@rytass/bpm-core-nestjs-module 0.6.0 → 0.9.0

package/src/lib/workflow-engine/workflow-engine.service.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WorkflowEngineService = void 0;
+exports.WorkflowEngineService = exports.MANUAL_TRANSFER_DELEGATION_REASON = void 0;
 const tslib_1 = require("tslib");
+const form_1 = require("@rytass/bpm-core-shared/form");
 const common_1 = require("@nestjs/common");
 const typeorm_1 = require("@nestjs/typeorm");
 const typeorm_2 = require("typeorm");
@@ -9,6 +10,9 @@ const attachment_service_1 = require("../attachment/attachment.service");
 const delegation_service_1 = require("../delegation/delegation.service");
 const form_definition_version_entity_1 = require("../form/form-definition-version.entity");
 const form_enums_1 = require("../form/form.enums");
+const form_data_source_errors_1 = require("../form-data-source/form-data-source.errors");
+const form_data_source_types_1 = require("../form-data-source/form-data-source.types");
+const sla_schedule_service_1 = require("../calendar/sla-schedule.service");
 const notification_service_1 = require("../notification/notification.service");
 const notification_entity_1 = require("../notification/notification.entity");
 const notification_enums_1 = require("../notification/notification.enums");
@@ -36,6 +40,11 @@ const workflow_token_entity_1 = require("./workflow-token.entity");
 const MAX_PROCESSING_STEPS = 500;
 const DEFAULT_APPROVAL_HISTORY_TASK_LIMIT = 50;
 const SYSTEM_DRY_RUN_INSTANCE_ID = 'dry-run-instance';
+/**
+ * Delegation-chain reason recorded for an approver-initiated transfer, as
+ * opposed to {@link SLA_ESCALATION_DELEGATION_REASON}.
+ */
+exports.MANUAL_TRANSFER_DELEGATION_REASON = 'MANUAL_TRANSFER';
 const WORKFLOW_READ_ALL_PERMISSIONS = new Set([
     'bpm:*',
     'bpm.workflow.read_all',
@@ -43,7 +52,7 @@ const WORKFLOW_READ_ALL_PERMISSIONS = new Set([
     'workflow.read_all',
 ]);
 let WorkflowEngineService = class WorkflowEngineService {
-    constructor(approvalInstanceRepository, workflowTokenRepository, taskRepository, taskCandidateRepository, taskDecisionRepository, notificationRepository, activityLogRepository, adhocDirectiveRepository, approvalTemplateRepository, approvalTemplateVersionRepository, formDefinitionVersionRepository, attachmentService, conditionService, delegationService, notificationService, signatureService, serviceTaskDispatcher = new workflow_service_task_dispatcher_token_1.DefaultWorkflowServiceTaskDispatcher()) {
+    constructor(approvalInstanceRepository, workflowTokenRepository, taskRepository, taskCandidateRepository, taskDecisionRepository, notificationRepository, activityLogRepository, adhocDirectiveRepository, approvalTemplateRepository, approvalTemplateVersionRepository, formDefinitionVersionRepository, attachmentService, conditionService, delegationService, notificationService, signatureService, slaScheduleService, serviceTaskDispatcher = new workflow_service_task_dispatcher_token_1.DefaultWorkflowServiceTaskDispatcher(), formDataSourceValueResolver) {
         this.approvalInstanceRepository = approvalInstanceRepository;
         this.workflowTokenRepository = workflowTokenRepository;
         this.taskRepository = taskRepository;
@@ -60,17 +69,28 @@ let WorkflowEngineService = class WorkflowEngineService {
         this.delegationService = delegationService;
         this.notificationService = notificationService;
         this.signatureService = signatureService;
+        this.slaScheduleService = slaScheduleService;
         this.serviceTaskDispatcher = serviceTaskDispatcher;
+        this.formDataSourceValueResolver = formDataSourceValueResolver;
     }
-    async submitApprovalInstance(input) {
+    async submitApprovalInstance(input, authContext) {
         const formData = parseJsonObject(input.formDataJson, 'formDataJson');
         const template = await this.getTemplateOrThrow(input.templateId);
+        if (!template.isActive) {
+            throw new common_1.ConflictException('Approval template is deactivated');
+        }
         if (!template.currentVersionId) {
             throw new common_1.ConflictException('Approval template does not have a published version');
         }
         const templateVersion = await this.getPublishedTemplateVersionOrThrow(template.currentVersionId);
         const formDefinitionVersion = await this.getPublishedFormVersionOrThrow(templateVersion.formDefinitionVersionId);
         validateSubmittedFormData(formDefinitionVersion.schema, formData);
+        const formDataOptionSnapshot = await this.resolveFormDataOptionSnapshots({
+            authContext: authContext ?? createWorkflowAuthContext(input.initiatorMemberId),
+            formData,
+            revalidateAll: true,
+            schema: formDefinitionVersion.schema,
+        });
         const initiatorMetadataSnapshot = input.initiatorMetadataSnapshotJson
             ? parseJsonObject(input.initiatorMetadataSnapshotJson, 'initiatorMetadataSnapshotJson')
