@things-factory/worklist 10.1.36 → 10.1.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/worklist",
-  "version": "10.1.36",
+  "version": "10.1.38",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -37,14 +37,14 @@
     "@operato/moment-timezone-es": "^10.0.0",
     "@operato/p13n": "^10.0.0",
     "@operato/popup": "^10.15.0",
-    "@things-factory/attachment-base": "^10.1.34",
-    "@things-factory/auth-base": "^10.1.34",
-    "@things-factory/board-service": "^10.1.36",
-    "@things-factory/context-ui": "^10.1.34",
-    "@things-factory/organization": "^10.1.34",
-    "@things-factory/personalization": "^10.1.34",
-    "@things-factory/scheduler-client": "^10.1.34",
-    "@things-factory/shell": "^10.1.34"
+    "@things-factory/attachment-base": "^10.1.38",
+    "@things-factory/auth-base": "^10.1.38",
+    "@things-factory/board-service": "^10.1.38",
+    "@things-factory/context-ui": "^10.1.38",
+    "@things-factory/organization": "^10.1.38",
+    "@things-factory/personalization": "^10.1.38",
+    "@things-factory/scheduler-client": "^10.1.38",
+    "@things-factory/shell": "^10.1.38"
   },
-  "gitHead": "3942ac0aa4f004b4700e739889e12ffc35d78794"
+  "gitHead": "b947349fe1c27d11038b592ceadaba336f14785b"
 }

package/tests/delegate-approval.test.ts

@@ -0,0 +1,112 @@
+import { join } from 'path'
+
+/**
+ * Handing an approval seat on, through the real controller on sqlite.
+ *
+ * What the controller has to carry that the pure decision (test/delegation.test.ts) cannot: the seat
+ * keeps what it is on the new row, and the three refusals are asked of the people actually loaded -
+ * the receiver's domains, and the issuer read through the thread.
+ */
+
+const { createSqliteTestDataSource } = require(join(__dirname, '..', '..', 'ops-master', 'test', 'support', 'database.cjs'))
+const DIST = join(__dirname, '..', 'dist-server')
+const { ActivityInstance } = require(join(DIST, 'service', 'activity-instance', 'activity-instance.js'))
+const { ActivityThread } = require(join(DIST, 'service', 'activity-thread', 'activity-thread.js'))
+const { ActivityApproval } = require(join(DIST, 'service', 'activity-approval', 'activity-approval.js'))
+const { delegate } = require(join(DIST, 'controllers', 'activity-approval', 'delegate.js'))
+const { Domain } = require('@things-factory/shell')
+const { User } = require('@things-factory/auth-base')
+
+let db: any
+let here: any
+let elsewhere: any
+let holder: any
+let colleague: any
+let issuer: any
+let stranger: any
+
+beforeAll(async () => {
+  db = createSqliteTestDataSource([ActivityInstance, ActivityThread, ActivityApproval])
+  await db.initialize()
+
+  here = await db.getRepository(Domain).save({ name: 'here', subdomain: 'here' })
+  elsewhere = await db.getRepository(Domain).save({ name: 'elsewhere', subdomain: 'elsewhere' })
+
+  const person = (name: string, domains: any[]) =>
+    db.getRepository(User).save({ name, email: `${name}@example.com`, password: 'x', status: 'activated', domains })
+
+  holder = await person('holder', [here])
+  colleague = await person('colleague', [here])
+  issuer = await person('issuer', [here])
+  stranger = await person('stranger', [elsewhere])
+})
+
+afterAll(async () => db?.destroy())
+
+async function aSeat(participation?: string) {
+  const instance = await db.getRepository(ActivityInstance).save({
+    domain: here,
+    name: 'i',
+    state: 'issued',
+    issuer,
+    approvalLine: [
+      { type: 'User', value: holder.id, ...(participation ? { participation } : {}) },
+      { type: 'User', value: colleague.id }
+    ]
+  })
+  const thread = await db.getRepository(ActivityThread).save({ domain: here, name: 't', round: 1, state: 'submitted', activityInstance: instance })
+
+  return db.getRepository(ActivityApproval).save({
+    domain: here,
+    activityThread: thread,
+    approver: holder,
+    order: 1,
+    round: 1,
+    /* ActivityApprovalJudgment.Pending is the empty string. */
+    judgment: '',
+    participation
+  })
+}
+
+const handOn = (seat: any, to: any) =>
+  db.transaction((tx: any) =>
+    delegate({ id: seat.id, to: { id: to.id }, comment: 'away' }, { state: { domain: here, user: holder, tx }, t: (key: string) => key } as any)
