@rytass/bpm-core-nestjs-module 0.5.0 → 0.5.1

package/src/lib/signature/signature.service.ts

@@ -1,205 +0,0 @@
-import { createHash, createHmac } from 'crypto';
-import { Inject, Injectable, Optional } from '@nestjs/common';
-import { EntityManager, Repository } from 'typeorm';
-import { ApprovalInstanceEntity } from '../workflow-engine/approval-instance.entity';
-import { TaskDecisionActionEnum } from '../workflow-engine/workflow-engine.enums';
-import { TaskEntity } from '../workflow-engine/task.entity';
-import { SignatureEntity } from './signature.entity';
-import {
-  BPMResolvedSignatureOptions,
-  BPM_SIGNATURE_OPTIONS,
-  DEFAULT_BPM_SIGNATURE_OPTIONS,
-} from './signature-options';
-import { SignatureVerificationObject } from './signature-verification.object';
-
-const SIGNATURE_ALGORITHM = 'HMAC-SHA256';
-
-export interface SignTaskDecisionInput {
-  readonly action: TaskDecisionActionEnum;
-  readonly comment: string | null;
-  readonly decidedAt: Date;
-  readonly instance: ApprovalInstanceEntity;
-  readonly returnToNodeId: string | null;
-  readonly signerMemberId: string;
-  readonly task: TaskEntity;
-  readonly transferToMemberId: string | null;
-}
-
-@Injectable()
-export class SignatureService {
-  constructor(
-    @Optional()
-    @Inject(BPM_SIGNATURE_OPTIONS)
-    private readonly signatureOptions: BPMResolvedSignatureOptions = DEFAULT_BPM_SIGNATURE_OPTIONS,
-  ) {}
-
-  async signTaskDecision(
-    manager: EntityManager,
-    input: SignTaskDecisionInput,
-  ): Promise<SignatureEntity> {
-    const signatureRepository = manager.getRepository(SignatureEntity);
-    const previousSignature = await this.readLatestSignature(
-      signatureRepository,
-      input.instance.id,
-    );
-    const payload = buildTaskDecisionSignedPayload(input);
-    const signedPayloadHash = hashStableJson(payload);
-    const keyVersion = this.signatureOptions.currentKeyVersion;
-    const signature = await signHash(
-      signedPayloadHash,
-      keyVersion,
-      this.signatureOptions,
-    );
-
-    return signatureRepository.save(
-      signatureRepository.create({
-        algorithm: SIGNATURE_ALGORITHM,
-        instanceId: input.instance.id,
-        keyVersion,
-        previousSignatureHash: previousSignature?.signedPayloadHash ?? null,
-        signedAt: input.decidedAt,
-        signedPayload: payload,
-        signedPayloadHash,
-        signature,
-        signerMemberId: input.signerMemberId,
-        taskId: input.task.id,
-        timestampToken:
-          await this.signatureOptions.timestampProvider.createTimestampToken({
-            signedAt: input.decidedAt,
-            signedPayloadHash,
-          }),
-      }),
-    );
-  }
-
-  async listSignatures(
-    signatureRepository: Repository<SignatureEntity>,
-    instanceId: string,
-  ): Promise<readonly SignatureEntity[]> {
-    return signatureRepository.find({
-      order: { signedAt: 'ASC', id: 'ASC' },
-      where: { instanceId },
-    });
-  }
-
-  async verifyInstanceSignatureChain(
-    signatureRepository: Repository<SignatureEntity>,
-    instanceId: string,
-  ): Promise<SignatureVerificationObject> {
-    const signatures = await this.listSignatures(
-      signatureRepository,
-      instanceId,
-    );
-    const errors = (
-      await Promise.all(
-        signatures.map((signature, index) =>
-          verifySignatureAt(
-            signature,
-            signatures[index - 1] ?? null,
-            this.signatureOptions,
-          ),
-        ),
-      )
-    ).flatMap((signatureErrors) => signatureErrors);
-
-    return Object.assign(new SignatureVerificationObject(), {
-      checkedCount: signatures.length,
-      errors,
-      instanceId,
-      valid: errors.length === 0,
-    });
-  }
-
-  private async readLatestSignature(
-    signatureRepository: Repository<SignatureEntity>,
-    instanceId: string,
-  ): Promise<SignatureEntity | null> {
-    return signatureRepository.findOne({
-      order: { signedAt: 'DESC', id: 'DESC' },
-      where: { instanceId },
-    });
-  }
-}
-
-function buildTaskDecisionSignedPayload(
-  input: SignTaskDecisionInput,
-): Readonly<Record<string, unknown>> {
-  return {
-    action: input.action,
-    comment: input.comment,
-    decidedAt: input.decidedAt.toISOString(),
-    formDataHash: hashStableJson(input.instance.formData),
-    instanceId: input.instance.id,
-    nodeId: input.task.nodeId,
-    returnToNodeId: input.returnToNodeId,
-    signerMemberId: input.signerMemberId,
-    taskId: input.task.id,
-    transferToMemberId: input.transferToMemberId,
-  };
-}
-
-async function verifySignatureAt(
-  signature: SignatureEntity,
-  previousSignature: SignatureEntity | null,
-  options: BPMResolvedSignatureOptions,
-): Promise<readonly string[]> {
-  const payloadHash = hashStableJson(signature.signedPayload);
-  const expectedSignature = await signHash(
-    payloadHash,
-    signature.keyVersion,
-    options,
-  );
-  const expectedPreviousHash = previousSignature?.signedPayloadHash ?? null;
-
-  return [
-    payloadHash === signature.signedPayloadHash
-      ? null
-      : `Signature ${signature.id} payload hash mismatch`,
-    expectedSignature === signature.signature
-      ? null
-      : `Signature ${signature.id} HMAC mismatch`,
-    expectedPreviousHash === signature.previousSignatureHash
-      ? null
-      : `Signature ${signature.id} previous hash mismatch`,
-  ].filter(isPresentText);
-}
-
-async function signHash(
-  signedPayloadHash: string,
-  keyVersion: number,
-  options: BPMResolvedSignatureOptions,
-): Promise<string> {
-  const key = await options.keyProvider.readKey(keyVersion);
-
-  if (!key) {
-    throw new Error(`Unsupported signature key version: ${keyVersion}`);
-  }
-
-  return createHmac('sha256', key).update(signedPayloadHash).digest('base64');
-}
-
-function hashStableJson(value: unknown): string {
-  return createHash('sha256').update(stableStringify(value)).digest('hex');
-}
-
-function stableStringify(value: unknown): string {
-  if (value === null || typeof value !== 'object') {
-    return JSON.stringify(value);
-  }
-
-  if (Array.isArray(value)) {
-    return `[${value.map(stableStringify).join(',')}]`;
-  }
-
-  return `{${Object.entries(value as Readonly<Record<string, unknown>>)
-    .sort(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey))
-    .map(
-      ([key, entryValue]) =>
-        `${JSON.stringify(key)}:${stableStringify(entryValue)}`,
-    )
-    .join(',')}}`;
-}
-
-function isPresentText(value: string | null): value is string {
-  return typeof value === 'string' && value.length > 0;
-}