             : await this.readDefaultInitiatorMetadataSnapshot(input.initiatorMemberId);
@@ -89,6 +109,7 @@ let WorkflowEngineService = class WorkflowEngineService {
             const instance = await instanceRepository.save(instanceRepository.create({
                 completedAt: null,
                 formData,
+                formDataOptionSnapshot,
                 formDefinitionSnapshot: {
                     formDefinitionVersionId: formDefinitionVersion.id,
                     schema: formDefinitionVersion.schema,
@@ -142,6 +163,48 @@ let WorkflowEngineService = class WorkflowEngineService {
             return instance;
         });
     }
+    async resolveFormDataOptionSnapshots({ authContext, formData, previousFormData, previousSnapshots, revalidateAll, schema, }) {
+        if (!this.formDataSourceValueResolver) {
+            assertNoUnresolvableDynamicValues(schema, formData);
+            return previousSnapshots ?? {};
+        }
+        return this.formDataSourceValueResolver.resolveFormDataOptionSnapshots({
+            authContext,
+            formData,
+            previousFormData,
+            previousSnapshots,
+            revalidateAll,
+            schema,
+        });
+    }
+    async prepareResubmitFormDataOptions(input, formData, authContext) {
+        const instance = await this.approvalInstanceRepository.findOne({
+            where: { id: input.instanceId },
+        });
+        if (!instance) {
+            throw new common_1.NotFoundException(`Approval instance ${input.instanceId} was not found`);
+        }
+        if (instance.initiatorMemberId !== input.initiatorMemberId) {
+            throw new common_1.ConflictException(`Approval instance ${instance.id} can only be resubmitted by its initiator`);
+        }
+        if (instance.state !== workflow_engine_enums_1.ApprovalInstanceStateEnum.RETURNED) {
+            throw new common_1.ConflictException(`Approval instance ${instance.id} is not returned`);
+        }
+        const template = await this.getTemplateOrThrow(instance.templateId);
+        if (!template.isActive) {
+            throw new common_1.ConflictException('Approval template is deactivated');
+        }
+        const schema = readFormDefinitionSnapshotSchema(instance.formDefinitionSnapshot);
+        validateSubmittedFormData(schema, formData);
+        const formDataOptionSnapshot = await this.resolveFormDataOptionSnapshots({
+            authContext,
+            formData,
+            previousFormData: instance.formData,
+            previousSnapshots: instance.formDataOptionSnapshot ?? {},
+            schema,
+        });
+        return { formDataOptionSnapshot, instance };
+    }
     async processInstance(instanceId) {
         await this.approvalInstanceRepository.manager.transaction(async (manager) => {
             await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
@@ -169,7 +232,7 @@ let WorkflowEngineService = class WorkflowEngineService {
             await this.processRunningInstance(manager, instance);
         });
     }
-    async decideTask(input) {
+    async decideTask(input, options = {}) {
         return this.approvalInstanceRepository.manager.transaction(async (manager) => {
             const taskRepository = manager.getRepository(task_entity_1.TaskEntity);
             const taskCandidateRepository = manager.getRepository(task_candidate_entity_1.TaskCandidateEntity);
@@ -220,9 +283,30 @@ let WorkflowEngineService = class WorkflowEngineService {
             if (instance.state !== workflow_engine_enums_1.ApprovalInstanceStateEnum.RUNNING) {
                 throw new common_1.ConflictException(`Approval instance ${instance.id} is not running`);
             }
+            const taskNode = readWorkflowNodeOrThrow(instance.workflowSnapshot, task.nodeId);
+            if (taskNode.type !== 'userTask') {
+                throw new common_1.ConflictException(`Task ${task.id} is not bound to a user task node`);
+            }
+            if (input.action === workflow_engine_enums_1.TaskDecisionActionEnum.REJECTED &&
+                taskNode.data.allowReject === false) {
+                throw new common_1.ForbiddenException(`Workflow node ${task.nodeId} does not allow rejection`);
+            }
+            if (input.action === workflow_engine_enums_1.TaskDecisionActionEnum.TRANSFERRED &&
+                options.transferReason === undefined &&
+                taskNode.data.allowTransfer === false) {
+                throw new common_1.ForbiddenException(`Workflow node ${task.nodeId} does not allow transfer`);
+            }
             const returnToNodeId = input.action === workflow_engine_enums_1.TaskDecisionActionEnum.RETURNED
                 ? readReturnTargetNodeId(instance.workflowSnapshot, task.nodeId, input.returnToNodeId)
                 : null;
+            // Read from the instance snapshot, not the live template: templates
+            // that turn `requireComment` on later must not retroactively block
+            // in-flight instances started against the previous version.
