@rytass/bpm-core-nestjs-module 0.14.0 → 0.16.2

package/CHANGELOG.md

@@ -1,3 +1,103 @@
+## 0.16.2 (2026-10-14)
+
+### 🚀 Features
+
+- **react:** support react-pdf 11 and pdfjs-dist 6 in the PDF preview ([ab7f3ca](https://github.com/Rytass/BPMCore/commit/ab7f3ca))
+
+### 🩹 Fixes
+
+- **workflow-engine:** count only the member's own tasks on the dashboard ([8f12de3](https://github.com/Rytass/BPMCore/commit/8f12de3))
+
+### ❤️ Thank You
+
+- Chia Yu Pai @fantasywind
+- Kai-Chieh Yang
+
+## 0.16.0 (2026-10-13)
+
+### 🚀 Features
+
+- ⚠️  **attachment:** boot without attachment settings ([808bc65](https://github.com/Rytass/BPMCore/commit/808bc65))
+
+### ⚠️  Breaking Changes
+
+- **attachment:** boot without attachment settings  ([808bc65](https://github.com/Rytass/BPMCore/commit/808bc65))
+  BPMResolvedAttachmentOptions.publicBaseUrl is
+  string | null, DEFAULT_BPM_ATTACHMENT_OPTIONS no longer carries a
+  signedUrlSecret, and attachmentAllowInsecureSignedUrlSecret is
+  deprecated and ignored. A host running more than one API replica must
+  set a shared attachmentSignedUrlSecret, since a generated one only
+  verifies on the process that signed the URL.
+  Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
+
+### ❤️ Thank You
+
+- Chia Yu Pai @fantasywind
+- Claude Opus 5.5
+
+## 0.15.0 (2026-10-13)
+
+### ⚠️  Breaking Changes
+
+- **workflow-engine / organization:** the engine now reads "today" in the organization time zone (`organizationTimeZone`, default `Asia/Taipei`) instead of UTC. For a membership or manager rule whose `effectiveFrom` / `effectiveTo` is today, approver resolution applies or retires it from local midnight — up to eight hours earlier than before in UTC+8. A host whose organization dates are kept in UTC sets `organizationTimeZone: 'UTC'` before upgrading. Running instances keep their tasks. ([d6e43f3](https://github.com/Rytass/BPMCore/commit/d6e43f3); this note was missing from the generated changelog because the footer sits on a `docs:` commit)
+- **template:** publishing now refuses a `DYNAMIC_FORM` resolver whose member field can be left empty — the field must be `required`, not `hidden`, and have no `visibleWhen`. Drafts still save; versions already published are not re-validated. ([b3a3950](https://github.com/Rytass/BPMCore/commit/b3a3950))
+
+### 🗄️ Upgrade
+
+- New migrations add nullable columns and indexes only; no data is dropped. Hosts run with `migrationsRun: false`, so **run the migrations before deploying 0.15.0**.
+
+### 🚀 Features
+
+- **organization:** read effective dates in a configurable organizationTimeZone ([905982c](https://github.com/Rytass/BPMCore/commit/905982c))
+- **forms:** add store-only hidden fields and link display for text fields ([ae38a92](https://github.com/Rytass/BPMCore/commit/ae38a92))
+- **workflow-engine:** expose the node name on tasks as nodeLabel ([25b0705](https://github.com/Rytass/BPMCore/commit/25b0705))
+- **workflow-engine:** tell the applicant who submitted the document on their behalf ([3a20985](https://github.com/Rytass/BPMCore/commit/3a20985))
+- **workflow-engine:** let the member who submitted for the applicant read the instance ([7416df8](https://github.com/Rytass/BPMCore/commit/7416df8))
+- **workflow-engine:** keep the member who submitted on someone's behalf out of excluding nodes ([0e02334](https://github.com/Rytass/BPMCore/commit/0e02334))
+- **workflow-engine:** add a nullable submitted-by column to approval instances ([06e7c97](https://github.com/Rytass/BPMCore/commit/06e7c97))
+- **workflow-engine:** require delegates and transfer targets on manager chains to match the grade they replace ([2cc0432](https://github.com/Rytass/BPMCore/commit/2cc0432))
+- **workflow-engine:** let hosts submit and look up instances by business key ([daa7d9d](https://github.com/Rytass/BPMCore/commit/daa7d9d))
+- **workflow-engine:** add business_key column with per-template unique index ([cb1b9bf](https://github.com/Rytass/BPMCore/commit/cb1b9bf))
+- **designer:** pick approvers from a member field and show readable dry-run assignees ([bc9592e](https://github.com/Rytass/BPMCore/commit/bc9592e))
+- **forms:** add a member field type ([0fca8d4](https://github.com/Rytass/BPMCore/commit/0fca8d4))
+
+### 🩹 Fixes
+
+- **template-designer:** name a member-field dry-run assignee by its field label ([465fcc3](https://github.com/Rytass/BPMCore/commit/465fcc3))
+- **workflow-engine:** read task node labels from the entity's own table path ([16d6e8e](https://github.com/Rytass/BPMCore/commit/16d6e8e))
+- **template-designer:** sample a dry-run member field with a placeholder, not the initiator ([b567e41](https://github.com/Rytass/BPMCore/commit/b567e41))
+- **template:** refuse a DYNAMIC_FORM resolver on a member field that can be left empty ([b3a3950](https://github.com/Rytass/BPMCore/commit/b3a3950))
+- **workflow-engine:** end a dry-run skip reason with a full stop before the stop reason ([8a855f4](https://github.com/Rytass/BPMCore/commit/8a855f4))
+- **organization:** default organizationTimeZone to Asia/Taipei ([cc6b908](https://github.com/Rytass/BPMCore/commit/cc6b908))
+- **workflow-engine:** consume the token of a NOTIFY node skipped by its entry condition ([#78](https://github.com/Rytass/BPMCore/issues/78))
+- **forms:** keep the new-tab cue out of copied link text ([4fcd8e8](https://github.com/Rytass/BPMCore/commit/4fcd8e8))
+- **forms:** harden hidden fields and link display after review ([9ce1f82](https://github.com/Rytass/BPMCore/commit/9ce1f82))
+- **workflow-engine:** normalise the ad-hoc task nodeLabel like the list paths ([ded39e9](https://github.com/Rytass/BPMCore/commit/ded39e9))
+- **workflow-engine:** bound the submitter name lookup inside the approval transaction ([dbf1d3b](https://github.com/Rytass/BPMCore/commit/dbf1d3b))
+- **workflow-engine:** index the submitter column that the sent list now matches ([557f458](https://github.com/Rytass/BPMCore/commit/557f458))
+- **workflow-engine:** leave out the refusals of seats the initiator exclusion removes ([959912e](https://github.com/Rytass/BPMCore/commit/959912e))
+- **workflow-engine:** keep every refused delegation on record when the dedupe or a kept stored member hides its row ([aad1c8c](https://github.com/Rytass/BPMCore/commit/aad1c8c))
+- **workflow-engine:** skip the submitter before choosing the initiator-manager replacement tier ([355373e](https://github.com/Rytass/BPMCore/commit/355373e))
+- **workflow-engine:** harden business key lookup and count its length in characters ([844ce82](https://github.com/Rytass/BPMCore/commit/844ce82))
+- **forms:** keep member ids out of case titles and check member references on publish ([2b3c9c0](https://github.com/Rytass/BPMCore/commit/2b3c9c0))
+- **workflow-engine:** name the fallback problem in the dry-run manager message ([7f571f0](https://github.com/Rytass/BPMCore/commit/7f571f0))
+- **workflow-engine:** translate missing org units and finish the dry-run edge cases ([b528aaa](https://github.com/Rytass/BPMCore/commit/b528aaa))
+- **workflow-engine:** reject malformed member values on submit ([f13113e](https://github.com/Rytass/BPMCore/commit/f13113e))
+- **workflow-engine:** say 通知對象 for notify recipients ([226dbda](https://github.com/Rytass/BPMCore/commit/226dbda))
+- **workflow-engine:** name the node and the org in approver-resolution errors and keep the dry run going ([f45bfaf](https://github.com/Rytass/BPMCore/commit/f45bfaf))
+
+### 🔥 Performance
+
+- **workflow-engine:** batch the grade lookups of a manager-chain node's delegations ([99ae382](https://github.com/Rytass/BPMCore/commit/99ae382))
+- **workflow-engine:** read task node labels in Postgres instead of loading whole snapshots ([65bbbe1](https://github.com/Rytass/BPMCore/commit/65bbbe1))
+- **notification:** name the submitter at submit instead of inside the approval transaction ([da64763](https://github.com/Rytass/BPMCore/commit/da64763))
+
+### ❤️ Thank You
+
+- Chia Yu Pai @fantasywind
+- Claude Opus 5.5
+- Kai-Chieh Yang
+
 ## 0.14.0 (2026-10-12)
 
