bazis 0.128.0 → 0.130.0

package/core/workflow/index.ts

@@ -4,6 +4,7 @@
  * extension points. The document format is `bazis/library/workflow`.
  */
 import type { CodeProcess } from "./definitions_module/code/defineProcess";
+import "./generated/deps";
 
 export { WorkflowModule } from "./Workflow.module";
 export { defineProcess, type CodeProcess, type ProcessDefinition } from "./definitions_module/code/defineProcess";
@@ -49,7 +50,6 @@ export { workflowRuntimeConfig } from "./runtime_module/config/Runtime.config";
 export type { HistoryType } from "./runtime_module/model/WfHistory.model";
 export type { InstanceStatus, StartedVia } from "./runtime_module/model/WfInstance.model";
 export type { TokenStatus } from "./runtime_module/model/WfToken.model";
-export { WorkflowAccess, DenyWorkflowAccess, type WorkflowAccessTarget, type WorkflowAction } from "./access/WorkflowAccess";
 export { WorkflowInputValidator, DefaultWorkflowInputValidator, type WorkflowInputContext } from "./contracts/WorkflowInputValidator";
 export { WorkflowError, type WorkflowErrorCode } from "./contracts/WorkflowError";
 export type { WorkflowActor, WorkflowPage, WorkflowPaging } from "./contracts/types";

package/core/workflow/internal/WorkflowTools.ts

@@ -1,4 +1,4 @@
-import type { ServiceResolver } from "../../di";
+import type { ServiceProvider } from "../../di";
 import { ToolRunner, type AgentToolContract, type BoundToolRunner } from "../../agent";
 
 /** The workflow caller id of TOOLS-001: processes run only Tools whose `callers` list it. */
@@ -11,7 +11,7 @@ export const WORKFLOW_CALLER = "workflow";
 export class WorkflowTools {
   private readonly runner: BoundToolRunner | undefined;
 
-  constructor(services: ServiceResolver) {
+  constructor(services: ServiceProvider) {
     this.runner = services.tryResolve(ToolRunner)?.as(WORKFLOW_CALLER);
   }
 

package/core/workflow/internal/http.ts

@@ -1,25 +1,26 @@
-import { ForbiddenError, UnauthorizedError, type HttpContext } from "../../http";
-import { WorkflowAccess, type WorkflowAccessTarget, type WorkflowAction } from "../access/WorkflowAccess";
+import { IAccess, type AccessObject, type SubjectAccess } from "../../access";
+import { ForbiddenError, type HttpContext } from "../../http";
 import type { WorkflowActor } from "../contracts/types";
 import { WorkflowError } from "../contracts/WorkflowError";
 
-/**
- * Asks the application's {@link WorkflowAccess} who calls and whether the action
- * is allowed. Without a registered access every route answers 403.
- */
-export async function authorize(ctx: HttpContext, action: WorkflowAction, target: WorkflowAccessTarget = {}): Promise<WorkflowActor> {
-  const access = ctx.services.tryResolve(WorkflowAccess);
-  if (access === undefined) throw new ForbiddenError("Workflow HTTP is closed: register a WorkflowAccess implementation");
-  const actor = await access.actor(ctx);
-  if (actor === undefined) throw new UnauthorizedError();
-  if (!await access.can(ctx, action, target)) throw new ForbiddenError();
-  return actor;
+/** Who calls a route: their rights and how they are recorded as an actor. */
+export interface WorkflowCaller {
+  readonly access: SubjectAccess;
+  readonly actor: WorkflowActor;
 }
 
-/** Whom the caller's tasks are addressed to, from the application's {@link WorkflowAccess}. */
-export async function assigneesOf(ctx: HttpContext, actor: WorkflowActor): Promise<readonly string[]> {
-  const access = ctx.services.tryResolve(WorkflowAccess);
-  return access === undefined ? [] : await access.assignees(ctx, actor);
+/**
+ * The caller of a route; 401 without a subject. With `permission` and `object`
+ * also checks the object the route's `can` could not know: 403 without the
+ * right. The actor's id is the first owner id, so that `{ own: true }` means
+ * the instances the subject started.
+ */
+export async function callerOf(ctx: HttpContext, permission?: string, object?: AccessObject): Promise<WorkflowCaller> {
+  const access = await ctx.services.resolve(IAccess).for(ctx);
+  if (permission !== undefined && !await access.can(permission, object)) throw new ForbiddenError();
+  const sub = access.subject.sub;
+  const [id = sub.slice(sub.lastIndexOf(":") + 1)] = await access.ownerIds();
+  return { access, actor: { kind: "user", id } };
 }
 