+            if (input.action === workflow_engine_enums_1.TaskDecisionActionEnum.RETURNED &&
+                !decisionComment &&
+                isReturnCommentRequired(instance.workflowSnapshot, task.nodeId)) {
+                throw new common_1.BadRequestException(`Return decision comment is required by workflow node ${task.nodeId}`);
+            }
             const decidedAt = new Date();
             const claimedTask = await taskRepository.save({
                 ...task,
@@ -261,7 +345,7 @@ let WorkflowEngineService = class WorkflowEngineService {
                 transferToMemberId,
             }));
             if (input.action === workflow_engine_enums_1.TaskDecisionActionEnum.TRANSFERRED) {
-                await this.transferTask(manager, instance, claimedTask, decision, signature, transferToMemberId, decisionComment, decidedAt, claimedCandidate);
+                await this.transferTask(manager, instance, claimedTask, decision, signature, transferToMemberId, decisionComment, decidedAt, claimedCandidate, options.transferReason ?? exports.MANUAL_TRANSFER_DELEGATION_REASON);
                 await this.notificationService.resolveTaskNotifications({
                     actingMemberId: input.decidedByMemberId,
                     manager,
@@ -408,8 +492,11 @@ let WorkflowEngineService = class WorkflowEngineService {
             return cancelledInstance;
         });
     }
-    async resubmitApprovalInstance(input) {
+    async resubmitApprovalInstance(input, authContext) {
         const formData = parseJsonObject(input.formDataJson, 'formDataJson');
+        const preparation = this.formDataSourceValueResolver
+            ? await this.prepareResubmitFormDataOptions(input, formData, authContext ?? createWorkflowAuthContext(input.initiatorMemberId))
+            : null;
         return this.approvalInstanceRepository.manager.transaction(async (manager) => {
             await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
                 input.instanceId,
@@ -427,11 +514,28 @@ let WorkflowEngineService = class WorkflowEngineService {
             if (instance.state !== workflow_engine_enums_1.ApprovalInstanceStateEnum.RETURNED) {
                 throw new common_1.ConflictException(`Approval instance ${instance.id} is not returned`);
             }
-            validateSubmittedFormData(readFormDefinitionSnapshotSchema(instance.formDefinitionSnapshot), formData);
+            const template = await this.getTemplateOrThrow(instance.templateId);
+            if (!template.isActive) {
+                throw new common_1.ConflictException('Approval template is deactivated');
+            }
+            if (preparation &&
+                !isSameApprovalInstanceRevision(preparation.instance, instance)) {
+                throw new common_1.ConflictException('Approval instance changed while options were resolving; refresh and retry');
+            }
+            const resubmitSchema = readFormDefinitionSnapshotSchema(instance.formDefinitionSnapshot);
+            validateSubmittedFormData(resubmitSchema, formData);
+            if (!preparation) {
+                assertNoUnresolvableDynamicValues(resubmitSchema, formData);
+            }
             const resubmittedInstance = await instanceRepository.save({
                 ...instance,
                 completedAt: null,
                 formData,
+                formDataOptionSnapshot: preparation?.formDataOptionSnapshot ??
+                    // Without a resolver every remaining dynamic value was rejected
+                    // above, so only cleared fields can reach here — drop their
+                    // snapshots instead of keeping a label for a value that is gone.