 ### 🚀 Features

package/README.md

@@ -703,6 +703,15 @@ export interface BPMMemberResolver {
 
 ## Organization Data Ownership
 
+> **Upgrading past 0.14.0 — which day is "today".** The workflow engine now
+> reads membership and manager-rule effective dates in the
+> `organizationTimeZone` root option, default `Asia/Taipei`; it used to read
+> the UTC date. Between local midnight and 08:00 a rule effective from today
+> now applies, and one ending today no longer does, up to eight hours earlier
+> than before. If your organization dates are kept in UTC, set
+> `organizationTimeZone: 'UTC'` before upgrading. See
+> [Configuration Reference](#configuration-reference).
+
 > **Read this before integrating BPM into a host that already has its own
 > organization model.** The org-integration shape is **asymmetric** with
 > member integration above — knowing which side owns what saves a day of
@@ -936,12 +945,13 @@ BPMRootModule.forRootAsync({
 | `formDataSourceRegistryProvider`                 | Empty catalog                  | Single host provider for versioned Select / AutoComplete / Radio / Checkbox DataSources. |
 | `attachmentRoutePrefix`                          | `/attachments`                 | Drives both the BPM signed URL path and the Nest controller mount path for `AttachmentController`. Must be set at module wiring time (see "Attachment Storage" below). |
 | `attachmentStorageProviderId`                    | `local`                        | Value stored on attachment metadata for the active adapter.    |
-| `attachmentPublicBaseUrl`                        | `http://localhost:17603`       | Public base URL for signed attachment URLs.                    |
-| `attachmentSignedUrlSecret`                      | local development secret       | HMAC secret for signed attachment download/preview tokens. Under `NODE_ENV=production` BPM refuses to start while this is unset. |
-| `attachmentAllowInsecureSignedUrlSecret`         | `false`                        | Opt-in that lets a `NODE_ENV=production` process boot on the built-in development secret anyway. Only for throwaway environments — the value is published in this package. |
+| `attachmentPublicBaseUrl`                        | requesting origin              | Public base URL for signed attachment URLs. Unset, each URL uses the origin of the GraphQL request that asked for it (`X-Forwarded-Proto` / `X-Forwarded-Host`, else the request's protocol and `Host`), so a host behind a proxy needs no setting. |
+| `attachmentSignedUrlSecret`                      | random per process             | HMAC secret for signed attachment download/preview tokens. Unset, each process generates one at boot and warns on stderr; a URL then only verifies on the process that signed it, so set a shared secret before running more than one API replica. |
+| `attachmentAllowInsecureSignedUrlSecret`         | —                              | Deprecated and ignored: no signing secret ships in the package any more. |
 | `attachmentSignedUrlTtlSeconds`                  | `300`                          | Signed attachment URL lifetime in seconds.                     |
 | `identityMemberMetadataCacheTtlMs`               | `300000`                       | Member metadata cache TTL.                                     |
 | `identityRegisterResolvers`                      | `true`                         | Set to `false` when the host already publishes `member` / `members` / `memberCount` / `searchMembers` GraphQL queries. `IdentityService` stays available either way. |
+| `organizationTimeZone`                           | `Asia/Taipei`                  | IANA zone in which BPM reads "today" when it compares against the date-only `effectiveFrom` / `effectiveTo` of memberships and manager resolutions (manager chains, direct and org-unit managers, position levels, the initiator snapshot, SLA escalation, the "active only" organization views). Set `'UTC'` if your organization dates are kept in UTC. An unknown zone makes BPM fail at startup. Independent of `notificationSlaBusinessCalendarTimeZone`. Before this option the workflow engine read UTC while `OrganizationService` read `Asia/Taipei`; both now follow it. |
 | `notificationInAppEnabled`                       | `true`                         | Enables in-app notification records.                           |
 | `notificationEmailEnabled`                       | `auto`                         | Enables email when SMTP settings are complete.                 |
 | `notificationEmailSmtpHost`                      | `null`                         | SMTP host.                                                     |
@@ -1667,16 +1677,12 @@ npm publish --access public
 
 ## Production Notes
 
-- **BREAKING (upgrade note).** Replace all local fallback secrets before
-  production. Under `NODE_ENV=production`, `attachmentSignedUrlSecret` is now
-  enforced: BPM refuses to start rather than sign attachment URLs with the
-  value published in this package. `BPMRootModule` mounts `AttachmentModule`
-  unconditionally, so this applies **even to a host that never serves
-  attachments** — an existing production deployment that never set the secret
-  will fail to boot after upgrading. Set the secret, or set
-  `attachmentAllowInsecureSignedUrlSecret: true` to acknowledge that the
-  signing key is public and boot anyway. Never set that flag on anything
-  serving real attachments.
+- BPM boots with no attachment options at all. An unset
+  `attachmentSignedUrlSecret` is generated per process at boot (with a stderr
+  warning) — never a value published in this package — so set a shared secret
+  once the API runs more than one replica, or when a restart must not
+  invalidate the signed URLs handed out in the last few minutes.
+  `attachmentAllowInsecureSignedUrlSecret` is deprecated and ignored.
 - Use a production storage adapter instead of local filesystem storage.
 - Keep old signature keys available for verification after key rotation.
 - Keep in-process schedulers disabled in API replicas unless a dedicated worker

