@things-factory/worklist 10.1.248 → 10.1.249

package/dist-server/controllers/activity-instance/claim-draft.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claimDraft = claimDraft;
+const activity_instance_js_1 = require("../../service/activity-instance/activity-instance.js");
+/**
+ * Take hold of a draft before working on it - so that a discard and an issue of the same draft cannot
+ * both succeed.
+ *
+ * Measured on postgres (tests/discard-versus-issue.pg.test.ts): issue read the draft, a discard deleted
+ * it, and issue then saved what it had read - the row came back, issued, and the writer had been told it
+ * was thrown away. Reading and saving later holds nothing.
+ *
+ * The claim is an UPDATE that only matches a draft. It takes the row's lock on every driver (SELECT ...
+ * FOR UPDATE is not supported on sqlite), and the lock is held until this transaction ends:
+ *
+ *   this claims first   a discard waits, then finds no draft and is refused by name
+ *   a discard is first  this waits, then matches no row and is refused by name
+ *
+ * No row matched means the draft went out or was thrown away in the meantime.
+ */
+async function claimDraft(id, context) {
+    const { domain, user, tx } = context.state;
+    const claimed = await tx
+        .getRepository(activity_instance_js_1.ActivityInstance)
+        .update({ domain: { id: domain.id }, id, state: activity_instance_js_1.ActivityInstanceStatus.Draft }, { updater: user });
+    if (!claimed.affected) {
+        throw new Error(context.t('error.activity-instance draft is gone', { id }));
+    }
+}
+//# sourceMappingURL=claim-draft.js.map

package/dist-server/controllers/activity-instance/claim-draft.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-draft.js","sourceRoot":"","sources":["../../../server/controllers/activity-instance/claim-draft.ts"],"names":[],"mappings":";;AAkBA,gCAUC;AA5BD,+FAA+G;AAE/G;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,OAAwB;IACnE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAE1C,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,aAAa,CAAC,uCAAgB,CAAC;SAC/B,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,6CAAsB,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAEpG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uCAAuC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC","sourcesContent":["import { ActivityInstance, ActivityInstanceStatus } from '../../service/activity-instance/activity-instance.js'\n\n/**\n * Take hold of a draft before working on it - so that a discard and an issue of the same draft cannot\n * both succeed.\n *\n * Measured on postgres (tests/discard-versus-issue.pg.test.ts): issue read the draft, a discard deleted\n * it, and issue then saved what it had read - the row came back, issued, and the writer had been told it\n * was thrown away. Reading and saving later holds nothing.\n *\n * The claim is an UPDATE that only matches a draft. It takes the row's lock on every driver (SELECT ...\n * FOR UPDATE is not supported on sqlite), and the lock is held until this transaction ends:\n *\n *   this claims first   a discard waits, then finds no draft and is refused by name\n *   a discard is first  this waits, then matches no row and is refused by name\n *\n * No row matched means the draft went out or was thrown away in the meantime.\n */\nexport async function claimDraft(id: string, context: ResolverContext): Promise<void> {\n  const { domain, user, tx } = context.state\n\n  const claimed = await tx\n    .getRepository(ActivityInstance)\n    .update({ domain: { id: domain.id }, id, state: ActivityInstanceStatus.Draft }, { updater: user })\n\n  if (!claimed.affected) {\n    throw new Error(context.t('error.activity-instance draft is gone', { id }))\n  }\n}\n"]}

package/dist-server/controllers/activity-instance/discard-draft.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Throw away a draft - by whoever wrote it, or someone who manages instances (ruling 2026-09-24).
+ *
+ * The same entitlement as editing and issuing a draft (entitlement.ts). A draft is still the writer's
+ * own; once issued it is other people's work and cannot be thrown away here.
+ *
+ * ── Order, because a rollback cannot bring a file back ─────────────────────
+ *   1. rows that hang off the instance - approvals, then threads. A draft normally has none; they are
+ *      cleared so that no row is left without its parent. These roll back with the transaction.
+ *   2. the instance, with `state = 'draft'` in the delete itself. Reading the state and deleting after
+ *      would let an issue land in between and be deleted. No row deleted means it is not a draft any
+ *      more (or not here), and the refusal says so - the transaction rolls step 1 back.
+ *   3. attachments that name the instance, last: deleteAttachmentsByRef removes the files from storage
+ *      at once, and that cannot be rolled back.
+ *
+ * The files wait for the commit. Under @transaction, deleteAttachmentsByRef deletes the rows now and puts
+ * the file deletes on context.state.afterCommit, which shell runs once the transaction has returned
+ * (ADR-0091 decision 8). A later refusal - the bulk door refusing its third id - rolls every row back
+ * and no file has gone. A transaction opened by hand without runTransaction has no list, and there the
+ * files still go at once.
+ */
+export declare function discardDraft(id: string, context: ResolverContext): Promise<true>;