+                    readSnapshotForPresentValues(resubmitSchema, formData, instance.formDataOptionSnapshot),
                 state: workflow_engine_enums_1.ApprovalInstanceStateEnum.RUNNING,
                 title: input.title?.trim() || instance.title,
             });
@@ -454,7 +558,13 @@ let WorkflowEngineService = class WorkflowEngineService {
                 taskId: null,
             }));
             await this.processRunningInstance(manager, runtimeInstance);
-            return runtimeInstance;
+            const refreshedInstance = await instanceRepository.findOne({
+                where: { id: instance.id },
+            });
+            if (!refreshedInstance) {
+                throw new common_1.NotFoundException(`Approval instance ${instance.id} was not found after resubmit`);
+            }
+            return refreshedInstance;
         });
     }
     async requestAdhocCountersign({ comment, requestedByMemberId, target, taskId, }) {
@@ -1344,6 +1454,7 @@ let WorkflowEngineService = class WorkflowEngineService {
     async listLaunchableApprovalTemplates(memberId) {
         const templates = await this.approvalTemplateRepository.find({
             order: { updatedAt: 'DESC' },
+            where: { isActive: true },
         });
         const currentVersionIds = templates
             .map((template) => template.currentVersionId)
@@ -1895,6 +2006,10 @@ let WorkflowEngineService = class WorkflowEngineService {
         const candidates = await this.resolveRuntimeTaskCandidates(manager, instance, node);
         const primaryCandidate = candidates[0];
         const now = new Date();
+        const slaDueAt = await this.slaScheduleService.resolveTaskSlaDueAt({
+            node,
+            now,
+        });
         const task = await taskRepository.save(taskRepository.create({
             assigneeMemberId: candidates.length === 1 ? primaryCandidate.memberId : null,
             assignmentType: candidates.length === 1
@@ -1908,7 +2023,7 @@ let WorkflowEngineService = class WorkflowEngineService {
             nodeId: node.id,
             openedAt: null,
             originalAssigneeMemberId: candidates.length === 1 ? primaryCandidate.originalMemberId : null,
-            slaDueAt: (0, notification_service_1.calculateTaskSlaDueAt)({ node, now }),
+            slaDueAt,
             status: workflow_engine_enums_1.TaskStatusEnum.PENDING,
             tokenId: token.id,
         }));
@@ -2006,7 +2121,7 @@ let WorkflowEngineService = class WorkflowEngineService {
         }
         return nextCandidates;
     }
-    async transferTask(manager, instance, task, decision, signature, transferToMemberId, decisionComment, decidedAt, actorCandidate) {
+    async transferTask(manager, instance, task, decision, signature, transferToMemberId, decisionComment, decidedAt, actorCandidate, transferReason) {
         if (!transferToMemberId) {
             throw new common_1.BadRequestException('Transfer target member is required');
         }
@@ -2021,7 +2136,7 @@ let WorkflowEngineService = class WorkflowEngineService {
             ...readDelegationSteps(task.delegationChain),
             {
                 from: transferringMemberId,
-                reason: 'MANUAL_TRANSFER',
+                reason: transferReason,
                 ruleId: null,
                 to: transferToMemberId,
             },
@@ -2386,11 +2501,20 @@ let WorkflowEngineService = class WorkflowEngineService {
         if (action.type === 'SET_FORM_FIELD') {
             const value = this.conditionService.evaluateValue(action.value, buildWorkflowExpressionContext(instance), `workflow.nodes.${node.id}.data.action.value`);
             const updatedFormData = writeValueAtPath(instance.formData, action.fieldPath, value);
+            // A service task runs inside this transaction, so it cannot call a host
+            // provider to re-resolve the label. Rather than leave the previous
+            // option snapshot describing a value that no longer exists, drop it: the
+            // history view then shows the raw value instead of a wrong label.