package/src/lib/template/approval-template-category.entity.ts

@@ -1,40 +0,0 @@
-import { Field, ID, Int, ObjectType } from '@nestjs/graphql';
-import {
-  Column,
-  CreateDateColumn,
-  Entity,
-  PrimaryGeneratedColumn,
-  UpdateDateColumn,
-} from 'typeorm';
-
-@Entity('approval_template_categories')
-@ObjectType('ApprovalTemplateCategory')
-export class ApprovalTemplateCategoryEntity {
-  @PrimaryGeneratedColumn('uuid')
-  @Field(() => ID)
-  id!: string;
-
-  @Column('text')
-  @Field()
-  name!: string;
-
-  @Column('text', { nullable: true })
-  @Field(() => String, { nullable: true })
-  description!: string | null;
-
-  @Column('boolean', { default: true, name: 'is_active' })
-  @Field()
-  isActive!: boolean;
-
-  @Column('int', { default: 0, name: 'sort_order' })
-  @Field(() => Int)
-  sortOrder!: number;
-
-  @CreateDateColumn({ name: 'created_at', type: 'timestamptz' })
-  @Field()
-  createdAt!: Date;
-
-  @UpdateDateColumn({ name: 'updated_at', type: 'timestamptz' })
-  @Field()
-  updatedAt!: Date;
-}