package/dist-server/controllers/activity-instance/discard-draft.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.discardDraft = discardDraft;
+const typeorm_1 = require("typeorm");
+const attachment_base_1 = require("@things-factory/attachment-base");
+const activity_approval_js_1 = require("../../service/activity-approval/activity-approval.js");
+const activity_instance_js_1 = require("../../service/activity-instance/activity-instance.js");
+const activity_thread_js_1 = require("../../service/activity-thread/activity-thread.js");
+const entitlement_js_1 = require("./entitlement.js");
+/**
+ * Throw away a draft - by whoever wrote it, or someone who manages instances (ruling 2026-09-24).
+ *
+ * The same entitlement as editing and issuing a draft (entitlement.ts). A draft is still the writer's
+ * own; once issued it is other people's work and cannot be thrown away here.
+ *
+ * ── Order, because a rollback cannot bring a file back ─────────────────────
+ *   1. rows that hang off the instance - approvals, then threads. A draft normally has none; they are
+ *      cleared so that no row is left without its parent. These roll back with the transaction.
+ *   2. the instance, with `state = 'draft'` in the delete itself. Reading the state and deleting after
+ *      would let an issue land in between and be deleted. No row deleted means it is not a draft any
+ *      more (or not here), and the refusal says so - the transaction rolls step 1 back.
+ *   3. attachments that name the instance, last: deleteAttachmentsByRef removes the files from storage
+ *      at once, and that cannot be rolled back.
+ *
+ * The files wait for the commit. Under @transaction, deleteAttachmentsByRef deletes the rows now and puts
+ * the file deletes on context.state.afterCommit, which shell runs once the transaction has returned
+ * (ADR-0091 decision 8). A later refusal - the bulk door refusing its third id - rolls every row back
+ * and no file has gone. A transaction opened by hand without runTransaction has no list, and there the
+ * files still go at once.
+ */
+async function discardDraft(id, context) {
+    const { domain, tx } = context.state;
+    const instances = tx.getRepository(activity_instance_js_1.ActivityInstance);
+    const instance = await instances.findOne({ where: { domain: { id: domain.id }, id } });
+    if (!instance) {
+        throw new Error(context.t('error.activity-instance not found', { activityInstance: id }));
+    }
+    await (0, entitlement_js_1.assertMayWorkOnDraft)(instance, context);
+    const threads = await tx.getRepository(activity_thread_js_1.ActivityThread).find({
+        where: { domain: { id: domain.id }, activityInstance: { id } }
+    });
+    if (threads.length) {
+        const threadIds = threads.map(one => one.id);
+        await tx.getRepository(activity_approval_js_1.ActivityApproval).delete({ domain: { id: domain.id }, activityThread: { id: (0, typeorm_1.In)(threadIds) } });
+        await tx.getRepository(activity_thread_js_1.ActivityThread).delete({ domain: { id: domain.id }, id: (0, typeorm_1.In)(threadIds) });
+    }
+    const removed = await instances.delete({ domain: { id: domain.id }, id, state: activity_instance_js_1.ActivityInstanceStatus.Draft });
+    if (!removed.affected) {
+        throw new Error(context.t('error.activity-instance not a draft any more', { id }));
+    }
+    await (0, attachment_base_1.deleteAttachmentsByRef)(null, { refBys: [id] }, context);
+    return true;
+}
+//# sourceMappingURL=discard-draft.js.map

package/dist-server/controllers/activity-instance/discard-draft.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discard-draft.js","sourceRoot":"","sources":["../../../server/controllers/activity-instance/discard-draft.ts"],"names":[],"mappings":";;AA8BA,oCAgCC;AA9DD,qCAA4B;AAE5B,qEAAwE;AAExE,+FAAuF;AACvF,+FAA+G;AAC/G,yFAAiF;AACjF,qDAAuD;AAEvD;;;;;;;;;;;;;;;;;;;;GAoBG;AACI,KAAK,UAAU,YAAY,CAAC,EAAU,EAAE,OAAwB;IACrE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IACpC,MAAM,SAAS,GAAG,EAAE,CAAC,aAAa,CAAC,uCAAgB,CAAC,CAAA;IAEpD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IAEtF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IAC3F,CAAC;IAED,MAAM,IAAA,qCAAoB,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAE7C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,mCAAc,CAAC,CAAC,IAAI,CAAC;QAC1D,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,EAAE;KAC/D,CAAC,CAAA;IAEF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAE5C,MAAM,EAAE,CAAC,aAAa,CAAC,uCAAgB,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAA;QACrH,MAAM,EAAE,CAAC,aAAa,CAAC,mCAAc,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IACjG,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,6CAAsB,CAAC,KAAK,EAAE,CAAC,CAAA;IAE9G,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8CAA8C,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,IAAA,wCAAsB,EAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAE7D,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["import { In } from 'typeorm'\n\nimport { deleteAttachmentsByRef } from '@things-factory/attachment-base'\n\nimport { ActivityApproval } from '../../service/activity-approval/activity-approval.js'\nimport { ActivityInstance, ActivityInstanceStatus } from '../../service/activity-instance/activity-instance.js'\nimport { ActivityThread } from '../../service/activity-thread/activity-thread.js'\nimport { assertMayWorkOnDraft } from './entitlement.js'\n\n/**\n * Throw away a draft - by whoever wrote it, or someone who manages instances (ruling 2026-09-24).\n *\n * The same entitlement as editing and issuing a draft (entitlement.ts). A draft is still the writer's\n * own; once issued it is other people's work and cannot be thrown away here.\n *\n * ── Order, because a rollback cannot bring a file back ─────────────────────\n *   1. rows that hang off the instance - approvals, then threads. A draft normally has none; they are\n *      cleared so that no row is left without its parent. These roll back with the transaction.\n *   2. the instance, with `state = 'draft'` in the delete itself. Reading the state and deleting after\n *      would let an issue land in between and be deleted. No row deleted means it is not a draft any\n *      more (or not here), and the refusal says so - the transaction rolls step 1 back.\n *   3. attachments that name the instance, last: deleteAttachmentsByRef removes the files from storage\n *      at once, and that cannot be rolled back.\n *\n * The files wait for the commit. Under @transaction, deleteAttachmentsByRef deletes the rows now and puts\n * the file deletes on context.state.afterCommit, which shell runs once the transaction has returned\n * (ADR-0091 decision 8). A later refusal - the bulk door refusing its third id - rolls every row back\n * and no file has gone. A transaction opened by hand without runTransaction has no list, and there the\n * files still go at once.\n */\nexport async function discardDraft(id: string, context: ResolverContext): Promise<true> {\n  const { domain, tx } = context.state\n  const instances = tx.getRepository(ActivityInstance)\n\n  const instance = await instances.findOne({ where: { domain: { id: domain.id }, id } })\n\n  if (!instance) {\n    throw new Error(context.t('error.activity-instance not found', { activityInstance: id }))\n  }\n\n  await assertMayWorkOnDraft(instance, context)\n\n  const threads = await tx.getRepository(ActivityThread).find({\n    where: { domain: { id: domain.id }, activityInstance: { id } }\n  })\n\n  if (threads.length) {\n    const threadIds = threads.map(one => one.id)\n\n    await tx.getRepository(ActivityApproval).delete({ domain: { id: domain.id }, activityThread: { id: In(threadIds) } })\n    await tx.getRepository(ActivityThread).delete({ domain: { id: domain.id }, id: In(threadIds) })\n  }\n\n  const removed = await instances.delete({ domain: { id: domain.id }, id, state: ActivityInstanceStatus.Draft })\n\n  if (!removed.affected) {\n    throw new Error(context.t('error.activity-instance not a draft any more', { id }))\n  }\n\n  await deleteAttachmentsByRef(null, { refBys: [id] }, context)\n\n  return true\n}\n"]}