+  )
+
+const newRowFor = (seat: any, to: any) =>
+  db.getRepository(ActivityApproval).findOne({ where: { originalApproval: { id: seat.id }, approver: { id: to.id } } })
+
+it('a judging seat goes to a colleague, and the new row is still a judging seat', async () => {
+  const seat = await aSeat('approval')
+
+  await handOn(seat, colleague)
+
+  expect(await newRowFor(seat, colleague)).toMatchObject({ judgment: '', participation: 'approval' })
+})
+
+it('a reference seat stays a reference once handed on', async () => {
+  const seat = await aSeat('reference')
+
+  await handOn(seat, colleague)
+
+  expect(await newRowFor(seat, colleague)).toMatchObject({ judgment: '', participation: 'reference' })
+})
+
+it('someone of another tenant is refused, and the seat is still the holder\'s', async () => {
+  const seat = await aSeat('approval')
+
+  await expect(handOn(seat, stranger)).rejects.toThrow('error.activity-approval delegate outside domain')
+  expect(await db.getRepository(ActivityApproval).findOne({ where: { id: seat.id } })).toMatchObject({ judgment: '' })
+})
+
+it('a judging seat to whoever raised the case is refused', async () => {
+  const seat = await aSeat('approval')
+
+  await expect(handOn(seat, issuer)).rejects.toThrow('error.activity-approval delegate to issuer')
+})
+
+it('to its own holder is refused', async () => {
+  const seat = await aSeat('approval')
+
+  await expect(handOn(seat, holder)).rejects.toThrow('error.activity-approval delegate to self')
+})

package/tests/discard-draft.test.ts

@@ -0,0 +1,145 @@
+import { join } from 'path'
+
+/**
+ * Throwing a draft away (ruling 2026-09-24): whoever wrote it may, nobody else without the management
+ * privilege, never once it has gone out - and nothing is left hanging off it.
+ *
+ * Real entities on sqlite, each call inside a real transaction, so a refusal also shows the rollback:
+ * the rows cleared before the refusal are back afterwards.
+ */
+
+let mockManages = false
+
+jest.mock('@things-factory/auth-base', () => {
+  const actual = jest.requireActual('@things-factory/auth-base')
+
+  return { ...actual, checkPermission: async () => mockManages }
+})
+
+const { createSqliteTestDataSource } = require(join(__dirname, '..', '..', 'ops-master', 'test', 'support', 'database.cjs'))
+const DIST = join(__dirname, '..', 'dist-server')
+const { ActivityInstance } = require(join(DIST, 'service', 'activity-instance', 'activity-instance.js'))
+const { ActivityThread } = require(join(DIST, 'service', 'activity-thread', 'activity-thread.js'))
+const { ActivityApproval } = require(join(DIST, 'service', 'activity-approval', 'activity-approval.js'))
+const { discardDraft } = require(join(DIST, 'controllers', 'activity-instance', 'discard-draft.js'))
+const { Attachment } = require('@things-factory/attachment-base')
+const { Domain } = require('@things-factory/shell')
+const { User } = require('@things-factory/auth-base')
+
+let db: any
+let domain: any
+let writer: any
+let someoneElse: any
+
+beforeAll(async () => {
+  db = createSqliteTestDataSource([ActivityInstance, ActivityThread, ActivityApproval, Attachment])
+  await db.initialize()
+
+  domain = await db.getRepository(Domain).save({ name: 'd', subdomain: 'd' })
+  writer = await db.getRepository(User).save({ name: 'w', email: 'w@example.com', password: 'x', domains: [domain] })
+  someoneElse = await db.getRepository(User).save({ name: 'o', email: 'o@example.com', password: 'x', domains: [domain] })
+})
+
+afterAll(async () => db?.destroy())
+
+beforeEach(() => (mockManages = false))
+
+async function aCase(state: string) {
+  const instance = await db.getRepository(ActivityInstance).save({ domain, name: 'i', state, creator: writer })
+  /* A draft normally has none of these; they stand here so that "nothing left over" means something. */
+  const thread = await db.getRepository(ActivityThread).save({ domain, name: 't', round: 1, state: 'assigned', activityInstance: instance })
+  await db.getRepository(ActivityApproval).save({ domain, activityThread: thread, order: 1, round: 1, judgment: 'pending' })
+