+            const staleSnapshotFieldKey = readDataSourceFieldKeyAtPath(instance.formDefinitionSnapshot, action.fieldPath);
+            const updatedOptionSnapshot = staleSnapshotFieldKey
+                ? readSnapshotWithoutField(instance.formDataOptionSnapshot, staleSnapshotFieldKey)
+                : instance.formDataOptionSnapshot;
             const updatedInstance = await manager
                 .getRepository(approval_instance_entity_1.ApprovalInstanceEntity)
                 .save({
                 ...instance,
                 formData: updatedFormData,
+                formDataOptionSnapshot: updatedOptionSnapshot,
             });
             Object.assign(instance, updatedInstance);
             await activityRepository.save(activityRepository.create({
@@ -2400,6 +2524,7 @@ let WorkflowEngineService = class WorkflowEngineService {
                 nodeId: node.id,
                 payload: {
                     action: 'SET_FORM_FIELD',
+                    clearedOptionSnapshot: staleSnapshotFieldKey ?? null,
                     fieldPath: action.fieldPath,
                     tokenId: token.id,
                 },
@@ -2715,8 +2840,10 @@ exports.WorkflowEngineService = WorkflowEngineService = tslib_1.__decorate([
     tslib_1.__param(8, (0, typeorm_1.InjectRepository)(approval_template_entity_1.ApprovalTemplateEntity)),
     tslib_1.__param(9, (0, typeorm_1.InjectRepository)(approval_template_version_entity_1.ApprovalTemplateVersionEntity)),
     tslib_1.__param(10, (0, typeorm_1.InjectRepository)(form_definition_version_entity_1.FormDefinitionVersionEntity)),
-    tslib_1.__param(16, (0, common_1.Optional)()),
-    tslib_1.__param(16, (0, common_1.Inject)(workflow_service_task_dispatcher_token_1.BPM_WORKFLOW_SERVICE_TASK_DISPATCHER)),
+    tslib_1.__param(17, (0, common_1.Optional)()),
+    tslib_1.__param(17, (0, common_1.Inject)(workflow_service_task_dispatcher_token_1.BPM_WORKFLOW_SERVICE_TASK_DISPATCHER)),
+    tslib_1.__param(18, (0, common_1.Optional)()),
+    tslib_1.__param(18, (0, common_1.Inject)(form_data_source_types_1.BPM_FORM_DATA_SOURCE_VALUE_RESOLVER)),
     tslib_1.__metadata("design:paramtypes", [typeorm_2.Repository,
         typeorm_2.Repository,
         typeorm_2.Repository,
@@ -2732,7 +2859,8 @@ exports.WorkflowEngineService = WorkflowEngineService = tslib_1.__decorate([
         condition_service_1.ConditionService,
         delegation_service_1.DelegationService,
         notification_service_1.NotificationService,
-        signature_service_1.SignatureService, Object])
+        signature_service_1.SignatureService,
+        sla_schedule_service_1.BPMSlaScheduleService, Object, Object])
 ], WorkflowEngineService);
 function parseJsonObject(value, label) {
     try {
@@ -2755,6 +2883,98 @@ function readDefaultInitiatorMetadataSnapshot(memberId) {
         memberId,
     };
 }
+function createWorkflowAuthContext(memberId) {
+    return {
+        memberId,
+        metadata: {},
+        permissions: [],
+        roles: [],
+    };
+}
+function isSameApprovalInstanceRevision(left, right) {
+    return (readApprovalInstanceRevision(left) === readApprovalInstanceRevision(right) &&
+        JSON.stringify(left.formData) === JSON.stringify(right.formData));
+}
+/**
+ * Returns the field key a service-task `fieldPath` writes into when that field
+ * is DataSource-backed, else `null`. Only the first path segment can name a
+ * form field; deeper segments address inside its value.
+ */
+/**
+ * Reads defensively: a service task must keep running even when the instance
+ * carries a snapshot this version cannot parse, so an unreadable schema simply
+ * means "no snapshot to invalidate" rather than a failed workflow step.
+ */
+function readDataSourceFieldKeyAtPath(snapshot, fieldPath) {
+    const schema = snapshot?.schema;
+    // Deliberately looser than `isFormDefinitionSchema`: one malformed sibling
+    // entry must not stop a valid dynamic field from having its stale snapshot
+    // pruned. Each entry is record-guarded below instead.
+    if (!isRecord(schema) || !Array.isArray(schema.fields)) {
+        return null;
+    }
+    // Reuse the writer's normalization so an optional `form.`/`formData.` prefix
+    // resolves to the same field the value is written into.
+    const [fieldKey] = normalizeFormFieldPath(fieldPath);
+    if (!fieldKey) {
+        return null;
+    }
+    // A corrupt snapshot can hold non-object entries: read them defensively
+    // rather than letting a service task throw.