package/dist-server/controllers/activity-instance/draft.d.ts

@@ -0,0 +1,3 @@
+import { ActivityInstance } from '../../service/activity-instance/activity-instance.js';
+import { ActivityInstanceDraft } from '../../service/activity-instance/activity-instance-type.js';
+export declare function draft(activityInstance: ActivityInstanceDraft, context: ResolverContext): Promise<ActivityInstance>;

package/dist-server/controllers/activity-instance/draft.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.draft = draft;
+const activity_instance_js_1 = require("../../service/activity-instance/activity-instance.js");
+const activity_js_1 = require("../../service/activity/activity.js");
+const common_js_1 = require("../common.js");
+const entitlement_js_1 = require("./entitlement.js");
+const claim_draft_js_1 = require("./claim-draft.js");
+const assignee_pool_js_1 = require("../../service/activity-instance/assignee-pool.js");
+const approval_line_input_js_1 = require("./approval-line-input.js");
+async function draft(activityInstance, context) {
+    const { domain, user, tx } = context.state;
+    const { id, activityId, input, dueAt } = activityInstance;
+    var repository = tx.getRepository(activity_js_1.Activity);
+    var activity = {};
+    if (id) {
+        var previousActivityInstance = await tx.getRepository(activity_instance_js_1.ActivityInstance).findOne({
+            where: { domain: { id: domain.id }, id },
+            relations: ['activity']
+        });
+        if (!previousActivityInstance) {
+            throw new Error(context.t('error.activityInstance not found', {
+                activityInstance: id
+            }));
+        }
+        /* 남의 초안은 못 고친다. 새로 시작하는 것(id 없음)은 이 검사에 안 걸린다. */
+        await (0, entitlement_js_1.assertMayWorkOnDraft)(previousActivityInstance, context);
+        if (previousActivityInstance.state !== activity_instance_js_1.ActivityInstanceStatus.Draft) {
+            throw new Error(context.t('error.activityInstance state should be draft', {
+                activityInstance: id,
+                state: previousActivityInstance.state
+            }));
+        }
+        /* Held until this transaction ends, so a discard cannot remove it between the read and the save. */
+        await (0, claim_draft_js_1.claimDraft)(id, context);
+        activity = previousActivityInstance.activity;
+    }
+    else {
+        activityInstance.adhocType = 'standard';
+        activityInstance.refBy = activityId;
+    }
+    if (activityId) {
+        activity = await repository.findOne({
+            where: { domain: { id: domain.id }, id: activityId },
+            relations: ['assigneeRoles', 'supervisoryRole']
+        });
+        if (!activity) {
+            throw new Error(context.t('error.activity not found', {
+                activity: activityId
+            }));
+        }
+    }
+    /*
+     * The activity's approval line is set on its detail screen and nowhere else (ruling 2026-09-24).
+     * A line handed in must be absent or the same one - § approval-line-input.ts.
+     */
+    if ((0, approval_line_input_js_1.approvalLineInputRefusal)(activity.approvalLine, activityInstance.approvalLine)) {
+        throw Object.assign(new Error(context.t('error.activity-instance approval line is set')), { code: approval_line_input_js_1.LINE_IS_SET });
+    }
+    if (!activityInstance.assignees) {
+        activityInstance.assignees = activity.assignees;
+    }
+    /* A pool handed in is read in this domain, each role once - or refused by name (assignee-pool.ts). */
+    if (activityInstance.assigneeRoles) {
+        activityInstance.assigneeRoles = await (0, assignee_pool_js_1.resolvePoolRoles)(activityInstance.assigneeRoles, context);
+    }
+    if (!activityInstance.approvalLine) {
+        activityInstance.approvalLine = activity.approvalLine;
+    }
+    if (!dueAt && activity.standardTime) {
+        activityInstance.dueAt = new Date(Date.now() + activity.standardTime * 1000);
+    }
+    const activitySearchKeys = (0, common_js_1.fillActivitySearchKeys)(activity?.searchKeys, input);
+    return await tx.getRepository(activity_instance_js_1.ActivityInstance).save({
+        ...previousActivityInstance,
+        activityType: activity.activityType,
+        uiType: activity.uiType,
+        uiSource: activity.uiSource,
+        viewType: activity.viewType,
+        viewSource: activity.viewSource,
+        assigneeRoles: activity.assigneeRoles,
+        supervisoryRole: activity.supervisoryRole,
+        ...activityInstance,
+        transaction: 'draft',
+        activity,
+        ...activitySearchKeys,
+        state: activity_instance_js_1.ActivityInstanceStatus.Draft,
+        domain,
+        creator: user,
+        updater: user
+    });
+}
+//# sourceMappingURL=draft.js.map