 /** A route parameter as a string. */

package/core/workflow/runtime_module/WorkflowRuntime.module.ts

@@ -1,10 +1,8 @@
-import { DI, Module, SERVICE_PROVIDER, scoped } from "../../di";
-import { EventBus, LOGGER } from "../../kernel";
-import { WorkflowClock } from "../contracts/WorkflowClock";
+import { AccessModule } from "../../access";
+import { Module, scoped, singleton } from "../../di";
 import { DefaultWorkflowInputValidator, WorkflowInputValidator } from "../contracts/WorkflowInputValidator";
 import { WorkflowDefinitionsModule } from "../definitions_module/WorkflowDefinitions.module";
-import { IWorkflowDefinitions } from "../definitions_module/services/IWorkflowDefinitions.service";
-import { WorkflowTools } from "../internal/WorkflowTools";
+import { runtimePermissions } from "./access/Runtime.permissions";
 import { WorkflowRetention } from "./background/WorkflowRetention";
 import { WorkflowWorker } from "./background/WorkflowWorker";
 import { workflowRuntimeConfig } from "./config/Runtime.config";
@@ -21,40 +19,25 @@ import { WorkflowRuntime } from "./services/WorkflowRuntime.service";
 
 /**
  * Runs published versions: instances, tokens, jobs, history, the worker and
- * retention ([passport](MODULE.md)). Dependencies are explicit: the framework's
- * classes are not covered by the application's codegen.
+ * retention ([passport](MODULE.md)). The application replaces the input
+ * validator by registering its own `WorkflowInputValidator`.
  */
 @Module({
-  imports: [WorkflowDefinitionsModule],
+  imports: [AccessModule, WorkflowDefinitionsModule],
+  permissions: runtimePermissions,
   config: [workflowRuntimeConfig],
   ormBazis: { context: RuntimeDbContext, entities: [...RUNTIME_ENTITIES], ownedStore: runtimeStore, registerRepositories: false },
   providers: [
-    DI.singleton(DI.factoryProvider(GraphCache, [], () => new GraphCache())),
-    DI.scoped(DI.factoryProviderWithResolver(WorkflowEngine, [], (resolver) => new WorkflowEngine(
-      resolver.resolve(RuntimeDbContext),
-      resolver.resolve(IWorkflowDefinitions),
-      resolver.resolve(GraphCache),
-      resolver.resolve(EventBus),
-      resolver,
-      resolver.tryResolve(LOGGER),
-      resolver.resolve(WorkflowClock),
-    ))),
-    scoped(ToolStep, ToolStep, [RuntimeDbContext, WorkflowEngine, WorkflowTools] as const),
-    scoped(TimerStep, TimerStep, [RuntimeDbContext, WorkflowEngine] as const),
-    scoped(Schedules, Schedules, [RuntimeDbContext, WorkflowEngine, IWorkflowDefinitions] as const),
-    // The application's input validator, if it registered one anywhere; the built-in one otherwise.
-    DI.scoped(DI.factoryProviderWithResolver(IWorkflowRuntime, [], (resolver) => new WorkflowRuntime(
-      resolver.resolve(RuntimeDbContext),
-      resolver.resolve(WorkflowEngine),
-      resolver.resolve(IWorkflowDefinitions),
-      resolver.resolve(SERVICE_PROVIDER).tryResolve(WorkflowInputValidator) ?? new DefaultWorkflowInputValidator(),
-    ))),
+    singleton(GraphCache),
+    scoped(WorkflowEngine),
+    scoped(ToolStep),
+    scoped(TimerStep),
+    scoped(Schedules),
+    singleton(WorkflowInputValidator, DefaultWorkflowInputValidator),
+    scoped(IWorkflowRuntime, WorkflowRuntime),
   ],
-  controllers: [DI.bindDeps(InstancesController, IWorkflowRuntime), DI.bindDeps(EventsController, IWorkflowRuntime)],
-  background: [
-    DI.bindDeps(WorkflowWorker, SERVICE_PROVIDER, workflowRuntimeConfig.token),
-    DI.bindDeps(WorkflowRetention, SERVICE_PROVIDER, workflowRuntimeConfig.token),
-  ],
-  exports: [IWorkflowRuntime],
+  controllers: [InstancesController, EventsController],
+  background: [WorkflowWorker, WorkflowRetention],
+  exports: [IWorkflowRuntime, WorkflowInputValidator],
 })
 export class WorkflowRuntimeModule {}

