFAA2F;AAC3F,+GAAwG;AACxG,yFAAmF;AACnF,6FAAuF;AACvF,2FAAqF;AACrF,iGAA2F;AAC3F,yGAAkG;AAClG,uGAAgG;AAChG,yFAG4C;AAC5C,2EAAqF;AACrF,yEAAoE;AACpE,yEAAoE;AACpE,qEAGkC;AAW3B,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAChC,MAAM,CAAC,OAAO,CAAC,UAAwC,EAAE;QACvD,MAAM,gBAAgB,GACpB,OAAO,CAAC,gBAAgB,IAAI,kEAAsC,CAAC;QAErE,OAAO;YACL,OAAO,EAAE;gBACP,sDAA6B;gBAC7B,kEAA8B;gBAC9B,iDAAsB;aACvB;YACD,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC1B,uBAAa,CAAC,UAAU,CAAC;oBACvB,uCAAiB;oBACjB,gEAA6B;oBAC7B,qEAAkC;oBAClC,gEAA6B;iBAC9B,CAAC;aACH;YACD,MAAM,EAAE,uBAAqB;YAC7B,SAAS,EAAE;gBACT,gBAAgB;gBAChB,wEAAqC;gBACrC,+EAAoC;gBACpC,6EAAmC;gBACnC,oEAA+B;gBAC/B,qFAAuC;gBACvC,kEAA8B;gBAC9B,wEAAiC;gBACjC,iDAAsB;gBACtB,iDAAsB;aACvB;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AApCY,sDAAqB;gCAArB,qBAAqB;IAFjC,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,qBAAqB,CAoCjC"}

package/src/lib/workflow-webhook/workflow-webhook.provider.d.ts

@@ -0,0 +1,12 @@
+import { Provider } from '@nestjs/common';
+import { BPMWorkflowWebhookRegistry } from './workflow-webhook.types';
+/**
+ * Endpoint catalog used when the host registers none: empty, so a template
+ * cannot reference an endpoint and publish still refuses one that tries.
+ *
+ * Mirrors `defaultFormDataSourceRegistryProvider`: prefer a registry handed to
+ * `BPMRootModule` as a runtime value, which a `forRootAsync` factory can build
+ * once Vault is available. `BPM_ROOT_OPTIONS` is optional so this module also
+ * resolves when used on its own.
+ */
+export declare const defaultWorkflowWebhookRegistryProvider: Provider<BPMWorkflowWebhookRegistry>;

package/src/lib/workflow-webhook/workflow-webhook.provider.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultWorkflowWebhookRegistryProvider = void 0;
+const bpm_root_options_1 = require("../bpm/bpm-root-options");
+const workflow_webhook_types_1 = require("./workflow-webhook.types");
+/**
+ * Endpoint catalog used when the host registers none: empty, so a template
+ * cannot reference an endpoint and publish still refuses one that tries.
+ *
+ * Mirrors `defaultFormDataSourceRegistryProvider`: prefer a registry handed to
+ * `BPMRootModule` as a runtime value, which a `forRootAsync` factory can build
+ * once Vault is available. `BPM_ROOT_OPTIONS` is optional so this module also
+ * resolves when used on its own.
+ */
+exports.defaultWorkflowWebhookRegistryProvider = {
+    inject: [{ optional: true, token: bpm_root_options_1.BPM_ROOT_OPTIONS }],
+    provide: workflow_webhook_types_1.BPM_WORKFLOW_WEBHOOK_REGISTRY,
+    useFactory: (rootOptions) => rootOptions?.workflowWebhookRegistry ??
+        new workflow_webhook_types_1.EmptyBPMWorkflowWebhookRegistry(),
+};
+//# sourceMappingURL=workflow-webhook.provider.js.map