package/src/lib/template/approval-template-version.entity.ts

@@ -1,82 +0,0 @@
-import { WorkflowDefinition } from '@rytass/bpm-core-shared/workflow';
-import { Field, ID, Int, ObjectType } from '@nestjs/graphql';
-import {
-  Column,
-  CreateDateColumn,
-  Entity,
-  PrimaryGeneratedColumn,
-  UpdateDateColumn,
-} from 'typeorm';
-import { ApprovalTemplateVersionStatusEnum } from './template.enums';
-
-@Entity('approval_template_versions')
-@ObjectType('ApprovalTemplateVersion')
-export class ApprovalTemplateVersionEntity {
-  @PrimaryGeneratedColumn('uuid')
-  @Field(() => ID)
-  id!: string;
-
-  @Column('uuid', { name: 'template_id' })
-  @Field(() => ID)
-  templateId!: string;
-
-  @Column('int')
-  @Field(() => Int)
-  version!: number;
-
-  @Column('text')
-  @Field(() => ApprovalTemplateVersionStatusEnum)
-  status!: ApprovalTemplateVersionStatusEnum;
-
-  @Column('jsonb', { name: 'workflow_definition' })
-  workflowDefinition!: WorkflowDefinition;
-
-  @Column('uuid', { name: 'form_definition_version_id', nullable: true })
-  @Field(() => ID, { nullable: true })
-  formDefinitionVersionId!: string | null;
-
-  @Column('text', { name: 'initiator_policy_cel', nullable: true })
-  @Field(() => String, { nullable: true })
-  initiatorPolicyCel!: string | null;
-
-  @Column('jsonb', { name: 'notification_config', nullable: true })
-  notificationConfig!: Readonly<Record<string, unknown>> | null;
-
-  @Column('jsonb', { name: 'sla_defaults', nullable: true })
-  slaDefaults!: Readonly<Record<string, unknown>> | null;
-
-  @Column('timestamptz', { name: 'published_at', nullable: true })
-  @Field(() => Date, { nullable: true })
-  publishedAt!: Date | null;
-
-  @Column('text', { name: 'published_by_member_id', nullable: true })
-  @Field(() => String, { nullable: true })
-  publishedByMemberId!: string | null;
-
-  @Column('timestamptz', { name: 'archived_at', nullable: true })
-  @Field(() => Date, { nullable: true })
-  archivedAt!: Date | null;
-
-  @CreateDateColumn({ name: 'created_at', type: 'timestamptz' })
-  @Field()
-  createdAt!: Date;
-
-  @UpdateDateColumn({ name: 'updated_at', type: 'timestamptz' })
-  @Field()
-  updatedAt!: Date;
-
-  @Field(() => String)
-  get workflowDefinitionJson(): string {
-    return JSON.stringify(this.workflowDefinition);
-  }
-
-  @Field(() => String, { nullable: true })
-  get notificationConfigJson(): string | null {
-    return this.notificationConfig ? JSON.stringify(this.notificationConfig) : null;
-  }
-
-  @Field(() => String, { nullable: true })
-  get slaDefaultsJson(): string | null {
-    return this.slaDefaults ? JSON.stringify(this.slaDefaults) : null;
-  }
-}

package/src/lib/template/approval-template.entity.ts

@@ -1,64 +0,0 @@
-import { Field, ID, ObjectType } from '@nestjs/graphql';
-import {
-  Column,
-  CreateDateColumn,
-  DeleteDateColumn,
-  Entity,
-  JoinColumn,
-  ManyToOne,
-  PrimaryGeneratedColumn,
-  UpdateDateColumn,
-} from 'typeorm';
-import { ApprovalTemplateCategoryEntity } from './approval-template-category.entity';
-
-@Entity('approval_templates')
-@ObjectType('ApprovalTemplate')
-export class ApprovalTemplateEntity {
-  @PrimaryGeneratedColumn('uuid')
-  @Field(() => ID)
-  id!: string;
-
-  @Column('text')
-  @Field()
-  name!: string;
-
-  @Column('text', { nullable: true })
-  @Field(() => String, { nullable: true })
-  description!: string | null;
-
-  @Column('text', { nullable: true })
-  @Field(() => String, { nullable: true })
-  category!: string | null;
-
-  @Column('uuid', { name: 'category_id', nullable: true })
-  @Field(() => ID, { nullable: true })
-  categoryId?: string | null;
-
-  @ManyToOne(() => ApprovalTemplateCategoryEntity, {
-    nullable: true,
-    onDelete: 'SET NULL',
-  })
-  @JoinColumn({ name: 'category_id' })
-  @Field(() => ApprovalTemplateCategoryEntity, { nullable: true })
-  categoryDetail?: ApprovalTemplateCategoryEntity | null;
-
-  @Column('uuid', { name: 'current_version_id', nullable: true })
-  @Field(() => ID, { nullable: true })
-  currentVersionId!: string | null;
-
-  @DeleteDateColumn({ name: 'deleted_at', type: 'timestamptz' })
-  @Field(() => Date, { nullable: true })
-  deletedAt!: Date | null;
-
-  @CreateDateColumn({ name: 'created_at', type: 'timestamptz' })
-  @Field()
-  createdAt!: Date;
-
-  @UpdateDateColumn({ name: 'updated_at', type: 'timestamptz' })
-  @Field()
-  updatedAt!: Date;
-
-  @Column('text', { name: 'created_by_member_id', nullable: true })
-  @Field(() => String, { nullable: true })
-  createdByMemberId!: string | null;
-}