+  return instance
+}
+
+const discardAs = (user: any, id: string) =>
+  db.transaction((tx: any) => discardDraft(id, { state: { domain, user, tx }, t: (key: string) => key } as any))
+
+const left = async (instanceId: string) => {
+  const threads = await db.getRepository(ActivityThread).find({ where: { activityInstance: { id: instanceId } } })
+  const approvals = threads.length
+    ? await db.getRepository(ActivityApproval).find({ where: { activityThread: { id: threads[0].id } } })
+    : []
+
+  return {
+    instance: !!(await db.getRepository(ActivityInstance).findOne({ where: { id: instanceId } })),
+    threads: threads.length,
+    approvals: approvals.length
+  }
+}
+
+it('whoever wrote the draft throws it away, and nothing is left hanging off it', async () => {
+  const draft = await aCase('draft')
+
+  await expect(discardAs(writer, draft.id)).resolves.toBe(true)
+  expect(await left(draft.id)).toEqual({ instance: false, threads: 0, approvals: 0 })
+})
+
+it("someone else's draft is refused, and every row is still there", async () => {
+  const draft = await aCase('draft')
+
+  await expect(discardAs(someoneElse, draft.id)).rejects.toThrow('error.activity-instance belongs to someone else')
+  expect(await left(draft.id)).toEqual({ instance: true, threads: 1, approvals: 1 })
+})
+
+it('one that has gone out is refused by name, and the rows cleared before the refusal come back', async () => {
+  const issued = await aCase('issued')
+
+  await expect(discardAs(writer, issued.id)).rejects.toThrow('error.activity-instance not a draft any more')
+  expect(await left(issued.id)).toEqual({ instance: true, threads: 1, approvals: 1 })
+})
+
+it('someone who manages instances may throw away a draft they did not write', async () => {
+  const draft = await aCase('draft')
+  mockManages = true
+
+  await expect(discardAs(someoneElse, draft.id)).resolves.toBe(true)
+  expect(await left(draft.id)).toEqual({ instance: false, threads: 0, approvals: 0 })
+})
+
+it('an id that is not here is refused by name', async () => {
+  await expect(discardAs(writer, '00000000-0000-0000-0000-000000000000')).rejects.toThrow('error.activity-instance not found')
+})
+
+describe('attachment files and the commit', () => {
+  /*
+   * deleteAttachmentsByRef removes the files from storage while the transaction is still open. The
+   * @transaction directive commits after the resolver returns, so if the commit then fails the rows
+   * come back and the files do not. Pointed out 2026-09-24 (architect); there is no after-commit hook
+   * in @transaction and no rows-now-files-later shape in attachment-base, so the fix waits for a ruling.
+   *
+   * test.failing: this is red in intent - it passes while the hole is open, and turns red the day files
+   * wait for the commit, which is the signal to make it a plain test.
+   */
+  const attachmentConst = require(join(__dirname, '..', '..', 'attachment-base', 'dist-server', 'attachment-const.js'))
+  const deletedFiles: string[] = []
+
+  beforeAll(() => {
+    attachmentConst.STORAGE = { ...(attachmentConst.STORAGE || {}), deleteFile: async (path: string) => deletedFiles.push(path) }
+  })
+
+  it.failing('a transaction that rolls back after the discard leaves the file in storage', async () => {
+    const draft = await aCase('draft')
+    await db.getRepository(Attachment).save({
+      domain,
+      name: 'a.txt',
+      refBy: draft.id,
+      refType: 'ActivityInstance',
+      path: `files/${draft.id}.txt`,
+      mimetype: 'text/plain',
+      encoding: '7bit',
+      size: '1'
+    })
+
+    await expect(
+      db.transaction(async (tx: any) => {
+        await discardDraft(draft.id, { state: { domain, user: writer, tx }, t: (key: string) => key } as any)
+        throw new Error('the commit fails')
+      })
+    ).rejects.toThrow('the commit fails')
+
+    expect(await left(draft.id)).toEqual({ instance: true, threads: 1, approvals: 1 })
+    expect(deletedFiles).not.toContain(`files/${draft.id}.txt`)
+  })
+})

package/tests/may-read-case.test.ts

@@ -0,0 +1,166 @@
+import { join } from 'path'
+
+/**
+ * The two reads of one case by id actually ask who is reading.