package/src/lib/workflow-webhook/workflow-webhook.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook.provider.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/workflow-webhook.provider.ts"],"names":[],"mappings":";;;AACA,8DAGiC;AACjC,qEAIkC;AAElC;;;;;;;;GAQG;AACU,QAAA,sCAAsC,GACjD;IACE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,mCAAgB,EAAE,CAAC;IACrD,OAAO,EAAE,sDAA6B;IACtC,UAAU,EAAE,CACV,WAA8C,EAClB,EAAE,CAC9B,WAAW,EAAE,uBAAuB;QACpC,IAAI,wDAA+B,EAAE;CACxC,CAAC"}

package/src/lib/workflow-webhook/workflow-webhook.queries.d.ts

@@ -0,0 +1,38 @@
+import { NotifyWebhookParameterType } from '@rytass/bpm-core-shared/workflow';
+import { WorkflowWebhookService } from './workflow-webhook.service';
+import { BPMWorkflowWebhookEndpointSourceKind } from './workflow-webhook.types';
+export declare const WorkflowWebhookEndpointSourceEnum: Readonly<Record<BPMWorkflowWebhookEndpointSourceKind, BPMWorkflowWebhookEndpointSourceKind>>;
+export declare const WorkflowWebhookParameterTypeEnum: Readonly<Record<NotifyWebhookParameterType, NotifyWebhookParameterType>>;
+export declare class WorkflowWebhookParameterObject {
+    description: string | null;
+    key: string;
+    label: string;
+    required: boolean;
+    type: NotifyWebhookParameterType;
+}
+/**
+ * The designer's view of an endpoint. Deliberately carries no URL, header or
+ * secret (ADR 18 §3.8): those never reach the browser, whichever source the
+ * endpoint came from.
+ */
+export declare class WorkflowWebhookEndpointObject {
+    deprecated: boolean;
+    description: string | null;
+    /** Switched off by an administrator; also reported as `deprecated`. */
+    disabled: boolean;
+    key: string;
+    label: string;
+    parameters: readonly WorkflowWebhookParameterObject[];
+    source: BPMWorkflowWebhookEndpointSourceKind;
+    version: number;
+}
+export declare class WorkflowWebhookQueries {
+    private readonly webhookService;
+    constructor(webhookService: WorkflowWebhookService);
+    /**
+     * `includeDeprecated` exists for the designer's edit path: a draft that
+     * already references a deprecated endpoint must still render its name
+     * instead of silently losing the target.
+     */
+    workflowWebhookEndpoints(includeDeprecated?: boolean | null): Promise<readonly WorkflowWebhookEndpointObject[]>;
+}