package/src/lib/template/compose-approval-template.object.ts

@@ -1,23 +0,0 @@
-import { Field, ObjectType } from '@nestjs/graphql';
-import { FormDefinitionEntity } from '../form/form-definition.entity';
-import { FormDefinitionVersionEntity } from '../form/form-definition-version.entity';
-import { ApprovalTemplateEntity } from './approval-template.entity';
-import { ApprovalTemplateVersionEntity } from './approval-template-version.entity';
-
-@ObjectType('ComposeApprovalTemplateWithFormResult')
-export class ComposeApprovalTemplateWithFormObject {
-  @Field(() => FormDefinitionEntity)
-  formDefinition!: FormDefinitionEntity;
-
-  @Field(() => FormDefinitionVersionEntity)
-  formDefinitionVersion!: FormDefinitionVersionEntity;
-
-  @Field(() => ApprovalTemplateEntity)
-  template!: ApprovalTemplateEntity;
-
-  @Field(() => ApprovalTemplateVersionEntity)
-  templateVersion!: ApprovalTemplateVersionEntity;
-
-  @Field()
-  published!: boolean;
-}

package/src/lib/template/compose-template.mutations.ts

@@ -1,22 +0,0 @@
-import { Args, Mutation, Resolver } from '@nestjs/graphql';
-import { BPMCurrentMemberId, BPMDesignerOnly } from '../bpm-auth';
-import { ComposeApprovalTemplateWithFormObject } from './compose-approval-template.object';
-import { ComposeApprovalTemplateWithFormInput } from './dto/compose-approval-template.input';
-import { TemplateService } from './template.service';
-
-@Resolver()
-@BPMDesignerOnly()
-export class ComposeTemplateMutations {
-  constructor(private readonly templateService: TemplateService) {}
-
-  @Mutation(() => ComposeApprovalTemplateWithFormObject)
-  async composeApprovalTemplateWithForm(
-    @Args('input') input: ComposeApprovalTemplateWithFormInput,
-    @BPMCurrentMemberId() currentMemberId: string,
-  ): Promise<ComposeApprovalTemplateWithFormObject> {
-    return this.templateService.composeApprovalTemplateWithForm(
-      input,
-      currentMemberId,
-    );
-  }
-}