+ *
+ * `test/participates.test.ts` holds the rule. This holds the wiring: the compiled resolvers are
+ * called with the repositories and the privilege check stubbed, so taking the check out of a
+ * resolver lets a stranger read somebody else's approval - and this turns red.
+ *
+ * Stubbed, not faked away: the rows come from the real resolvers' own queries, answered by entity.
+ */
+
+const mockRows = new Map<string, any>()
+let mockGrantsEveryCase = false
+
+jest.mock('@things-factory/shell', () => {
+  const actual = jest.requireActual('@things-factory/shell')
+
+  return {
+    ...actual,
+    getRepository: (entity: any) => ({
+      findOne: async ({ where }: any) => {
+        const row = mockRows.get(`${entity.name}:${where?.id}`)
+        return row && (!where?.domain || row.domainId === where.domain.id) ? row : null
+      },
+      find: async () => mockRows.get(`${entity.name}:*`) || [],
+      findBy: async () => mockRows.get(`${entity.name}:by`) || [],
+      findOneBy: async () => null
+    })
+  }
+})
+
+jest.mock('@things-factory/auth-base', () => {
+  const actual = jest.requireActual('@things-factory/auth-base')
+
+  return { ...actual, checkPermission: async () => mockGrantsEveryCase }
+})
+
+const DIST = join(__dirname, '..', 'dist-server', 'service')
+const { ActivityApprovalQuery } = require(join(DIST, 'activity-approval', 'activity-approval-query.js'))
+const { ActivityThreadQuery } = require(join(DIST, 'activity-thread', 'activity-thread-query.js'))
+const { ActivityInstanceQuery } = require(join(DIST, 'activity-instance', 'activity-instance-query.js'))
+
+function contextFor(userId: string, roleIds: string[] = [], roleDomainId = 'd-here') {
+  mockRows.set(`User:${userId}`, { id: userId, roles: roleIds.map(id => ({ id, domainId: roleDomainId })) })
+
+  return {
+    state: { domain: { id: 'd-here' }, user: { id: userId } },
+    t: (key: string) => key
+  } as any
+}
+
+beforeEach(() => {
+  mockRows.clear()
+  mockGrantsEveryCase = false
+
+  mockRows.set('ActivityInstance:i-1', { id: 'i-1', domainId: 'd-here', issuerId: 'u-issuer' })
+  mockRows.set('ActivityThread:t-1', { id: 't-1', domainId: 'd-here', activityInstanceId: 'i-1', assigneeId: 'u-worker' })
+  mockRows.set('ActivityApproval:a-1', { id: 'a-1', domainId: 'd-here', activityThreadId: 't-1', approverId: 'u-approver' })
+  mockRows.set('ActivityApproval:*', [{ approverId: 'u-approver' }])
+})
+
+describe('one approval by id', () => {
+  const read = (context: any) => new ActivityApprovalQuery().activityApproval('a-1', context)
+
+  it('a stranger in the same domain is refused by name, not handed a null', async () => {
+    await expect(read(contextFor('u-stranger'))).rejects.toThrow('error.activity-case not a participant')
+  })
+
+  it('its approver reads it', async () => {
+    await expect(read(contextFor('u-approver'))).resolves.toMatchObject({ id: 'a-1' })
+  })
+
+  it('whoever raised the case reads it', async () => {
+    await expect(read(contextFor('u-issuer'))).resolves.toMatchObject({ id: 'a-1' })
+  })
+
+  it('a holder of the activity-instance query privilege reads it', async () => {
+    mockGrantsEveryCase = true
+    await expect(read(contextFor('u-stranger'))).resolves.toMatchObject({ id: 'a-1' })
+  })
+
+  it('a case that does not exist is still null - absent is not refused', async () => {
+    await expect(new ActivityApprovalQuery().activityApproval('a-none', contextFor('u-stranger'))).resolves.toBeNull()
+  })
+})
+
+describe('one thread by id', () => {
+  const read = (context: any) => new ActivityThreadQuery().activityThread('t-1', context)
+
+  it('a stranger in the same domain is refused by name', async () => {
+    await expect(read(contextFor('u-stranger'))).rejects.toThrow('error.activity-case not a participant')
+  })
+
+  it('its assignee and its approver read it', async () => {
+    await expect(read(contextFor('u-worker'))).resolves.toMatchObject({ id: 't-1' })
+    await expect(read(contextFor('u-approver'))).resolves.toMatchObject({ id: 't-1' })
+  })
+})
+
+describe('a case read under its parent rides on the parent', () => {
+  /*
+   * dataset's data-ooc and data-sample screens read activityInstance { activityThreads {
+   * activityApprovals } } under their own records. These field resolvers do not ask who is reading -
+   * the caller already read the parent. Closing the root lists and gating the by-id reads must leave
+   * this path as it was.