package/src/lib/workflow-webhook/workflow-webhook.queries.js

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowWebhookQueries = exports.WorkflowWebhookEndpointObject = exports.WorkflowWebhookParameterObject = exports.WorkflowWebhookParameterTypeEnum = exports.WorkflowWebhookEndpointSourceEnum = void 0;
+const tslib_1 = require("tslib");
+const graphql_1 = require("@nestjs/graphql");
+const bpm_auth_1 = require("../bpm-auth");
+const workflow_webhook_service_1 = require("./workflow-webhook.service");
+exports.WorkflowWebhookEndpointSourceEnum = {
+    DATABASE: 'DATABASE',
+    REGISTRY: 'REGISTRY',
+};
+(0, graphql_1.registerEnumType)(exports.WorkflowWebhookEndpointSourceEnum, {
+    name: 'BPMWorkflowWebhookEndpointSource',
+});
+exports.WorkflowWebhookParameterTypeEnum = {
+    boolean: 'boolean',
+    json: 'json',
+    number: 'number',
+    string: 'string',
+    stringArray: 'stringArray',
+};
+(0, graphql_1.registerEnumType)(exports.WorkflowWebhookParameterTypeEnum, {
+    name: 'BPMWorkflowWebhookParameterType',
+});
+let WorkflowWebhookParameterObject = class WorkflowWebhookParameterObject {
+};
+exports.WorkflowWebhookParameterObject = WorkflowWebhookParameterObject;
+tslib_1.__decorate([
+    (0, graphql_1.Field)(() => String, { nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], WorkflowWebhookParameterObject.prototype, "description", void 0);
+tslib_1.__decorate([
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", String)
+], WorkflowWebhookParameterObject.prototype, "key", void 0);
+tslib_1.__decorate([
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", String)
+], WorkflowWebhookParameterObject.prototype, "label", void 0);
+tslib_1.__decorate([
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", Boolean)
+], WorkflowWebhookParameterObject.prototype, "required", void 0);
+tslib_1.__decorate([
+    (0, graphql_1.Field)(() => exports.WorkflowWebhookParameterTypeEnum),
+    tslib_1.__metadata("design:type", String)
+], WorkflowWebhookParameterObject.prototype, "type", void 0);
+exports.WorkflowWebhookParameterObject = WorkflowWebhookParameterObject = tslib_1.__decorate([
+    (0, graphql_1.ObjectType)('BPMWorkflowWebhookParameter')
+], WorkflowWebhookParameterObject);
+/**
+ * The designer's view of an endpoint. Deliberately carries no URL, header or
+ * secret (ADR 18 §3.8): those never reach the browser, whichever source the
+ * endpoint came from.
+ */
+let WorkflowWebhookEndpointObject = class WorkflowWebhookEndpointObject {
+};
+exports.WorkflowWebhookEndpointObject = WorkflowWebhookEndpointObject;
+tslib_1.__decorate([
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", Boolean)
+], WorkflowWebhookEndpointObject.prototype, "deprecated", void 0);
+tslib_1.__decorate([
+    (0, graphql_1.Field)(() => String, { nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], WorkflowWebhookEndpointObject.prototype, "description", void 0);
+tslib_1.__decorate([
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", Boolean)
+], WorkflowWebhookEndpointObject.prototype, "disabled", void 0);
+tslib_1.__decorate([
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", String)
+], WorkflowWebhookEndpointObject.prototype, "key", void 0);
+tslib_1.__decorate([
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", String)
+], WorkflowWebhookEndpointObject.prototype, "label", void 0);
+tslib_1.__decorate([
+    (0, graphql_1.Field)(() => [WorkflowWebhookParameterObject]),
+    tslib_1.__metadata("design:type", Array)
+], WorkflowWebhookEndpointObject.prototype, "parameters", void 0);
+tslib_1.__decorate([
+    (0, graphql_1.Field)(() => exports.WorkflowWebhookEndpointSourceEnum),
+    tslib_1.__metadata("design:type", String)
+], WorkflowWebhookEndpointObject.prototype, "source", void 0);
+tslib_1.__decorate([
+    (0, graphql_1.Field)(() => graphql_1.Int),
+    tslib_1.__metadata("design:type", Number)
+], WorkflowWebhookEndpointObject.prototype, "version", void 0);
+exports.WorkflowWebhookEndpointObject = WorkflowWebhookEndpointObject = tslib_1.__decorate([
+    (0, graphql_1.ObjectType)('BPMWorkflowWebhookEndpoint')
+], WorkflowWebhookEndpointObject);
+let WorkflowWebhookQueries = class WorkflowWebhookQueries {
+    constructor(webhookService) {
+        this.webhookService = webhookService;
+    }
+    /**
+     * `includeDeprecated` exists for the designer's edit path: a draft that
+     * already references a deprecated endpoint must still render its name
+     * instead of silently losing the target.
+     */
+    async workflowWebhookEndpoints(includeDeprecated) {
+        const entries = await this.webhookService.listEndpoints({
+            includeDeprecated: Boolean(includeDeprecated),
+        });
+        return entries.map((entry) => toEndpointObject(entry));
+    }
+};
+exports.WorkflowWebhookQueries = WorkflowWebhookQueries;
+tslib_1.__decorate([
+    (0, graphql_1.Query)(() => [WorkflowWebhookEndpointObject]),
+    tslib_1.__param(0, (0, graphql_1.Args)('includeDeprecated', { nullable: true, type: () => Boolean })),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WorkflowWebhookQueries.prototype, "workflowWebhookEndpoints", null);
+exports.WorkflowWebhookQueries = WorkflowWebhookQueries = tslib_1.__decorate([
+    (0, graphql_1.Resolver)(),
+    (0, bpm_auth_1.BPMDesignerOnly)(),
+    tslib_1.__metadata("design:paramtypes", [workflow_webhook_service_1.WorkflowWebhookService])
+], WorkflowWebhookQueries);
+function toEndpointObject(entry) {
+    const descriptor = entry.endpoint.descriptor;
+    return Object.assign(new WorkflowWebhookEndpointObject(), {
+        deprecated: Boolean(descriptor.deprecated),
+        description: descriptor.description ?? null,
+        disabled: Boolean(descriptor.disabled),
+        key: descriptor.key,
+        label: descriptor.label,
+        parameters: descriptor.parameters.map((parameter) => Object.assign(new WorkflowWebhookParameterObject(), {
+            description: parameter.description ?? null,
+            key: parameter.key,
+            label: parameter.label,
+            required: parameter.required,
+            type: parameter.type,
+        })),
+        source: entry.source,
+        version: descriptor.version,
+    });
+}
+//# sourceMappingURL=workflow-webhook.queries.js.map