package/dist-server/controllers/activity-instance/draft.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"draft.js","sourceRoot":"","sources":["../../../server/controllers/activity-instance/draft.ts"],"names":[],"mappings":";;AASA,sBAuGC;AAhHD,+FAA+G;AAE/G,oEAA6D;AAC7D,4CAAqD;AACrD,qDAAuD;AACvD,qDAA6C;AAC7C,uFAAmF;AACnF,qEAAgF;AAEzE,KAAK,UAAU,KAAK,CACzB,gBAAuC,EACvC,OAAwB;IAExB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC1C,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAA;IAEzD,IAAI,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,sBAAQ,CAAC,CAAA;IAC3C,IAAI,QAAQ,GAAG,EAAc,CAAA;IAE7B,IAAI,EAAE,EAAE,CAAC;QACP,IAAI,wBAAwB,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,uCAAgB,CAAC,CAAC,OAAO,CAAC;YAC9E,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;YACxC,SAAS,EAAE,CAAC,UAAU,CAAC;SACxB,CAAC,CAAA;QAEF,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,CAAC,CAAC,kCAAkC,EAAE;gBAC5C,gBAAgB,EAAE,EAAE;aACrB,CAAC,CACH,CAAA;QACH,CAAC;QAED,kDAAkD;QAClD,MAAM,IAAA,qCAAoB,EAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;QAE7D,IAAI,wBAAwB,CAAC,KAAK,KAAK,6CAAsB,CAAC,KAAK,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,CAAC,CAAC,8CAA8C,EAAE;gBACxD,gBAAgB,EAAE,EAAE;gBACpB,KAAK,EAAE,wBAAwB,CAAC,KAAK;aACtC,CAAC,CACH,CAAA;QACH,CAAC;QAED,oGAAoG;QACpG,MAAM,IAAA,2BAAU,EAAC,EAAE,EAAE,OAAO,CAAC,CAAA;QAE7B,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,CAAA;IAC9C,CAAC;SAAM,CAAC;QACN,gBAAgB,CAAC,SAAS,GAAG,UAAU,CAAA;QACvC,gBAAgB,CAAC,KAAK,GAAG,UAAU,CAAA;IACrC,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAClC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;YACpD,SAAS,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC;SAChD,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE;gBACpC,QAAQ,EAAE,UAAU;aACrB,CAAC,CACH,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,IAAI,IAAA,iDAAwB,EAAC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACnF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,oCAAW,EAAE,CAAC,CAAA;IAClH,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC;QAChC,gBAAgB,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;IACjD,CAAC;IACD,sGAAsG;IACtG,IAAI,gBAAgB,CAAC,aAAa,EAAE,CAAC;QACnC,gBAAgB,CAAC,aAAa,GAAG,MAAM,IAAA,mCAAgB,EAAC,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IAClG,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;QACnC,gBAAgB,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAA;IACvD,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACpC,gBAAgB,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAC9E,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAA,kCAAsB,EAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IAE9E,OAAO,MAAM,EAAE,CAAC,aAAa,CAAC,uCAAgB,CAAC,CAAC,IAAI,CAAC;QACnD,GAAG,wBAAwB;QAC3B,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,GAAG,gBAAgB;QACnB,WAAW,EAAE,OAAO;QACpB,QAAQ;QACR,GAAG,kBAAkB;QACrB,KAAK,EAAE,6CAAsB,CAAC,KAAK;QACnC,MAAM;QACN,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { ActivityInstance, ActivityInstanceStatus } from '../../service/activity-instance/activity-instance.js'\nimport { ActivityInstanceDraft } from '../../service/activity-instance/activity-instance-type.js'\nimport { Activity } from '../../service/activity/activity.js'\nimport { fillActivitySearchKeys } from '../common.js'\nimport { assertMayWorkOnDraft } from './entitlement.js'\nimport { claimDraft } from './claim-draft.js'\nimport { resolvePoolRoles } from '../../service/activity-instance/assignee-pool.js'\nimport { LINE_IS_SET, approvalLineInputRefusal } from './approval-line-input.js'\n\nexport async function draft(\n  activityInstance: ActivityInstanceDraft,\n  context: ResolverContext\n): Promise<ActivityInstance> {\n  const { domain, user, tx } = context.state\n  const { id, activityId, input, dueAt } = activityInstance\n\n  var repository = tx.getRepository(Activity)\n  var activity = {} as Activity\n\n  if (id) {\n    var previousActivityInstance = await tx.getRepository(ActivityInstance).findOne({\n      where: { domain: { id: domain.id }, id },\n      relations: ['activity']\n    })\n\n    if (!previousActivityInstance) {\n      throw new Error(\n        context.t('error.activityInstance not found', {\n          activityInstance: id\n        })\n      )\n    }\n\n    /* 남의 초안은 못 고친다. 새로 시작하는 것(id 없음)은 이 검사에 안 걸린다. */\n    await assertMayWorkOnDraft(previousActivityInstance, context)\n\n    if (previousActivityInstance.state !== ActivityInstanceStatus.Draft) {\n      throw new Error(\n        context.t('error.activityInstance state should be draft', {\n          activityInstance: id,\n          state: previousActivityInstance.state\n        })\n      )\n    }\n\n    /* Held until this transaction ends, so a discard cannot remove it between the read and the save. */\n    await claimDraft(id, context)\n\n    activity = previousActivityInstance.activity\n  } else {\n    activityInstance.adhocType = 'standard'\n    activityInstance.refBy = activityId\n  }\n\n  if (activityId) {\n    activity = await repository.findOne({\n      where: { domain: { id: domain.id }, id: activityId },\n      relations: ['assigneeRoles', 'supervisoryRole']\n    })\n\n    if (!activity) {\n      throw new Error(\n        context.t('error.activity not found', {\n          activity: activityId\n        })\n      )\n    }\n  }\n\n  /*\n   * The activity's approval line is set on its detail screen and nowhere else (ruling 2026-09-24).\n   * A line handed in must be absent or the same one - § approval-line-input.ts.\n   */\n  if (approvalLineInputRefusal(activity.approvalLine, activityInstance.approvalLine)) {\n    throw Object.assign(new Error(context.t('error.activity-instance approval line is set')), { code: LINE_IS_SET })\n  }\n\n  if (!activityInstance.assignees) {\n    activityInstance.assignees = activity.assignees\n  }\n  /* A pool handed in is read in this domain, each role once - or refused by name (assignee-pool.ts). */\n  if (activityInstance.assigneeRoles) {\n    activityInstance.assigneeRoles = await resolvePoolRoles(activityInstance.assigneeRoles, context)\n  }\n  if (!activityInstance.approvalLine) {\n    activityInstance.approvalLine = activity.approvalLine\n  }\n\n  if (!dueAt && activity.standardTime) {\n    activityInstance.dueAt = new Date(Date.now() + activity.standardTime * 1000)\n  }\n\n  const activitySearchKeys = fillActivitySearchKeys(activity?.searchKeys, input)\n\n  return await tx.getRepository(ActivityInstance).save({\n    ...previousActivityInstance,\n    activityType: activity.activityType,\n    uiType: activity.uiType,\n    uiSource: activity.uiSource,\n    viewType: activity.viewType,\n    viewSource: activity.viewSource,\n    assigneeRoles: activity.assigneeRoles,\n    supervisoryRole: activity.supervisoryRole,\n    ...activityInstance,\n    transaction: 'draft',\n    activity,\n    ...activitySearchKeys,\n    state: ActivityInstanceStatus.Draft,\n    domain,\n    creator: user,\n    updater: user\n  })\n}\n"]}