+   */
+  it('the threads under an instance reach a caller who is not a participant', async () => {
+    mockRows.set('ActivityThread:by', [{ id: 't-1' }])
+
+    const threads = await new ActivityInstanceQuery().activityThreads({ id: 'i-1' }, contextFor('u-stranger'))
+    expect(threads.map((one: any) => one.id)).toEqual(['t-1'])
+  })
+
+  it('the approvals under a thread reach a caller who is not a participant', async () => {
+    mockRows.set('ActivityApproval:by', [{ id: 'a-1' }])
+
+    const approvals = await new ActivityThreadQuery().activityApprovals({ id: 't-1' }, contextFor('u-stranger'))
+    expect(approvals.map((one: any) => one.id)).toEqual(['a-1'])
+  })
+})
+
+describe('one instance by id', () => {
+  const read = (context: any) => new ActivityInstanceQuery().activityInstance('i-1', context)
+
+  beforeEach(() => {
+    mockRows.set('ActivityInstance:i-1', {
+      id: 'i-1',
+      domainId: 'd-here',
+      creatorId: 'u-operator',
+      assigneeRoleId: 'r-waiting'
+    })
+    mockRows.set('ActivityThread:*', [{ id: 't-1', assigneeId: 'u-worker' }])
+  })
+
+  it('whoever wrote the draft reopens it without the management privilege', async () => {
+    await expect(read(contextFor('u-operator'))).resolves.toMatchObject({ id: 'i-1' })
+  })
+
+  it('a holder of the role it waits for reads it, to pick it up', async () => {
+    await expect(read(contextFor('u-picker', ['r-waiting']))).resolves.toMatchObject({ id: 'i-1' })
+  })
+
+  it("the assignee of one of its threads and that thread's approver read it", async () => {
+    await expect(read(contextFor('u-worker'))).resolves.toMatchObject({ id: 'i-1' })
+    await expect(read(contextFor('u-approver'))).resolves.toMatchObject({ id: 'i-1' })
+  })
+
+  it('a stranger in the same domain is refused by name', async () => {
+    await expect(read(contextFor('u-stranger'))).rejects.toThrow('error.activity-case not a participant')
+  })
+
+  it('the waiting or supervisory role counts only when held in this domain', async () => {
+    mockRows.set('ActivityInstance:i-1', { id: 'i-1', domainId: 'd-here', assigneeRoleId: 'r-waiting', supervisoryRoleId: 'r-super' })
+
+    await expect(read(contextFor('u-elsewhere', ['r-waiting', 'r-super'], 'd-other'))).rejects.toThrow(
+      'error.activity-case not a participant'
+    )
+    await expect(read(contextFor('u-here', ['r-super'], 'd-here'))).resolves.toMatchObject({ id: 'i-1' })
+  })
+
+  it('a holder of the activity-instance query privilege reads it', async () => {
+    mockGrantsEveryCase = true
+    await expect(read(contextFor('u-stranger'))).resolves.toMatchObject({ id: 'i-1' })
+  })
+})