package/src/lib/workflow-webhook/workflow-webhook.queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook.queries.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/workflow-webhook.queries.ts"],"names":[],"mappings":";;;;AAAA,6CAQyB;AAEzB,0CAA8C;AAC9C,yEAAoE;AAMvD,QAAA,iCAAiC,GAK1C;IACF,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;CACrB,CAAC;AAEF,IAAA,0BAAgB,EAAC,yCAAiC,EAAE;IAClD,IAAI,EAAE,kCAAkC;CACzC,CAAC,CAAC;AAEU,QAAA,gCAAgC,GAEzC;IACF,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,aAAa;CAC3B,CAAC;AAEF,IAAA,0BAAgB,EAAC,wCAAgC,EAAE;IACjD,IAAI,EAAE,iCAAiC;CACxC,CAAC,CAAC;AAGI,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;CAe1C,CAAA;AAfY,wEAA8B;AAEzC;IADC,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mEACZ;AAG5B;IADC,IAAA,eAAK,GAAE;;2DACK;AAGb;IADC,IAAA,eAAK,GAAE;;6DACO;AAGf;IADC,IAAA,eAAK,GAAE;;gEACW;AAGnB;IADC,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,wCAAgC,CAAC;;4DACZ;yCAdvB,8BAA8B;IAD1C,IAAA,oBAAU,EAAC,6BAA6B,CAAC;GAC7B,8BAA8B,CAe1C;AAED;;;;GAIG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;CAyBzC,CAAA;AAzBY,sEAA6B;AAExC;IADC,IAAA,eAAK,GAAE;;iEACa;AAGrB;IADC,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kEACZ;AAI5B;IADC,IAAA,eAAK,GAAE;;+DACW;AAGnB;IADC,IAAA,eAAK,GAAE;;0DACK;AAGb;IADC,IAAA,eAAK,GAAE;;4DACO;AAGf;IADC,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,CAAC,8BAA8B,CAAC,CAAC;;iEACS;AAGvD;IADC,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,yCAAiC,CAAC;;6DACD;AAG9C;IADC,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,aAAG,CAAC;;8DACA;wCAxBN,6BAA6B;IADzC,IAAA,oBAAU,EAAC,4BAA4B,CAAC;GAC5B,6BAA6B,CAyBzC;AAIM,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAA6B,cAAsC;QAAtC,mBAAc,GAAd,cAAc,CAAwB;IAAG,CAAC;IAEvE;;;;OAIG;IAEG,AAAN,KAAK,CAAC,wBAAwB,CAE5B,iBAAkC;QAElC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC;YACtD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,CAAC;SAC9C,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;CACF,CAAA;AAnBY,wDAAsB;AAS3B;IADL,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,CAAC,6BAA6B,CAAC,CAAC;IAE1C,mBAAA,IAAA,cAAI,EAAC,mBAAmB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;;;;sEAQpE;iCAlBU,sBAAsB;IAFlC,IAAA,kBAAQ,GAAE;IACV,IAAA,0BAAe,GAAE;6CAE6B,iDAAsB;GADxD,sBAAsB,CAmBlC;AAED,SAAS,gBAAgB,CACvB,KAAsC;IAEtC,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;IAE7C,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,6BAA6B,EAAE,EAAE;QACxD,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QAC1C,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,IAAI;QAC3C,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QACtC,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAClD,MAAM,CAAC,MAAM,CAAC,IAAI,8BAA8B,EAAE,EAAE;YAClD,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,IAAI;YAC1C,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB,CAAC,CACH;QACD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC,CAAC;AACL,CAAC"}