package/dist-server/controllers/activity-instance/end.d.ts

@@ -0,0 +1,6 @@
+import { ActivityInstance } from '../../service/activity-instance/activity-instance.js';
+export declare function end({ id, output, reason }: {
+    id: string;
+    output?: object;
+    reason?: string;
+}, context: ResolverContext): Promise<ActivityInstance>;

package/dist-server/controllers/activity-instance/end.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.end = end;
+const activity_instance_js_1 = require("../../service/activity-instance/activity-instance.js");
+const activity_thread_js_1 = require("../../service/activity-thread/activity-thread.js");
+const common_js_1 = require("../common.js");
+async function end({ id, output, reason }, context) {
+    const { domain, user, tx } = context.state;
+    const repository = tx.getRepository(activity_instance_js_1.ActivityInstance);
+    var activityInstance = await repository.findOne({
+        where: { domain: { id: domain.id }, id },
+        relations: [
+            'domain',
+            'activity',
+            'activityThreads',
+            'assigneeRoles',
+            'supervisoryRole',
+            'updater',
+            'creator',
+            'starter',
+            'terminator'
+        ]
+    });
+    if (!activityInstance) {
+        throw new Error(context.t('error.activity-instance not found', {
+            activityInstance: id
+        }));
+    }
+    /*
+      Prerequisites for a Task to Be End.
+      - The previous state of the task must not be End or Aborted.
+      - There should be no unfinished activity threads.
+    */
+    if (activityInstance.state == activity_instance_js_1.ActivityInstanceStatus.Aborted ||
+        activityInstance.state == activity_instance_js_1.ActivityInstanceStatus.Ended) {
+        throw new Error(context.t(`error.activity-instance is already terminated`, {
+            id,
+            state: activityInstance.state
+        }));
+    }
+    const TERMINATED = [activity_thread_js_1.ActivityThreadStatus.Aborted, activity_thread_js_1.ActivityThreadStatus.Ended];
+    for (let activityThread of activityInstance.activityThreads) {
+        if (TERMINATED.includes(activityThread.state)) {
+            continue;
+        }
+        throw new Error(context.t(`error.all activity threads should be terminated`, {
+            activityThread: activityThread.id,
+            state: activityInstance.state
+        }));
+    }
+    if (!activityInstance.startedAt) {
+        activityInstance.startedAt = new Date();
+    }
+    return await repository.save({
+        ...activityInstance,
+        reason,
+        output,
+        transaction: 'end',
+        state: await (0, common_js_1.evalActivityInstanceState)(id, context),
+        updater: user,
+        terminatedAt: new Date(),
+        terminator: user
+    });
+}
+//# sourceMappingURL=end.js.map