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rytass/bpm-core-nestjs-module",
-  "version": "0.14.0",
+  "version": "0.16.2",
   "description": "Embeddable NestJS BPM approval workflow module: workflow engine, approval templates, forms, organization/member contracts, attachments, signatures, notifications, delegation, and TypeORM migrations.",
   "keywords": [
     "bpm",
@@ -162,7 +162,7 @@
     "@nestjs/core": ">=10.0.0",
     "@nestjs/graphql": ">=12.0.0",
     "@nestjs/typeorm": ">=10.0.0",
-    "@rytass/bpm-core-shared": "^0.14.0",
+    "@rytass/bpm-core-shared": "^0.16.2",
     "@rytass/secret-adapter-vault-nestjs": ">=0.4.5",
     "express": ">=4.0.0",
     "graphql": ">=16.0.0",
@@ -178,13 +178,13 @@
     }
   },
   "dependencies": {
-    "@rytass/storages": "^0.2.7",
-    "@rytass/storages-adapter-local": "^0.2.10",
+    "@rytass/storages": "^0.3.0",
+    "@rytass/storages-adapter-local": "^0.3.0",
     "cel-js": "^0.8.2",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.15.1",
     "handlebars": "^4.7.10",
-    "nodemailer": "^9.1.1",
+    "nodemailer": "^10.1.0",
     "tslib": "^2.8.1"
   }
 }

package/src/lib/attachment/attachment-options.d.ts

@@ -3,6 +3,11 @@ export interface BPMRootAttachmentOptions {
     /**
      * Public HTTP base URL used to build signed attachment download and preview
      * URLs.
+     *
+     * Optional: when unset, each URL is built from the origin of the GraphQL
+     * request that asked for it (`X-Forwarded-Proto` / `X-Forwarded-Host`, else
+     * the request's own protocol and `Host`), so a host behind a proxy or on
+     * localhost gets a working link without configuring it.
      */
     readonly attachmentPublicBaseUrl?: string | null;
     /**
@@ -13,18 +18,19 @@ export interface BPMRootAttachmentOptions {
      */
     readonly attachmentRoutePrefix?: string | null;
     /**
-     * Opt-in escape hatch that lets a `NODE_ENV=production` process boot while
-     * still signing attachment URLs with the built-in development secret.
-     *
-     * Without it, a production process that never set
-     * `attachmentSignedUrlSecret` refuses to start. Set this only for a
-     * throwaway environment that happens to run with `NODE_ENV=production` and
-     * serves no real attachments — the built-in value is published in this
-     * package, so anyone can forge a signed attachment URL against it.
+     * @deprecated No longer has any effect. An unset
+     * `attachmentSignedUrlSecret` now gets a random per-process secret instead
+     * of a built-in one, so there is nothing insecure left to acknowledge.
      */
     readonly attachmentAllowInsecureSignedUrlSecret?: boolean;
     /**
      * HMAC secret used to sign attachment download and preview tokens.
+     *
+     * Optional: when unset, every process generates its own random secret at
+     * boot and warns on stderr. That keeps the URLs unforgeable, but a URL only
+     * verifies on the process that signed it — set a shared secret once the API
+     * runs more than one replica, or when a restart must not invalidate the
+     * links handed out in the last `attachmentSignedUrlTtlSeconds`.
      */
     readonly attachmentSignedUrlSecret?: string | null;
     /**
@@ -37,14 +43,21 @@ export interface BPMRootAttachmentOptions {
     readonly attachmentStorageProviderId?: string | null;
 }
 export interface BPMResolvedAttachmentOptions {
-    readonly publicBaseUrl: string;
+    /** `null` builds each URL from the requesting origin. */
+    readonly publicBaseUrl: string | null;
     readonly routePrefix: string;
     readonly signedUrlSecret: string;
     readonly signedUrlTtlSeconds: number;
     readonly storageProviderId: string;
 }
 export declare const BPM_ATTACHMENT_OPTIONS: InjectionToken<BPMResolvedAttachmentOptions>;
-export declare const DEFAULT_BPM_ATTACHMENT_OPTIONS: BPMResolvedAttachmentOptions;
+/**
+ * Defaults for every attachment option that has a fixed one. The signing
+ * secret has none on purpose: a value published in this package would make
+ * every signed URL forgeable, so an unset secret is generated per process by
+ * {@link resolveBPMAttachmentOptions}.
+ */
+export declare const DEFAULT_BPM_ATTACHMENT_OPTIONS: Omit<BPMResolvedAttachmentOptions, 'signedUrlSecret'>;
 export declare function resolveBPMAttachmentOptions(options?: BPMRootAttachmentOptions): BPMResolvedAttachmentOptions;
 /**
  * Normalizes an attachment route prefix into the form Nest expects on a