package/src/lib/workflow-webhook/workflow-webhook.service.d.ts

@@ -0,0 +1,50 @@
+import { OnModuleInit } from '@nestjs/common';
+import { EntityManager } from 'typeorm';
+import { DatabaseWorkflowWebhookEndpointSource } from './workflow-webhook-database-source';
+import { BPMResolvedWorkflowWebhookOptions } from './workflow-webhook-options';
+import { BPMWorkflowWebhookEndpoint, BPMWorkflowWebhookEndpointEntry, BPMWorkflowWebhookRegistry } from './workflow-webhook.types';
+export interface ListWorkflowWebhookEndpointsOptions {
+    readonly includeDeprecated?: boolean;
+}
+export declare class WorkflowWebhookService implements OnModuleInit {
+    private readonly registry;
+    private readonly options;
+    private readonly databaseSource?;
+    private readonly sources;
+    constructor(registry: BPMWorkflowWebhookRegistry | undefined, options?: BPMResolvedWorkflowWebhookOptions, databaseSource?: DatabaseWorkflowWebhookEndpointSource | undefined);
+    /**
+     * Whether administrators can manage endpoints in the database: requested
+     * in `workflowWebhookTargetSources` and guarded by an allowlist and an
+     * encryption key (otherwise the options resolution dropped it).
+     */
+    hasDatabaseSource(): boolean;
+    /** Registered endpoints only; used to keep database keys from colliding. */
+    listRegistryEndpoints(): readonly BPMWorkflowWebhookEndpoint[];
+    /**
+     * A descriptor that contradicts itself would only surface as a confusing
+     * publish error much later, so the registry is checked once at boot and the
+     * application refuses to start instead.
+     */
+    onModuleInit(): void;
+    /**
+     * `false` when no source can ever answer, which is what a publish lint needs
+     * in order to refuse a template that references any endpoint at all.
+     */
+    hasEndpointSources(): boolean;
+    listEndpoints(options?: ListWorkflowWebhookEndpointsOptions): Promise<readonly BPMWorkflowWebhookEndpointEntry[]>;
+    /**
+     * `manager` lets a caller already inside a transaction (the engine's
+     * enqueue) look endpoints up on its own connection, instead of waiting on
+     * a second one from a pool its peers may have exhausted.
+     */
+    getEndpoint(key: string, version: number, manager?: EntityManager): Promise<BPMWorkflowWebhookEndpointEntry | null>;
+    readOptions(): BPMResolvedWorkflowWebhookOptions;
+    /**
+     * The publish-time allowlist check (ADR 18 §3.13 rule 3). Database
+     * endpoints only: calling host code while publishing would be a surprise,
+     * and registry URLs are checked before each delivery when enforcement is
+     * on. A URL that cannot be read here is left to the delivery path.
+     */
+    isEndpointUrlAllowedAtPublish(entry: BPMWorkflowWebhookEndpointEntry): Promise<boolean>;
+}
+export declare function readRegistryDescriptorErrors(registry: BPMWorkflowWebhookRegistry | undefined): readonly string[];