package/dist-server/controllers/activity-instance/end.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"end.js","sourceRoot":"","sources":["../../../server/controllers/activity-instance/end.ts"],"names":[],"mappings":";;AAIA,kBA4EC;AAhFD,+FAA+G;AAC/G,yFAAuF;AACvF,4CAAwD;AAEjD,KAAK,UAAU,GAAG,CACvB,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAoD,EACxE,OAAwB;IAExB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC1C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,uCAAgB,CAAC,CAAA;IAErD,IAAI,gBAAgB,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;QAC9C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;QACxC,SAAS,EAAE;YACT,QAAQ;YACR,UAAU;YACV,iBAAiB;YACjB,eAAe;YACf,iBAAiB;YACjB,SAAS;YACT,SAAS;YACT,SAAS;YACT,YAAY;SACb;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,CAAC,CAAC,mCAAmC,EAAE;YAC7C,gBAAgB,EAAE,EAAE;SACrB,CAAC,CACH,CAAA;IACH,CAAC;IAED;;;;MAIE;IACF,IACE,gBAAgB,CAAC,KAAK,IAAI,6CAAsB,CAAC,OAAO;QACxD,gBAAgB,CAAC,KAAK,IAAI,6CAAsB,CAAC,KAAK,EACtD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,CAAC,CAAC,+CAA+C,EAAE;YACzD,EAAE;YACF,KAAK,EAAE,gBAAgB,CAAC,KAAK;SAC9B,CAAC,CACH,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,yCAAoB,CAAC,OAAO,EAAE,yCAAoB,CAAC,KAAK,CAAC,CAAA;IAE7E,KAAK,IAAI,cAAc,IAAI,gBAAgB,CAAC,eAAe,EAAE,CAAC;QAC5D,IAAI,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,SAAQ;QACV,CAAC;QAED,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,CAAC,CAAC,iDAAiD,EAAE;YAC3D,cAAc,EAAE,cAAc,CAAC,EAAE;YACjC,KAAK,EAAE,gBAAgB,CAAC,KAAK;SAC9B,CAAC,CACH,CAAA;IACH,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC;QAChC,gBAAgB,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;IACzC,CAAC;IAED,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC;QAC3B,GAAG,gBAAgB;QACnB,MAAM;QACN,MAAM;QACN,WAAW,EAAE,KAAK;QAClB,KAAK,EAAE,MAAM,IAAA,qCAAyB,EAAC,EAAE,EAAE,OAAO,CAAC;QACnD,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,IAAI,IAAI,EAAE;QACxB,UAAU,EAAE,IAAI;KACV,CAAC,CAAA;AACX,CAAC","sourcesContent":["import { ActivityInstance, ActivityInstanceStatus } from '../../service/activity-instance/activity-instance.js'\nimport { ActivityThreadStatus } from '../../service/activity-thread/activity-thread.js'\nimport { evalActivityInstanceState } from '../common.js'\n\nexport async function end(\n  { id, output, reason }: { id: string; output?: object; reason?: string },\n  context: ResolverContext\n): Promise<ActivityInstance> {\n  const { domain, user, tx } = context.state\n  const repository = tx.getRepository(ActivityInstance)\n\n  var activityInstance = await repository.findOne({\n    where: { domain: { id: domain.id }, id },\n    relations: [\n      'domain',\n      'activity',\n      'activityThreads',\n      'assigneeRoles',\n      'supervisoryRole',\n      'updater',\n      'creator',\n      'starter',\n      'terminator'\n    ]\n  })\n\n  if (!activityInstance) {\n    throw new Error(\n      context.t('error.activity-instance not found', {\n        activityInstance: id\n      })\n    )\n  }\n\n  /* \n    Prerequisites for a Task to Be End.\n    - The previous state of the task must not be End or Aborted.\n    - There should be no unfinished activity threads.\n  */\n  if (\n    activityInstance.state == ActivityInstanceStatus.Aborted ||\n    activityInstance.state == ActivityInstanceStatus.Ended\n  ) {\n    throw new Error(\n      context.t(`error.activity-instance is already terminated`, {\n        id,\n        state: activityInstance.state\n      })\n    )\n  }\n\n  const TERMINATED = [ActivityThreadStatus.Aborted, ActivityThreadStatus.Ended]\n\n  for (let activityThread of activityInstance.activityThreads) {\n    if (TERMINATED.includes(activityThread.state)) {\n      continue\n    }\n\n    throw new Error(\n      context.t(`error.all activity threads should be terminated`, {\n        activityThread: activityThread.id,\n        state: activityInstance.state\n      })\n    )\n  }\n\n  if (!activityInstance.startedAt) {\n    activityInstance.startedAt = new Date()\n  }\n\n  return await repository.save({\n    ...activityInstance,\n    reason,\n    output,\n    transaction: 'end',\n    state: await evalActivityInstanceState(id, context),\n    updater: user,\n    terminatedAt: new Date(),\n    terminator: user\n  } as any)\n}\n"]}

package/dist-server/controllers/activity-instance/entitlement.d.ts

@@ -0,0 +1,25 @@
+import { ActivityInstance } from '../../service/activity-instance/activity-instance.js';
+/**
+ * May this person edit or issue this draft?
+ *
+ * The person who wrote it, or someone who manages activity instances. A draft is a private
+ * thing until it is issued — it carries an approval line and assignees that become other
+ * people's obligations the moment it goes out.
+ */
+export declare function assertMayWorkOnDraft(activityInstance: ActivityInstance, context: ResolverContext): Promise<void>;
+/**
+ * May this person pick up this task?
+ *
+ * ── When a role is named, it is the answer ───────────────────────────────────
+ * `assigneeRoles` is how an issuer says "this is for the quality inspectors". Reading it is
+ * the whole point of writing it, and until now it was loaded and ignored.
+ *
+ * ── When no role is named, anyone in the domain may take it ──────────────────
+ * That is the current behaviour and it is deliberate rather than a fallback: an issuer who
+ * names nobody is saying "whoever is free". Refusing instead would make every unaddressed
+ * task unpickable, which is the opposite of what leaving the field blank means.
+ *
+ * `reference_absent_value_leans_which_way` asks which way an absent value should lean, and
+ * here the lean is the issuer's stated intent — not a guess the code makes to be safe.
+ */
+export declare function assertMayPick(activityInstance: ActivityInstance, context: ResolverContext): Promise<void>;