package/src/lib/attachment/attachment-options.js

@@ -3,47 +3,34 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_BPM_ATTACHMENT_OPTIONS = exports.BPM_ATTACHMENT_OPTIONS = void 0;
 exports.resolveBPMAttachmentOptions = resolveBPMAttachmentOptions;
 exports.resolveAttachmentControllerPath = resolveAttachmentControllerPath;
+const node_crypto_1 = require("node:crypto");
 exports.BPM_ATTACHMENT_OPTIONS = Symbol('BPM_ATTACHMENT_OPTIONS');
+/**
+ * Defaults for every attachment option that has a fixed one. The signing
+ * secret has none on purpose: a value published in this package would make
+ * every signed URL forgeable, so an unset secret is generated per process by
+ * {@link resolveBPMAttachmentOptions}.
+ */
 exports.DEFAULT_BPM_ATTACHMENT_OPTIONS = {
-    publicBaseUrl: 'http://localhost:17603',
+    publicBaseUrl: null,
     routePrefix: '/attachments',
-    signedUrlSecret: 'bpm-core-local-attachment-url-key-v1',
     signedUrlTtlSeconds: 300,
     storageProviderId: 'local',
 };
 function resolveBPMAttachmentOptions(options = {}) {
-    const resolvedSignedUrlSecret = normalizeText(options.attachmentSignedUrlSecret) ??
-        exports.DEFAULT_BPM_ATTACHMENT_OPTIONS.signedUrlSecret;
-    const usesBuiltInSecret = resolvedSignedUrlSecret === exports.DEFAULT_BPM_ATTACHMENT_OPTIONS.signedUrlSecret;
-    // A console warning is the wrong instrument for a published constant that
-    // makes every signed attachment URL forgeable: in a container it scrolls past
-    // with the boot log and nobody reads it again. Under `NODE_ENV=production`
-    // the process refuses to start instead, and a host that genuinely wants the
-    // development value there has to say so.
-    if (usesBuiltInSecret &&
-        process.env.NODE_ENV === 'production' &&
-        options.attachmentAllowInsecureSignedUrlSecret !== true) {
-        throw new Error([
-            '[@rytass/bpm-core-nestjs-module] attachmentSignedUrlSecret is unset, so BPM would sign attachment URLs with the built-in local development value that ships in this package — anyone could forge one.',
-            'Set BPMRootModuleOptions.attachmentSignedUrlSecret to a strong secret.',
-            'If this service never serves attachments, BPM still mounts AttachmentModule, so set attachmentAllowInsecureSignedUrlSecret: true to acknowledge that the signing key is public and boot anyway.',
-        ].join(' '));
-    }
-    // Outside production, still warn everywhere except an explicit local
-    // development run. Gating the warning on production alone meant a staging
-    // host that never set the variable signed attachment URLs with the published
-    // constant — and said nothing about it. One extra line in a developer's
-    // console is the cheaper trade.
-    if (usesBuiltInSecret &&
-        process.env.NODE_ENV !== 'development' &&
-        process.env.NODE_ENV !== 'test') {
+    const configuredSignedUrlSecret = normalizeText(options.attachmentSignedUrlSecret);
+    // No secret is not a reason to refuse to boot — the module is meant to start
+    // with nothing but a database. A random per-process key keeps the signed
+    // URLs unforgeable; the warning is for the one thing it cannot do, which is
+    // verify a URL signed by another process.
+    if (!configuredSignedUrlSecret && process.env.NODE_ENV !== 'test') {
         // eslint-disable-next-line no-console
-        console.warn('[@rytass/bpm-core-nestjs-module] attachmentSignedUrlSecret is using the built-in local development value. Set BPMRootModuleOptions.attachmentSignedUrlSecret to a strong secret before serving production traffic — signed attachment URLs would otherwise be forgeable.');
+        console.warn('[@rytass/bpm-core-nestjs-module] attachmentSignedUrlSecret is unset, so this process signs attachment URLs with a random key generated at boot. The URLs stay unforgeable, but each one only verifies on the process that signed it: set BPMRootModuleOptions.attachmentSignedUrlSecret to a shared secret before running more than one API replica, or if a restart must not invalidate the links handed out in the last few minutes.');
     }
     return {
         publicBaseUrl: normalizePublicBaseUrl(options.attachmentPublicBaseUrl),
         routePrefix: normalizeRoutePrefix(options.attachmentRoutePrefix),
-        signedUrlSecret: resolvedSignedUrlSecret,
+        signedUrlSecret: configuredSignedUrlSecret ?? (0, node_crypto_1.randomBytes)(32).toString('hex'),
         signedUrlTtlSeconds: normalizePositiveInteger(options.attachmentSignedUrlTtlSeconds, exports.DEFAULT_BPM_ATTACHMENT_OPTIONS.signedUrlTtlSeconds),
         storageProviderId: normalizeText(options.attachmentStorageProviderId) ??
             exports.DEFAULT_BPM_ATTACHMENT_OPTIONS.storageProviderId,
@@ -60,8 +47,7 @@ function resolveAttachmentControllerPath(value) {
     return normalizedPrefix.replace(/^\//, '');
 }
 function normalizePublicBaseUrl(value) {
-    const normalizedValue = normalizeText(value) ?? exports.DEFAULT_BPM_ATTACHMENT_OPTIONS.publicBaseUrl;
-    return normalizedValue.replace(/\/+$/, '');
+    return normalizeText(value)?.replace(/\/+$/, '') ?? null;
 }
 function normalizeRoutePrefix(value) {
     const normalizedValue = normalizeText(value) ?? exports.DEFAULT_BPM_ATTACHMENT_OPTIONS.routePrefix;

package/src/lib/attachment/attachment-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachment-options.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/attachment/attachment-options.ts"],"names":[],"mappings":";;;AAgEA,kEAyDC;AAQD,0EAMC;AAlFY,QAAA,sBAAsB,GACjC,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAEtB,QAAA,8BAA8B,GAAiC;IAC1E,aAAa,EAAE,wBAAwB;IACvC,WAAW,EAAE,cAAc;IAC3B,eAAe,EAAE,sCAAsC;IACvD,mBAAmB,EAAE,GAAG;IACxB,iBAAiB,EAAE,OAAO;CAC3B,CAAC;AAEF,SAAgB,2BAA2B,CACzC,UAAoC,EAAE;IAEtC,MAAM,uBAAuB,GAC3B,aAAa,CAAC,OAAO,CAAC,yBAAyB,CAAC;QAChD,sCAA8B,CAAC,eAAe,CAAC;IAEjD,MAAM,iBAAiB,GACrB,uBAAuB,KAAK,sCAA8B,CAAC,eAAe,CAAC;IAE7E,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,yCAAyC;IACzC,IACE,iBAAiB;QACjB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACrC,OAAO,CAAC,sCAAsC,KAAK,IAAI,EACvD,CAAC;QACD,MAAM,IAAI,KAAK,CACb;YACE,uMAAuM;YACvM,wEAAwE;YACxE,iMAAiM;SAClM,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,6EAA6E;IAC7E,wEAAwE;IACxE,gCAAgC;IAChC,IACE,iBAAiB;QACjB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa;QACtC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAC/B,CAAC;QACD,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,0QAA0Q,CAC3Q,CAAC;IACJ,CAAC;IAED,OAAO;QACL,aAAa,EAAE,sBAAsB,CAAC,OAAO,CAAC,uBAAuB,CAAC;QACtE,WAAW,EAAE,oBAAoB,CAAC,OAAO,CAAC,qBAAqB,CAAC;QAChE,eAAe,EAAE,uBAAuB;QACxC,mBAAmB,EAAE,wBAAwB,CAC3C,OAAO,CAAC,6BAA6B,EACrC,sCAA8B,CAAC,mBAAmB,CACnD;QACD,iBAAiB,EACf,aAAa,CAAC,OAAO,CAAC,2BAA2B,CAAC;YAClD,sCAA8B,CAAC,iBAAiB;KACnD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,+BAA+B,CAC7C,KAAgC;IAEhC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAErD,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAgC;IAC9D,MAAM,eAAe,GACnB,aAAa,CAAC,KAAK,CAAC,IAAI,sCAA8B,CAAC,aAAa,CAAC;IAEvE,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAgC;IAC5D,MAAM,eAAe,GACnB,aAAa,CAAC,KAAK,CAAC,IAAI,sCAA8B,CAAC,WAAW,CAAC;IACrE,MAAM,gBAAgB,GAAG,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC;QACtD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;IAE1B,OAAO,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,KAAgC;IACrD,MAAM,YAAY,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEzC,OAAO,YAAY,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAyB,EACzB,QAAgB;IAEhB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"attachment-options.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/attachment/attachment-options.ts"],"names":[],"mappings":";;;AAgFA,kEA+BC;AAQD,0EAMC;AA5HD,6CAA0C;AA4D7B,QAAA,sBAAsB,GACjC,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAEnC;;;;;GAKG;AACU,QAAA,8BAA8B,GAGvC;IACF,aAAa,EAAE,IAAI;IACnB,WAAW,EAAE,cAAc;IAC3B,mBAAmB,EAAE,GAAG;IACxB,iBAAiB,EAAE,OAAO;CAC3B,CAAC;AAEF,SAAgB,2BAA2B,CACzC,UAAoC,EAAE;IAEtC,MAAM,yBAAyB,GAAG,aAAa,CAC7C,OAAO,CAAC,yBAAyB,CAClC,CAAC;IAEF,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,0CAA0C;IAC1C,IAAI,CAAC,yBAAyB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAClE,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,waAAwa,CACza,CAAC;IACJ,CAAC;IAED,OAAO;QACL,aAAa,EAAE,sBAAsB,CAAC,OAAO,CAAC,uBAAuB,CAAC;QACtE,WAAW,EAAE,oBAAoB,CAAC,OAAO,CAAC,qBAAqB,CAAC;QAChE,eAAe,EACb,yBAAyB,IAAI,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9D,mBAAmB,EAAE,wBAAwB,CAC3C,OAAO,CAAC,6BAA6B,EACrC,sCAA8B,CAAC,mBAAmB,CACnD;QACD,iBAAiB,EACf,aAAa,CAAC,OAAO,CAAC,2BAA2B,CAAC;YAClD,sCAA8B,CAAC,iBAAiB;KACnD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,+BAA+B,CAC7C,KAAgC;IAEhC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAErD,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAgC;IAEhC,OAAO,aAAa,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAgC;IAC5D,MAAM,eAAe,GACnB,aAAa,CAAC,KAAK,CAAC,IAAI,sCAA8B,CAAC,WAAW,CAAC;IACrE,MAAM,gBAAgB,GAAG,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC;QACtD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;IAE1B,OAAO,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,KAAgC;IACrD,MAAM,YAAY,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEzC,OAAO,YAAY,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAyB,EACzB,QAAgB;IAEhB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/src/lib/attachment/attachment-request-origin.d.ts