package/src/lib/template/dto/approval-template.input.ts

@@ -1,147 +0,0 @@
-import { Field, ID, InputType, Int } from '@nestjs/graphql';
-import {
-  IsBoolean,
-  IsInt,
-  IsOptional,
-  IsString,
-  IsUUID,
-} from 'class-validator';
-
-@InputType()
-export class CreateApprovalTemplateInput {
-  @Field()
-  @IsString()
-  name!: string;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  description!: string | null;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  category!: string | null;
-
-  @Field(() => ID, { nullable: true })
-  @IsOptional()
-  @IsUUID()
-  categoryId!: string | null;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  createdByMemberId!: string | null;
-
-  @Field(() => ID, { nullable: true })
-  @IsOptional()
-  @IsUUID()
-  formDefinitionVersionId!: string | null;
-}
-
-@InputType()
-export class UpdateApprovalTemplateInput {
-  @Field(() => ID)
-  @IsUUID()
-  id!: string;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  name!: string | null;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  description!: string | null;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  category!: string | null;
-
-  @Field(() => ID, { nullable: true })
-  @IsOptional()
-  @IsUUID()
-  categoryId!: string | null;
-}
-
-@InputType()
-export class CreateApprovalTemplateCategoryInput {
-  @Field()
-  @IsString()
-  name!: string;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  description!: string | null;
-
-  @Field(() => Boolean, { nullable: true })
-  @IsBoolean()
-  @IsOptional()
-  isActive!: boolean | null;
-
-  @Field(() => Int, { nullable: true })
-  @IsInt()
-  @IsOptional()
-  sortOrder!: number | null;
-}
-
-@InputType()
-export class UpdateApprovalTemplateCategoryInput {
-  @Field(() => ID)
-  @IsUUID()
-  id!: string;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  name!: string | null;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  description!: string | null;
-
-  @Field(() => Boolean, { nullable: true })
-  @IsBoolean()
-  @IsOptional()
-  isActive!: boolean | null;
-
-  @Field(() => Int, { nullable: true })
-  @IsInt()
-  @IsOptional()
-  sortOrder!: number | null;
-}
-
-@InputType()
-export class UpdateApprovalTemplateDraftInput {
-  @Field(() => ID)
-  @IsUUID()
-  versionId!: string;
-
-  @Field()
-  @IsString()
-  workflowDefinitionJson!: string;
-
-  @Field(() => ID, { nullable: true })
-  @IsOptional()
-  @IsUUID()
-  formDefinitionVersionId!: string | null;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  initiatorPolicyCel!: string | null;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  notificationConfigJson!: string | null;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  slaDefaultsJson!: string | null;
-}

package/src/lib/template/dto/compose-approval-template.input.ts

@@ -1,80 +0,0 @@
-import { Field, ID, InputType } from '@nestjs/graphql';
-import { IsBoolean, IsOptional, IsString, IsUUID } from 'class-validator';
-
-@InputType()
-export class ComposeApprovalTemplateWithFormInput {
-  // --- Target identity (decides create vs update of existing drafts) ---
-  @Field(() => ID, { nullable: true })
-  @IsOptional()
-  @IsUUID()
-  formDefinitionId!: string | null;
-
-  @Field(() => ID, { nullable: true })
-  @IsOptional()
-  @IsUUID()
-  templateId!: string | null;
-
-  // --- Form content ---
-  @Field()
-  @IsString()
-  formName!: string;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  formDescription!: string | null;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  schemaJson!: string | null;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  uiSchemaJson!: string | null;
-
-  // --- Template content ---
-  @Field()
-  @IsString()
-  templateName!: string;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  templateDescription!: string | null;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  category!: string | null;
-
-  @Field(() => ID, { nullable: true })
-  @IsOptional()
-  @IsUUID()
-  categoryId!: string | null;
-
-  @Field()
-  @IsString()
-  workflowDefinitionJson!: string;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  initiatorPolicyCel!: string | null;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  notificationConfigJson!: string | null;
-
-  @Field(() => String, { nullable: true })
-  @IsOptional()
-  @IsString()
-  slaDefaultsJson!: string | null;
-
-  // --- Behaviour flag ---
-  @Field()
-  @IsBoolean()
-  publish!: boolean;
-}

package/src/lib/template/template.enums.ts

@@ -1,30 +0,0 @@
-import { registerEnumType } from '@nestjs/graphql';
-
-export enum ApprovalTemplateVersionStatusEnum {
-  ARCHIVED = 'ARCHIVED',
-  DRAFT = 'DRAFT',
-  PUBLISHED = 'PUBLISHED',
-}
-
-export enum ApprovalTemplateListStatusEnum {
-  DRAFT = 'DRAFT',
-  PUBLISHED = 'PUBLISHED',
-}
-
-export enum ApprovalTemplateCategoryStatusEnum {
-  ACTIVE = 'ACTIVE',
-  ALL = 'ALL',
-  INACTIVE = 'INACTIVE',
-}
-
-registerEnumType(ApprovalTemplateVersionStatusEnum, {
-  name: 'ApprovalTemplateVersionStatus',
-});
-
-registerEnumType(ApprovalTemplateListStatusEnum, {
-  name: 'ApprovalTemplateListStatus',
-});
-
-registerEnumType(ApprovalTemplateCategoryStatusEnum, {
-  name: 'ApprovalTemplateCategoryStatus',
-});