package/core/workflow/runtime_module/access/Runtime.permissions.ts

@@ -0,0 +1,28 @@
+import { definePermissions } from "../../../access";
+
+const process = { ref: "workflow.process", column: "processKey" };
+
+/** The rights of running processes (WORKFLOW-002 §6.2). */
+export const runtimePermissions = definePermissions({
+  "workflow.instances.start": {
+    title: { en: "Start processes", ru: "Запускать процессы" },
+    scope: "request",
+    on: { process },
+  },
+  "workflow.instances.read": {
+    title: { en: "See instances", ru: "Видеть экземпляры" },
+    scope: { column: "partition" },
+    on: { process },
+    owner: "startedById",
+  },
+  "workflow.instances.manage": {
+    title: { en: "Cancel and retry instances", ru: "Отменять и повторять экземпляры" },
+    scope: { column: "partition" },
+    on: { process },
+  },
+  "workflow.events.emit": {
+    title: { en: "Send events to processes", ru: "Отправлять события процессам" },
+    scope: "request",
+    on: { event: { type: "string" } },
+  },
+});

package/core/workflow/runtime_module/background/WorkflowRetention.ts

@@ -5,7 +5,7 @@ import { WorkflowClock } from "../../contracts/WorkflowClock";
 import { IWorkflowDefinitions } from "../../definitions_module/services/IWorkflowDefinitions.service";
 import { WORKFLOW_INSTANCES_DELETED } from "../events/Runtime.events";
 import { RuntimeDbContext } from "../model/Runtime.dbContext";
-import type { WorkflowSettings } from "./WorkflowWorker";
+import type { WorkflowSettings } from "../config/Runtime.config";
 
 const DAY_MS = 86_400_000;
 

package/core/workflow/runtime_module/background/WorkflowWorker.ts

@@ -2,7 +2,7 @@ import { BackgroundService, delay } from "../../../background";
 import type { ServiceProvider } from "../../../di";
 import { WorkflowClock } from "../../contracts/WorkflowClock";
 import type { ConfigView } from "../../../kernel";
-import type { workflowRuntimeConfig } from "../config/Runtime.config";
+import type { WorkflowSettings } from "../config/Runtime.config";
 import { WorkflowJobs } from "../internal/WorkflowJobs";
 
 /** How often the scheduled starts are matched against the published versions. */
@@ -51,12 +51,3 @@ export class WorkflowWorker extends BackgroundService {
   }
 }
 
-/** The resolved settings of {@link workflowRuntimeConfig}. */
-export interface WorkflowSettings {
-  readonly "worker.enabled": boolean;
-  readonly "worker.intervalMs": number;
-  readonly "worker.batchSize": number;
-  readonly "retention.enabled": boolean;
-  readonly "retention.intervalMs": number;
-  readonly "retention.batchSize": number;
-}