@@ -0,0 +1,19 @@
+interface RequestLike {
+    readonly headers?: Readonly<Record<string, string | string[] | undefined>>;
+    readonly protocol?: string;
+}
+/**
+ * Origin (`<protocol>://<host>`) the client reached this API on, used to build
+ * signed attachment URLs when the host configured no public base URL.
+ *
+ * Proxy headers win over the socket's own values, because behind an ingress
+ * the socket sees plain HTTP on an internal address. Only the first value of a
+ * comma-separated proxy header is read — the one the outermost proxy set — and
+ * a value that is not a bare host or not `http` / `https` is ignored, so a
+ * crafted header cannot inject a path or a scheme into the URL. A forged
+ * `Host` only changes the URL returned to the client that sent it.
+ */
+export declare function readAttachmentRequestOrigin(request: RequestLike | undefined): string | null;
+/** Resolver parameter carrying {@link readAttachmentRequestOrigin}. */
+export declare const BPMAttachmentRequestOrigin: (...dataOrPipes: unknown[]) => ParameterDecorator;
+export {};

package/src/lib/attachment/attachment-request-origin.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BPMAttachmentRequestOrigin = void 0;
+exports.readAttachmentRequestOrigin = readAttachmentRequestOrigin;
+const common_1 = require("@nestjs/common");
+const graphql_1 = require("@nestjs/graphql");
+const HOST_PATTERN = /^[A-Za-z0-9.-]+(:\d{1,5})?$|^\[[0-9A-Fa-f:.]+\](:\d{1,5})?$/u;
+/**
+ * Origin (`<protocol>://<host>`) the client reached this API on, used to build
+ * signed attachment URLs when the host configured no public base URL.
+ *
+ * Proxy headers win over the socket's own values, because behind an ingress
+ * the socket sees plain HTTP on an internal address. Only the first value of a
+ * comma-separated proxy header is read — the one the outermost proxy set — and
+ * a value that is not a bare host or not `http` / `https` is ignored, so a
+ * crafted header cannot inject a path or a scheme into the URL. A forged
+ * `Host` only changes the URL returned to the client that sent it.
+ */
+function readAttachmentRequestOrigin(request) {
+    if (!request) {
+        return null;
+    }
+    const host = readFirstHeaderValue(request, 'x-forwarded-host') ??
+        readFirstHeaderValue(request, 'host');
+    const protocol = (readFirstHeaderValue(request, 'x-forwarded-proto') ??
+        request.protocol ??
+        'http').toLowerCase();
+    if (!host || !HOST_PATTERN.test(host)) {
+        return null;
+    }
+    if (protocol !== 'http' && protocol !== 'https') {
+        return null;
+    }
+    return `${protocol}://${host}`;
+}
+/** Resolver parameter carrying {@link readAttachmentRequestOrigin}. */
+exports.BPMAttachmentRequestOrigin = (0, common_1.createParamDecorator)((_data, context) => readAttachmentRequestOrigin(readRequest(context)));
+function readRequest(context) {
+    if (context.getType() === 'graphql') {
+        return graphql_1.GqlExecutionContext.create(context).getContext()?.req;
+    }
+    return context.switchToHttp().getRequest();
+}
+function readFirstHeaderValue(request, name) {
+    const value = request.headers?.[name];
+    const firstValue = (Array.isArray(value) ? value[0] : value)
+        ?.split(',')[0]
+        ?.trim();
+    return firstValue || null;
+}
+//# sourceMappingURL=attachment-request-origin.js.map

package/src/lib/attachment/attachment-request-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-request-origin.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/attachment/attachment-request-origin.ts"],"names":[],"mappings":";;;AA0BA,kEAyBC;AAnDD,2CAAwE;AACxE,6CAAsD;AAWtD,MAAM,YAAY,GAChB,8DAA8D,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,SAAgB,2BAA2B,CACzC,OAAgC;IAEhC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GACR,oBAAoB,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACjD,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,CACf,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,CAAC;QAClD,OAAO,CAAC,QAAQ;QAChB,MAAM,CACP,CAAC,WAAW,EAAE,CAAC;IAEhB,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,uEAAuE;AAC1D,QAAA,0BAA0B,GAAG,IAAA,6BAAoB,EAC5D,CAAC,KAAc,EAAE,OAAyB,EAAiB,EAAE,CAC3D,2BAA2B,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CACpD,CAAC;AAEF,SAAS,WAAW,CAAC,OAAyB;IAC5C,IAAI,OAAO,CAAC,OAAO,EAAU,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,6BAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,EAElD,EAAE,GAAG,CAAC;IACX,CAAC;IAED,OAAO,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAA2B,CAAC;AACtE,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAoB,EACpB,IAAY;IAEZ,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1D,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACf,EAAE,IAAI,EAAE,CAAC;IAEX,OAAO,UAAU,IAAI,IAAI,CAAC;AAC5B,CAAC"}

package/src/lib/attachment/attachment.module.d.ts

@@ -1,5 +1,4 @@
-import { DynamicModule, InjectionToken, Provider } from '@nestjs/common';
-import { ModuleMetadata } from '@nestjs/common/interfaces';
+import { DynamicModule, InjectionToken, ModuleMetadata, Provider } from '@nestjs/common';
 import { AttachmentStorage } from './attachment-storage.token';
 import { BPMRootAttachmentOptions } from './attachment-options';
 export interface AttachmentModuleOptions extends BPMRootAttachmentOptions {