package/dist-server/controllers/activity-instance/entitlement.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertMayWorkOnDraft = assertMayWorkOnDraft;
+exports.assertMayPick = assertMayPick;
+const auth_base_1 = require("@things-factory/auth-base");
+const assignee_pool_js_1 = require("../../service/activity-instance/assignee-pool.js");
+/**
+ * Who may act on **this one** activity instance.
+ *
+ * ── Why three mutations carry no `@privilege` ────────────────────────────────
+ * `draftActivityInstance`, `issueActivityInstance` and `pickActivityInstance` were given
+ * `@privilege(category: "activity-instance", privilege: "mutation", domainOwnerGranted: true)`
+ * commented out, in the same commit that put it live on the other six
+ * (`74acc61f6d`, 2025-04-10). That was a choice, not an omission, and the choice was right:
+ *
+ *   gated      acting on someone else's work, or destructive
+ *              assign · end · abort · delete draft
+ *   not gated  doing your own work
+ *              draft · issue · pick
+ *
+ * That privilege is the **management** one. Requiring it to pick up a task addressed to you
+ * would mean handing every operator on the floor the right to reassign and abort everyone
+ * else's work. So the category gate stays off here.
+ *
+ * The reason was never written down anywhere, which is why the next person to read the file
+ * saw three commented-out lines and could not tell "deliberate" from "forgotten". It is
+ * written here now.
+ *
+ * ── What was actually missing ────────────────────────────────────────────────
+ * "Your own work" was the intent and **nothing enforced it.** Each of the three takes an
+ * id and loads the record without asking whether this person has anything to do with it:
+ *
+ *   draft(id)  edits a draft — never checked who wrote it
+ *   issue(id)  issues a draft, routing approvals — never checked who wrote it
+ *   pick(id)   takes an unassigned task — loaded the assignee role and never read it
+ *
+ * The category gate cannot fix that. Turning it on locks out the operator whose task it is;
+ * leaving it off lets anyone in the domain take, edit or issue anyone else's. Those are two
+ * different questions and only the second one is open:
+ *
+ *   category privilege  may this person manage activity instances at all
+ *   entitlement         may this person act on **this** record
+ *
+ * The approval side already has the second one — `reject.ts` refuses a reject from someone
+ * who is only a reference on the order. The assignment side had no equivalent.
+ *
+ * Starting something new is untouched: with no id there is no owner to check, and anyone in
+ * the domain may begin a task.
+ */
+/** Whoever holds the management privilege is entitled to every record, as before. */
+async function manages(context) {
+    const { domain, user, unsafeIP, prohibitedPrivileges } = context.state;
+    return await (0, auth_base_1.checkPermission)({ category: 'activity-instance', privilege: 'mutation', owner: true }, user, domain, unsafeIP, prohibitedPrivileges);
+}
+/**
+ * May this person edit or issue this draft?
+ *
+ * The person who wrote it, or someone who manages activity instances. A draft is a private
+ * thing until it is issued — it carries an approval line and assignees that become other
+ * people's obligations the moment it goes out.
+ */
+async function assertMayWorkOnDraft(activityInstance, context) {
+    const { user } = context.state;
+    if (activityInstance.creatorId === user.id) {
+        return;
+    }
+    if (await manages(context)) {
+        return;
+    }
+    throw new Error(context.t('error.activity-instance belongs to someone else', {
+        id: activityInstance.id
+    }));
+}
+/**
+ * May this person pick up this task?
+ *
+ * ── When a role is named, it is the answer ───────────────────────────────────
+ * `assigneeRoles` is how an issuer says "this is for the quality inspectors". Reading it is
+ * the whole point of writing it, and until now it was loaded and ignored.
+ *
+ * ── When no role is named, anyone in the domain may take it ──────────────────
+ * That is the current behaviour and it is deliberate rather than a fallback: an issuer who
+ * names nobody is saying "whoever is free". Refusing instead would make every unaddressed
+ * task unpickable, which is the opposite of what leaving the field blank means.
+ *
+ * `reference_absent_value_leans_which_way` asks which way an absent value should lean, and
+ * here the lean is the issuer's stated intent — not a guess the code makes to be safe.
+ */
+async function assertMayPick(activityInstance, context) {
+    const { user, tx } = context.state;
+    const poolIds = (0, assignee_pool_js_1.poolIdsOf)(activityInstance);
+    if (!poolIds.length) {
+        return;
+    }
+    const holder = await tx.getRepository(auth_base_1.User).findOne({
+        where: { id: user.id },
+        relations: ['roles']
+    });
+    /* Any one of the pool's roles is enough (ADR-0091 decision 9). */
+    if ((0, assignee_pool_js_1.holdsAnyOf)((holder?.roles || []).map((role) => role.id), poolIds)) {
+        return;
+    }
+    if (await manages(context)) {
+        return;
+    }
+    throw new Error(context.t('error.activity-instance is addressed to another role', {
+        id: activityInstance.id
+    }));
+}
+//# sourceMappingURL=entitlement.js.map