package/core/workflow/runtime_module/config/Runtime.config.ts

@@ -5,7 +5,17 @@ import { defineConfig } from "../../../kernel";
  * application configuration: `BAZIS_WORKFLOW__WORKER__ENABLED=false` keeps an
  * instance from running jobs, for example a web-only one.
  */
-export const workflowRuntimeConfig = defineConfig("workflow", {
+/** The settings of the workflow background services, `workflow.*` in the configuration. */
+export interface WorkflowSettings {
+  readonly "worker.enabled": boolean;
+  readonly "worker.intervalMs": number;
+  readonly "worker.batchSize": number;
+  readonly "retention.enabled": boolean;
+  readonly "retention.intervalMs": number;
+  readonly "retention.batchSize": number;
+}
+
+export const workflowRuntimeConfig = defineConfig<WorkflowSettings>("workflow", {
   default: {
     "worker.enabled": true,
     "worker.intervalMs": 1000,

package/core/workflow/runtime_module/http/Events.controller.ts

@@ -1,6 +1,7 @@
 import { contextOnlyController } from "../../../http/Routing/contextOnlyControllers";
-import { Controller, Post, type HttpContext } from "../../../http";
-import { authorize, body, optionalString, param } from "../../internal/http";
+import { can } from "../../../access";
+import { Authorize, Controller, Post, type HttpContext } from "../../../http";
+import { body, callerOf, optionalString, param } from "../../internal/http";
 import { IWorkflowRuntime } from "../services/IWorkflowRuntime.service";
 
 /** Events from outside — a webhook, another service — over HTTP (WORKFLOW-001 §4). */
@@ -9,11 +10,12 @@ export class EventsController {
   constructor(private readonly runtime: IWorkflowRuntime) {}
 
   @Post(":eventKey")
+  @Authorize(can("workflow.events.emit"))
   async emit(ctx: HttpContext) {
     const eventKey = param(ctx, "eventKey");
     const request = await body(ctx);
     const partition = optionalString(request.partition, "partition") ?? null;
-    const actor = await authorize(ctx, "events.emit", { partition });
+    const { actor } = await callerOf(ctx, "workflow.events.emit", { scope: partition, event: eventKey });
     const result = await this.runtime.emit(eventKey, request.payload ?? {}, {
       correlation: optionalString(request.correlation, "correlation") ?? null,
       partition,

package/core/workflow/runtime_module/http/Instances.controller.ts

@@ -1,21 +1,22 @@
 import { contextOnlyController } from "../../../http/Routing/contextOnlyControllers";
-import { Controller, Created, Get, Post, type HttpContext } from "../../../http";
-import { WorkflowError } from "../../contracts/WorkflowError";
-import { authorize, body, optionalString, pagingQuery, param, requiredString } from "../../internal/http";
+import { can, type AccessObject } from "../../../access";
+import { Authorize, Controller, Created, Get, Post, type HttpContext } from "../../../http";
+import { body, callerOf, optionalString, pagingQuery, param, requiredString } from "../../internal/http";
 import type { InstanceStatus } from "../model/WfInstance.model";
-import { IWorkflowRuntime } from "../services/IWorkflowRuntime.service";
+import { IWorkflowRuntime, type InstanceSummary } from "../services/IWorkflowRuntime.service";
 
-/** Instances over HTTP (WORKFLOW-001 §4); rights come from `WorkflowAccess` with the instance's partition. */
+/** Instances over HTTP (WORKFLOW-001 §4); rights are `workflow.instances.*` (WORKFLOW-002 §6.2). */
 @Controller("workflow/instances")
 export class InstancesController {
   constructor(private readonly runtime: IWorkflowRuntime) {}
 
   @Post()
+  @Authorize(can("workflow.instances.start"))
   async start(ctx: HttpContext) {
     const request = await body(ctx);
     const processKey = requiredString(request.processKey, "processKey", 64);
     const partition = optionalString(request.partition, "partition") ?? null;
-    const actor = await authorize(ctx, "instances.start", { processKey, partition });
+    const { actor } = await callerOf(ctx, "workflow.instances.start", { scope: partition, process: processKey });
     const instance = await this.runtime.start(processKey, {
       input: request.input,
       partition,
@@ -26,14 +27,14 @@ export class InstancesController {
   }
 