package/src/lib/attachment/attachment.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachment.module.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/attachment/attachment.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAMwB;AACxB,wDAAyD;AAEzD,6CAAgD;AAChD,0FAAqF;AACrF,oFAA+E;AAC/E,kFAA6E;AAC7E,gEAA4D;AAC5D,mEAA+D;AAC/D,2DAAuD;AACvD,iEAA6D;AAC7D,6DAAyD;AACzD,+EAA0E;AAE1E,6DAAyD;AACzD,6DAM8B;AA4B9B;;;;;;;;GAQG;AACH,SAAS,6BAA6B,CACpC,qBAAgD;IAEhD,MAAM,cAAc,GAAG,IAAA,oDAA+B,EAAC,qBAAqB,CAAC,CAAC;IAE9E,OAAO,CAAC,cAAc,CAAC,yBAAa,EAAE,cAAc,EAAE,4CAAoB,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,yBAAyB,GAAG;IAChC,uBAAa,CAAC,UAAU,CAAC;QACvB,iDAAsB;QACtB,oCAAgB;QAChB,2CAAmB;QACnB,yCAAkB;QAClB,wBAAU;KACX,CAAC;CACH,CAAC;AAEF,MAAM,6BAA6B,GAAG,CAAC,4CAAoB,CAAC,CAAC;AAC7D,MAAM,2BAA2B,GAAG;IAClC,0CAAmB;IACnB,sCAAiB;IACjB,sCAAiB;CAClB,CAAC;AACF,MAAM,yBAAyB,GAAG,CAAC,sCAAiB,CAAC,CAAC;AAa/C,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAC3B,MAAM,CAAC,OAAO,CAAC,UAAmC,EAAE;QAClD,6BAA6B,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAE7D,OAAO;YACL,WAAW,EAAE,6BAA6B;YAC1C,OAAO,EAAE,yBAAyB;YAClC,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,yBAAyB,CAAC;YACnE,MAAM,EAAE,kBAAgB;YACxB,SAAS,EAAE;gBACT,GAAG,2BAA2B;gBAC9B,OAAO,CAAC,eAAe,IAAI,uDAAyB;gBACpD,+BAA+B,CAAC,OAAO,CAAC;aACzC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAqC;QACvD,6BAA6B,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAE7D,OAAO;YACL,WAAW,EAAE,6BAA6B;YAC1C,OAAO,EAAE,yBAAyB;YAClC,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,yBAAyB,CAAC;YACnE,MAAM,EAAE,kBAAgB;YACxB,SAAS,EAAE;gBACT,GAAG,2BAA2B;gBAC9B,OAAO,CAAC,eAAe,IAAI,uDAAyB;gBACpD;oBACE,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;oBACnC,OAAO,EAAE,2CAAsB;oBAC/B,UAAU,EAAE,KAAK,EACf,GAAG,IAAwB,EAC8B,EAAE,CAC3D,IAAA,gDAA2B,EAAC,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;iBACjE;aACF;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAvCY,4CAAgB;2BAAhB,gBAAgB;IAX5B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,yBAAyB;QAClC,WAAW,EAAE,6BAA6B;QAC1C,SAAS,EAAE;YACT,GAAG,2BAA2B;YAC9B,uDAAyB;YACzB,+BAA+B,EAAE;SAClC;QACD,OAAO,EAAE,yBAAyB;KACnC,CAAC;GACW,gBAAgB,CAuC5B;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,+BAA+B,CACtC,UAAoC,EAAE;IAEtC,OAAO;QACL,OAAO,EAAE,2CAAsB;QAC/B,UAAU,EAAE,GAAiC,EAAE,CAC7C,IAAA,gDAA2B,EAAC,OAAO,CAAC;KACvC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"attachment.module.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/attachment/attachment.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAOwB;AACxB,wDAAyD;AACzD,6CAAgD;AAChD,0FAAqF;AACrF,oFAA+E;AAC/E,kFAA6E;AAC7E,gEAA4D;AAC5D,mEAA+D;AAC/D,2DAAuD;AACvD,iEAA6D;AAC7D,6DAAyD;AACzD,+EAA0E;AAE1E,6DAAyD;AACzD,6DAM8B;AA4B9B;;;;;;;;GAQG;AACH,SAAS,6BAA6B,CACpC,qBAAgD;IAEhD,MAAM,cAAc,GAAG,IAAA,oDAA+B,EAAC,qBAAqB,CAAC,CAAC;IAE9E,OAAO,CAAC,cAAc,CAAC,yBAAa,EAAE,cAAc,EAAE,4CAAoB,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,yBAAyB,GAAG;IAChC,uBAAa,CAAC,UAAU,CAAC;QACvB,iDAAsB;QACtB,oCAAgB;QAChB,2CAAmB;QACnB,yCAAkB;QAClB,wBAAU;KACX,CAAC;CACH,CAAC;AAEF,MAAM,6BAA6B,GAAG,CAAC,4CAAoB,CAAC,CAAC;AAC7D,MAAM,2BAA2B,GAAG;IAClC,0CAAmB;IACnB,sCAAiB;IACjB,sCAAiB;CAClB,CAAC;AACF,MAAM,yBAAyB,GAAG,CAAC,sCAAiB,CAAC,CAAC;AAa/C,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAC3B,MAAM,CAAC,OAAO,CAAC,UAAmC,EAAE;QAClD,6BAA6B,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAE7D,OAAO;YACL,WAAW,EAAE,6BAA6B;YAC1C,OAAO,EAAE,yBAAyB;YAClC,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,yBAAyB,CAAC;YACnE,MAAM,EAAE,kBAAgB;YACxB,SAAS,EAAE;gBACT,GAAG,2BAA2B;gBAC9B,OAAO,CAAC,eAAe,IAAI,uDAAyB;gBACpD,+BAA+B,CAAC,OAAO,CAAC;aACzC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAqC;QACvD,6BAA6B,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAE7D,OAAO;YACL,WAAW,EAAE,6BAA6B;YAC1C,OAAO,EAAE,yBAAyB;YAClC,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,yBAAyB,CAAC;YACnE,MAAM,EAAE,kBAAgB;YACxB,SAAS,EAAE;gBACT,GAAG,2BAA2B;gBAC9B,OAAO,CAAC,eAAe,IAAI,uDAAyB;gBACpD;oBACE,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;oBACnC,OAAO,EAAE,2CAAsB;oBAC/B,UAAU,EAAE,KAAK,EACf,GAAG,IAAwB,EAC8B,EAAE,CAC3D,IAAA,gDAA2B,EAAC,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;iBACjE;aACF;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAvCY,4CAAgB;2BAAhB,gBAAgB;IAX5B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,yBAAyB;QAClC,WAAW,EAAE,6BAA6B;QAC1C,SAAS,EAAE;YACT,GAAG,2BAA2B;YAC9B,uDAAyB;YACzB,+BAA+B,EAAE;SAClC;QACD,OAAO,EAAE,yBAAyB;KACnC,CAAC;GACW,gBAAgB,CAuC5B;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,+BAA+B,CACtC,UAAoC,EAAE;IAEtC,OAAO;QACL,OAAO,EAAE,2CAAsB;QAC/B,UAAU,EAAE,GAAiC,EAAE,CAC7C,IAAA,gDAA2B,EAAC,OAAO,CAAC;KACvC,CAAC;AACJ,CAAC"}