package/dist-server/controllers/activity-instance/entitlement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement.js","sourceRoot":"","sources":["../../../server/controllers/activity-instance/entitlement.ts"],"names":[],"mappings":";;AAqEA,oDAgBC;AAiBD,sCA2BC;AAjID,yDAAuE;AAGvE,uFAAwF;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,qFAAqF;AACrF,KAAK,UAAU,OAAO,CAAC,OAAwB;IAC7C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEtE,OAAO,MAAM,IAAA,2BAAe,EAC1B,EAAE,QAAQ,EAAE,mBAAmB,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EACrE,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,oBAAoB,CACrB,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,oBAAoB,CAAC,gBAAkC,EAAE,OAAwB;IACrG,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAE9B,IAAI,gBAAgB,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;QAC3C,OAAM;IACR,CAAC;IAED,IAAI,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAM;IACR,CAAC;IAED,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,CAAC,CAAC,iDAAiD,EAAE;QAC3D,EAAE,EAAE,gBAAgB,CAAC,EAAE;KACxB,CAAC,CACH,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,aAAa,CAAC,gBAAkC,EAAE,OAAwB;IAC9F,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAClC,MAAM,OAAO,GAAG,IAAA,4BAAS,EAAC,gBAAgB,CAAC,CAAA;IAE3C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,gBAAI,CAAC,CAAC,OAAO,CAAC;QAClD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;QACtB,SAAS,EAAE,CAAC,OAAO,CAAC;KACrB,CAAC,CAAA;IAEF,kEAAkE;IAClE,IAAI,IAAA,6BAAU,EAAC,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5E,OAAM;IACR,CAAC;IAED,IAAI,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAM;IACR,CAAC;IAED,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,CAAC,CAAC,sDAAsD,EAAE;QAChE,EAAE,EAAE,gBAAgB,CAAC,EAAE;KACxB,CAAC,CACH,CAAA;AACH,CAAC","sourcesContent":["import { checkPermission, Role, User } from '@things-factory/auth-base'\n\nimport { ActivityInstance } from '../../service/activity-instance/activity-instance.js'\nimport { holdsAnyOf, poolIdsOf } from '../../service/activity-instance/assignee-pool.js'\n\n/**\n * Who may act on **this one** activity instance.\n *\n * ── Why three mutations carry no `@privilege` ────────────────────────────────\n * `draftActivityInstance`, `issueActivityInstance` and `pickActivityInstance` were given\n * `@privilege(category: \"activity-instance\", privilege: \"mutation\", domainOwnerGranted: true)`\n * commented out, in the same commit that put it live on the other six\n * (`74acc61f6d`, 2025-04-10). That was a choice, not an omission, and the choice was right:\n *\n *   gated      acting on someone else's work, or destructive\n *              assign · end · abort · delete draft\n *   not gated  doing your own work\n *              draft · issue · pick\n *\n * That privilege is the **management** one. Requiring it to pick up a task addressed to you\n * would mean handing every operator on the floor the right to reassign and abort everyone\n * else's work. So the category gate stays off here.\n *\n * The reason was never written down anywhere, which is why the next person to read the file\n * saw three commented-out lines and could not tell \"deliberate\" from \"forgotten\". It is\n * written here now.\n *\n * ── What was actually missing ────────────────────────────────────────────────\n * \"Your own work\" was the intent and **nothing enforced it.** Each of the three takes an\n * id and loads the record without asking whether this person has anything to do with it:\n *\n *   draft(id)  edits a draft — never checked who wrote it\n *   issue(id)  issues a draft, routing approvals — never checked who wrote it\n *   pick(id)   takes an unassigned task — loaded the assignee role and never read it\n *\n * The category gate cannot fix that. Turning it on locks out the operator whose task it is;\n * leaving it off lets anyone in the domain take, edit or issue anyone else's. Those are two\n * different questions and only the second one is open:\n *\n *   category privilege  may this person manage activity instances at all\n *   entitlement         may this person act on **this** record\n *\n * The approval side already has the second one — `reject.ts` refuses a reject from someone\n * who is only a reference on the order. The assignment side had no equivalent.\n *\n * Starting something new is untouched: with no id there is no owner to check, and anyone in\n * the domain may begin a task.\n */\n\n/** Whoever holds the management privilege is entitled to every record, as before. */\nasync function manages(context: ResolverContext): Promise<boolean> {\n  const { domain, user, unsafeIP, prohibitedPrivileges } = context.state\n\n  return await checkPermission(\n    { category: 'activity-instance', privilege: 'mutation', owner: true },\n    user,\n    domain,\n    unsafeIP,\n    prohibitedPrivileges\n  )\n}\n\n/**\n * May this person edit or issue this draft?\n *\n * The person who wrote it, or someone who manages activity instances. A draft is a private\n * thing until it is issued — it carries an approval line and assignees that become other\n * people's obligations the moment it goes out.\n */\nexport async function assertMayWorkOnDraft(activityInstance: ActivityInstance, context: ResolverContext) {\n  const { user } = context.state\n\n  if (activityInstance.creatorId === user.id) {\n    return\n  }\n\n  if (await manages(context)) {\n    return\n  }\n\n  throw new Error(\n    context.t('error.activity-instance belongs to someone else', {\n      id: activityInstance.id\n    })\n  )\n}\n\n/**\n * May this person pick up this task?\n *\n * ── When a role is named, it is the answer ───────────────────────────────────\n * `assigneeRoles` is how an issuer says \"this is for the quality inspectors\". Reading it is\n * the whole point of writing it, and until now it was loaded and ignored.\n *\n * ── When no role is named, anyone in the domain may take it ──────────────────\n * That is the current behaviour and it is deliberate rather than a fallback: an issuer who\n * names nobody is saying \"whoever is free\". Refusing instead would make every unaddressed\n * task unpickable, which is the opposite of what leaving the field blank means.\n *\n * `reference_absent_value_leans_which_way` asks which way an absent value should lean, and\n * here the lean is the issuer's stated intent — not a guess the code makes to be safe.\n */\nexport async function assertMayPick(activityInstance: ActivityInstance, context: ResolverContext) {\n  const { user, tx } = context.state\n  const poolIds = poolIdsOf(activityInstance)\n\n  if (!poolIds.length) {\n    return\n  }\n\n  const holder = await tx.getRepository(User).findOne({\n    where: { id: user.id },\n    relations: ['roles']\n  })\n\n  /* Any one of the pool's roles is enough (ADR-0091 decision 9). */\n  if (holdsAnyOf((holder?.roles || []).map((role: Role) => role.id), poolIds)) {\n    return\n  }\n\n  if (await manages(context)) {\n    return\n  }\n\n  throw new Error(\n    context.t('error.activity-instance is addressed to another role', {\n      id: activityInstance.id\n    })\n  )\n}\n"]}

package/dist-server/controllers/activity-instance/index.d.ts

@@ -0,0 +1,6 @@
+export * from './draft.js';
+export * from './issue.js';
+export * from './pick.js';
+export * from './assign.js';
+export * from './abort.js';
+export * from './end.js';

package/dist-server/controllers/activity-instance/index.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./draft.js"), exports);
+tslib_1.__exportStar(require("./issue.js"), exports);
+tslib_1.__exportStar(require("./pick.js"), exports);
+tslib_1.__exportStar(require("./assign.js"), exports);
+tslib_1.__exportStar(require("./abort.js"), exports);
+tslib_1.__exportStar(require("./end.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist-server/controllers/activity-instance/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/controllers/activity-instance/index.ts"],"names":[],"mappings":";;;AAAA,qDAA0B;AAC1B,qDAA0B;AAC1B,oDAAyB;AACzB,sDAA2B;AAC3B,qDAA0B;AAC1B,mDAAwB","sourcesContent":["export * from './draft.js'\nexport * from './issue.js'\nexport * from './pick.js'\nexport * from './assign.js'\nexport * from './abort.js'\nexport * from './end.js'\n"]}

package/dist-server/controllers/activity-instance/issue.d.ts

@@ -0,0 +1,3 @@
+import { ActivityInstance } from '../../service/activity-instance/activity-instance.js';
+import { ActivityInstanceIssue } from '../../service/activity-instance/activity-instance-type.js';
+export declare function issue(activityInstance: ActivityInstanceIssue, context: ResolverContext): Promise<ActivityInstance>;