+    const field = schema.fields.find((candidate) => isRecord(candidate) && candidate.fieldKey === fieldKey);
+    return field && (0, form_1.isFormDataSourceFieldDefinition)(field) ? field.fieldKey : null;
+}
+function readSnapshotWithoutField(snapshots, fieldKey) {
+    return Object.fromEntries(Object.entries(snapshots ?? {}).filter(([key]) => key !== fieldKey));
+}
+/**
+ * Keeps only the snapshots whose field still carries a value, so clearing a
+ * dynamic option also removes the label recorded for it.
+ */
+function readSnapshotForPresentValues(schema, formData, snapshots) {
+    return Object.fromEntries(Object.entries(snapshots ?? {}).filter(([fieldKey]) => schema.fields.some((field) => isRecord(field) &&
+        field.fieldKey === fieldKey &&
+        (0, form_1.isFormDataSourceFieldDefinition)(field) &&
+        hasPresentDynamicValue(field, formData[fieldKey]))));
+}
+/**
+ * Only a value the field's own selection mode can represent counts as cleared:
+ * an empty array clears a `multiple` field, but on a `single` field it is an
+ * illegal value that must still reach validation rather than silently drop the
+ * option snapshot.
+ */
+function hasPresentDynamicValue(field, value) {
+    if (typeof value === 'undefined' || value === null) {
+        return false;
+    }
+    // Only a shape the field's mode can actually hold counts as cleared: `''`
+    // clears a single field, `[]` clears a multiple one. The other combinations
+    // are illegal values that must still reach validation instead of silently
+    // dropping the option snapshot.
+    return (0, form_1.readFormFieldSelectionMode)(field) === 'multiple'
+        ? !Array.isArray(value) || value.length > 0
+        : value !== '';
+}
+/**
+ * Hosts without a DataSource registry keep working for static forms, but a
+ * dynamic value they cannot re-resolve must never reach the database: nothing
+ * downstream could tell whether the browser made the value up.
+ */
+function assertNoUnresolvableDynamicValues(schema, formData) {
+    // A malformed snapshot can hold non-object entries; skip them rather than
+    // throwing a TypeError out of a submit or resubmit.
+    const hasDynamicValue = schema.fields.some((field) => isRecord(field) &&
+        (0, form_1.isFormDataSourceFieldDefinition)(field) &&
+        hasPresentDynamicValue(field, formData[field.fieldKey]));
+    if (hasDynamicValue) {
+        throw new form_data_source_errors_1.BPMFormDataSourceException(form_data_source_errors_1.BPM_FORM_DATA_SOURCE_ERROR_CODES.DATA_SOURCE_MISSING);
+    }
+}
+function readApprovalInstanceRevision(instance) {
+    return instance.updatedAt instanceof Date
+        ? instance.updatedAt.toISOString()
+        : String(instance.updatedAt ?? '');
+}
 function parseWorkflowDefinition(value) {
     try {
         const parsedValue = JSON.parse(value);
@@ -2916,6 +3136,11 @@ function readDefaultReturnTargetNodeId(workflow, currentNode) {
     }
     return previousNodeId;
 }
+function isReturnCommentRequired(workflow, nodeId) {
+    const node = readWorkflowNodeOrThrow(workflow, nodeId);
+    return (node.type === 'userTask' &&
+        node.data.returnBehavior.requireComment === true);
+}
 function readReturnResubmitStrategy(task, instance) {
     const node = readWorkflowNodeOrThrow(instance.workflowSnapshot, task.nodeId);
     if (node.type !== 'userTask') {
@@ -3411,7 +3636,12 @@ function readFormDefinitionSnapshotSchema(snapshot) {
     throw new common_1.BadRequestException('Approval instance form schema is invalid');
 }
 function isFormDefinitionSchema(value) {
-    return (isRecord(value) && value.schemaVersion === 1 && Array.isArray(value.fields));
+    return (isRecord(value) &&
+        value.schemaVersion === 1 &&
+        Array.isArray(value.fields) &&
+        // Every reader below dereferences `field.fieldKey`; requiring records here
+        // turns a corrupt snapshot into a controlled 400 instead of a TypeError.
+        value.fields.every((field) => isRecord(field)));
 }
 function isSubmittedFormFieldVisible(field, fields, values) {
     return field.visibleWhen