package/src/lib/attachment/attachment.queries.d.ts

@@ -4,6 +4,6 @@ export declare class AttachmentQueries {
     private readonly attachmentService;
     constructor(attachmentService: AttachmentService);
     attachments(instanceId: string, taskId?: string | null, formFieldPath?: string | null, currentMemberId?: string): Promise<readonly AttachmentEntity[]>;
-    attachmentDownloadUrl(id: string, _requestedByMemberId: string | null, currentMemberId: string): Promise<string>;
-    attachmentPreviewUrl(id: string, _requestedByMemberId: string | null, currentMemberId: string): Promise<string>;
+    attachmentDownloadUrl(id: string, _requestedByMemberId: string | null, currentMemberId: string, requestOrigin: string | null): Promise<string>;
+    attachmentPreviewUrl(id: string, _requestedByMemberId: string | null, currentMemberId: string, requestOrigin: string | null): Promise<string>;
 }

package/src/lib/attachment/attachment.queries.js

@@ -5,6 +5,7 @@ const tslib_1 = require("tslib");
 const graphql_1 = require("@nestjs/graphql");
 const bpm_auth_1 = require("../bpm-auth");
 const attachment_entity_1 = require("./attachment.entity");
+const attachment_request_origin_1 = require("./attachment-request-origin");
 const attachment_service_1 = require("./attachment.service");
 let AttachmentQueries = class AttachmentQueries {
     constructor(attachmentService) {
@@ -18,17 +19,19 @@ let AttachmentQueries = class AttachmentQueries {
             taskId: taskId ?? null,
         });
     }
-    async attachmentDownloadUrl(id, _requestedByMemberId, currentMemberId) {
+    async attachmentDownloadUrl(id, _requestedByMemberId, currentMemberId, requestOrigin) {
         return this.attachmentService.createSignedUrl({
             disposition: 'attachment',
             id,
+            requestOrigin,
             requestedByMemberId: currentMemberId,
         });
     }
-    async attachmentPreviewUrl(id, _requestedByMemberId, currentMemberId) {
+    async attachmentPreviewUrl(id, _requestedByMemberId, currentMemberId, requestOrigin) {
         return this.attachmentService.createSignedUrl({
             disposition: 'inline',
             id,
+            requestOrigin,
             requestedByMemberId: currentMemberId,
         });
     }
@@ -53,8 +56,9 @@ tslib_1.__decorate([
         type: () => String,
     })),
     tslib_1.__param(2, (0, bpm_auth_1.BPMCurrentMemberId)()),
+    tslib_1.__param(3, (0, attachment_request_origin_1.BPMAttachmentRequestOrigin)()),
     tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [String, Object, String]),
+    tslib_1.__metadata("design:paramtypes", [String, Object, String, Object]),
     tslib_1.__metadata("design:returntype", Promise)
 ], AttachmentQueries.prototype, "attachmentDownloadUrl", null);
 tslib_1.__decorate([
@@ -66,8 +70,9 @@ tslib_1.__decorate([
         type: () => String,
     })),
     tslib_1.__param(2, (0, bpm_auth_1.BPMCurrentMemberId)()),
+    tslib_1.__param(3, (0, attachment_request_origin_1.BPMAttachmentRequestOrigin)()),
     tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [String, Object, String]),
+    tslib_1.__metadata("design:paramtypes", [String, Object, String, Object]),
     tslib_1.__metadata("design:returntype", Promise)
 ], AttachmentQueries.prototype, "attachmentPreviewUrl", null);
 exports.AttachmentQueries = AttachmentQueries = tslib_1.__decorate([

package/src/lib/attachment/attachment.queries.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachment.queries.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/attachment/attachment.queries.ts"],"names":[],"mappings":";;;;AAAA,6CAAwD;AACxD,0CAAmE;AACnE,2DAAuD;AACvD,6DAAyD;AAIlD,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YAA6B,iBAAoC;QAApC,sBAAiB,GAAjB,iBAAiB,CAAmB;IAAG,CAAC;IAG/D,AAAN,KAAK,CAAC,WAAW,CAC6B,UAAkB,EAE9D,MAAsB,EAEtB,aAA6B,EACP,eAAwB;QAE9C,OAAO,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;YAC5C,aAAa,EAAE,aAAa,IAAI,IAAI;YACpC,UAAU;YACV,mBAAmB,EAAE,eAAe;YACpC,MAAM,EAAE,MAAM,IAAI,IAAI;SACvB,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,qBAAqB,CACW,EAAU,EAO9C,oBAAmC,EACb,eAAuB;QAE7C,OAAO,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;YAC5C,WAAW,EAAE,YAAY;YACzB,EAAE;YACF,mBAAmB,EAAE,eAAe;SACrC,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,oBAAoB,CACY,EAAU,EAO9C,oBAAmC,EACb,eAAuB;QAE7C,OAAO,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;YAC5C,WAAW,EAAE,QAAQ;YACrB,EAAE;YACF,mBAAmB,EAAE,eAAe;SACrC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAzDY,8CAAiB;AAItB;IADL,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,CAAC,oCAAgB,CAAC,CAAC;IAE7B,mBAAA,IAAA,cAAI,EAAC,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1C,mBAAA,IAAA,cAAI,EAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAEtD,mBAAA,IAAA,cAAI,EAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAE7D,mBAAA,IAAA,6BAAkB,GAAE,CAAA;;;;oDAQtB;AAGK;IADL,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,MAAM,CAAC;IAEjB,mBAAA,IAAA,cAAI,EAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAClC,mBAAA,IAAA,cAAI,EAAC,qBAAqB,EAAE;QAC3B,iBAAiB,EACf,+DAA+D;QACjE,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM;KACnB,CAAC,CAAA;IAED,mBAAA,IAAA,6BAAkB,GAAE,CAAA;;;;8DAOtB;AAGK;IADL,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,MAAM,CAAC;IAEjB,mBAAA,IAAA,cAAI,EAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAClC,mBAAA,IAAA,cAAI,EAAC,qBAAqB,EAAE;QAC3B,iBAAiB,EACf,+DAA+D;QACjE,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM;KACnB,CAAC,CAAA;IAED,mBAAA,IAAA,6BAAkB,GAAE,CAAA;;;;6DAOtB;4BAxDU,iBAAiB;IAF7B,IAAA,kBAAQ,GAAE;IACV,IAAA,2BAAgB,GAAE;6CAE+B,sCAAiB;GADtD,iBAAiB,CAyD7B"}
+{"version":3,"file":"attachment.queries.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/attachment/attachment.queries.ts"],"names":[],"mappings":";;;;AAAA,6CAAwD;AACxD,0CAAmE;AACnE,2DAAuD;AACvD,2EAAyE;AACzE,6DAAyD;AAIlD,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YAA6B,iBAAoC;QAApC,sBAAiB,GAAjB,iBAAiB,CAAmB;IAAG,CAAC;IAG/D,AAAN,KAAK,CAAC,WAAW,CAC6B,UAAkB,EAE9D,MAAsB,EAEtB,aAA6B,EACP,eAAwB;QAE9C,OAAO,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;YAC5C,aAAa,EAAE,aAAa,IAAI,IAAI;YACpC,UAAU;YACV,mBAAmB,EAAE,eAAe;YACpC,MAAM,EAAE,MAAM,IAAI,IAAI;SACvB,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,qBAAqB,CACW,EAAU,EAO9C,oBAAmC,EACb,eAAuB,EACf,aAA4B;QAE1D,OAAO,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;YAC5C,WAAW,EAAE,YAAY;YACzB,EAAE;YACF,aAAa;YACb,mBAAmB,EAAE,eAAe;SACrC,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,oBAAoB,CACY,EAAU,EAO9C,oBAAmC,EACb,eAAuB,EACf,aAA4B;QAE1D,OAAO,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;YAC5C,WAAW,EAAE,QAAQ;YACrB,EAAE;YACF,aAAa;YACb,mBAAmB,EAAE,eAAe;SACrC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA7DY,8CAAiB;AAItB;IADL,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,CAAC,oCAAgB,CAAC,CAAC;IAE7B,mBAAA,IAAA,cAAI,EAAC,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1C,mBAAA,IAAA,cAAI,EAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAEtD,mBAAA,IAAA,cAAI,EAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAE7D,mBAAA,IAAA,6BAAkB,GAAE,CAAA;;;;oDAQtB;AAGK;IADL,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,MAAM,CAAC;IAEjB,mBAAA,IAAA,cAAI,EAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAClC,mBAAA,IAAA,cAAI,EAAC,qBAAqB,EAAE;QAC3B,iBAAiB,EACf,+DAA+D;QACjE,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM;KACnB,CAAC,CAAA;IAED,mBAAA,IAAA,6BAAkB,GAAE,CAAA;IACpB,mBAAA,IAAA,sDAA0B,GAAE,CAAA;;;;8DAQ9B;AAGK;IADL,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,MAAM,CAAC;IAEjB,mBAAA,IAAA,cAAI,EAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAClC,mBAAA,IAAA,cAAI,EAAC,qBAAqB,EAAE;QAC3B,iBAAiB,EACf,+DAA+D;QACjE,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM;KACnB,CAAC,CAAA;IAED,mBAAA,IAAA,6BAAkB,GAAE,CAAA;IACpB,mBAAA,IAAA,sDAA0B,GAAE,CAAA;;;;6DAQ9B;4BA5DU,iBAAiB;IAF7B,IAAA,kBAAQ,GAAE;IACV,IAAA,2BAAgB,GAAE;6CAE+B,sCAAiB;GADtD,iBAAiB,CA6D7B"}

package/src/lib/attachment/attachment.service.d.ts

@@ -28,9 +28,14 @@ export declare class AttachmentService {
         readonly formData: Readonly<Record<string, unknown>>;
         readonly instanceId: string;
     }): Promise<void>;
-    createSignedUrl({ disposition, id, requestedByMemberId, }: {
+    createSignedUrl({ disposition, id, requestOrigin, requestedByMemberId, }: {
         readonly disposition: AttachmentDisposition;
         readonly id: string;
+        /**
+         * Origin the request came in on; builds the URL when no public base URL
+         * is configured. Without either, the URL is root-relative.
+         */
+        readonly requestOrigin?: string | null;
         readonly requestedByMemberId: string;
     }): Promise<string>;
     readSignedAttachment({ disposition, id, token, }: {

package/src/lib/attachment/attachment.service.js

@@ -7,6 +7,7 @@ const common_1 = require("@nestjs/common");
 const typeorm_1 = require("typeorm");
 const typeorm_2 = require("@nestjs/typeorm");
 const approval_instance_entity_1 = require("../workflow-engine/approval-instance.entity");
+const instance_submitter_1 = require("../workflow-engine/instance-submitter");
 const task_candidate_entity_1 = require("../workflow-engine/task-candidate.entity");
 const task_decision_entity_1 = require("../workflow-engine/task-decision.entity");
 const task_entity_1 = require("../workflow-engine/task.entity");
@@ -15,7 +16,7 @@ const attachment_options_1 = require("./attachment-options");
 const attachment_entity_1 = require("./attachment.entity");
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 let AttachmentService = class AttachmentService {
-    constructor(attachmentRepository, approvalInstanceRepository, taskRepository, taskCandidateRepository, taskDecisionRepository, storage, attachmentOptions = attachment_options_1.DEFAULT_BPM_ATTACHMENT_OPTIONS) {
+    constructor(attachmentRepository, approvalInstanceRepository, taskRepository, taskCandidateRepository, taskDecisionRepository, storage, attachmentOptions = (0, attachment_options_1.resolveBPMAttachmentOptions)()) {
         this.attachmentRepository = attachmentRepository;
         this.approvalInstanceRepository = approvalInstanceRepository;
         this.taskRepository = taskRepository;
@@ -103,7 +104,7 @@ let AttachmentService = class AttachmentService {
             await attachmentRepository.save(nextAttachments);
         }
     }
-    async createSignedUrl({ disposition, id, requestedByMemberId, }) {
+    async createSignedUrl({ disposition, id, requestOrigin = null, requestedByMemberId, }) {
         const attachment = await this.readAttachmentOrThrow(id);
         await this.assertAttachmentReadableByMember(attachment, requestedByMemberId);
         if (disposition === 'inline' && attachment.mimeType !== 'application/pdf') {
@@ -115,7 +116,8 @@ let AttachmentService = class AttachmentService {
                 this.attachmentOptions.signedUrlTtlSeconds,
             id,
         }, this.attachmentOptions.signedUrlSecret);
-        return `${this.attachmentOptions.publicBaseUrl}${this.attachmentOptions.routePrefix}/${id}/download?token=${encodeURIComponent(token)}&disposition=${disposition}`;
+        const baseUrl = this.attachmentOptions.publicBaseUrl ?? requestOrigin ?? '';
+        return `${baseUrl}${this.attachmentOptions.routePrefix}/${id}/download?token=${encodeURIComponent(token)}&disposition=${disposition}`;
     }
     async readSignedAttachment({ disposition, id, token, }) {
         const payload = verifyAttachmentToken(token, this.attachmentOptions.signedUrlSecret);
@@ -148,7 +150,11 @@ let AttachmentService = class AttachmentService {
                 where: { id: attachment.instanceId },
             })
             : null;
-        if (instance?.initiatorMemberId === requestedByMemberId) {
+        // The member who filed the instance on the applicant's behalf opens the
+        // instance detail, so they must be able to open its files as well.
+        if (instance &&
+            (instance.initiatorMemberId === requestedByMemberId ||
+                (0, instance_submitter_1.readDistinctSubmitterMemberId)(instance) === requestedByMemberId)) {
             return;
         }
         const task = attachment.taskId
@@ -184,7 +190,8 @@ let AttachmentService = class AttachmentService {
         const candidates = await this.taskCandidateRepository.find({
             where: { taskId: (0, typeorm_1.In)([...taskIds]) },
         });
-        return candidates.some((candidate) => candidate.memberId === memberId || candidate.originalMemberId === memberId);
+        return candidates.some((candidate) => candidate.memberId === memberId ||
+            candidate.originalMemberId === memberId);
     }
     async isMemberRelatedToTaskDecisions(taskIds, memberId) {
         const decisions = await this.taskDecisionRepository.find({