   @Get()
+  @Authorize(can("workflow.instances.read"))
   async list(ctx: HttpContext) {
-    const partition = optionalString(ctx.query("partition"), "partition");
-    const processKey = optionalString(ctx.query("processKey"), "processKey");
-    await authorize(ctx, "instances.read", { partition: partition ?? null, ...(processKey === undefined ? {} : { processKey }) });
+    const { access } = await callerOf(ctx);
     const page = await this.runtime.instances({
       ...pagingQuery(ctx),
-      partition,
-      processKey,
+      access: await access.filter("workflow.instances.read"),
+      partition: optionalString(ctx.query("partition"), "partition"),
+      processKey: optionalString(ctx.query("processKey"), "processKey"),
       status: optionalString(ctx.query("status"), "status") as InstanceStatus | undefined,
       businessKey: optionalString(ctx.query("businessKey"), "businessKey"),
       startedById: optionalString(ctx.query("startedById"), "startedById"),
@@ -42,33 +43,42 @@ export class InstancesController {
   }
 
   @Get(":id")
+  @Authorize(can("workflow.instances.read"))
   async get(ctx: HttpContext) {
     const instance = await this.runtime.instance(param(ctx, "id"));
-    await authorize(ctx, "instances.read", { processKey: instance.processKey, partition: instance.partition, instanceId: instance.id });
+    await callerOf(ctx, "workflow.instances.read", objectOf(instance));
     return instance;
   }
 
   @Get(":id/history")
+  @Authorize(can("workflow.instances.read"))
   async history(ctx: HttpContext) {
     const instance = await this.runtime.instance(param(ctx, "id"));
-    await authorize(ctx, "instances.read", { processKey: instance.processKey, partition: instance.partition, instanceId: instance.id });
+    await callerOf(ctx, "workflow.instances.read", objectOf(instance));
     return { data: await this.runtime.history(instance.id) };
   }
 
   @Post(":id/cancel")
+  @Authorize(can("workflow.instances.manage"))
   async cancel(ctx: HttpContext) {
     const instance = await this.runtime.instance(param(ctx, "id"));
     const request = await body(ctx);
-    const actor = await authorize(ctx, "instances.manage", { processKey: instance.processKey, partition: instance.partition, instanceId: instance.id });
+    const { actor } = await callerOf(ctx, "workflow.instances.manage", objectOf(instance));
     return await this.runtime.cancel(instance.id, { reason: optionalString(request.reason, "reason", 1000) ?? null, actor });
   }
 
   @Post(":id/retry")
+  @Authorize(can("workflow.instances.manage"))
   async retry(ctx: HttpContext) {
     const instance = await this.runtime.instance(param(ctx, "id"));
-    const actor = await authorize(ctx, "instances.manage", { processKey: instance.processKey, partition: instance.partition, instanceId: instance.id });
+    const { actor } = await callerOf(ctx, "workflow.instances.manage", objectOf(instance));
     return await this.runtime.retry(instance.id, { actor });
   }
 }
 contextOnlyController(InstancesController);
 
+/** The instance as the object of a permission. */
+function objectOf(instance: InstanceSummary): AccessObject {
+  return { scope: instance.partition, process: instance.processKey, startedById: instance.startedBy.id };
+}
+

package/core/workflow/runtime_module/internal/WorkflowEngine.ts

@@ -1,4 +1,4 @@
-import type { ServiceResolver } from "../../../di";
+import type { ServiceProvider } from "../../../di";
 import { EventBus, type EventToken, type Logger } from "../../../kernel";
 import { durationMs, evaluateCondition, nodeKindOf, readPath, type FormSpec, type InstanceData, type ProcessFlow, type ProcessNode } from "../../../../library/workflow";
 import type { WorkflowActor } from "../../contracts/types";
@@ -52,9 +52,10 @@ export class WorkflowEngine {
     private readonly definitions: IWorkflowDefinitions,
     private readonly graphs: GraphCache,
     private readonly events: EventBus,
-    private readonly scope: ServiceResolver,
-    private readonly logger: Logger | undefined,
+    /** The scope of the engine: event handlers run in it. */
+    private readonly scope: ServiceProvider,
     private readonly clock: WorkflowClock,
+    private readonly logger?: Logger,
   ) {}
 
   /** The engine's time ({@link WorkflowClock}). */

package/core/workflow/runtime_module/services/IWorkflowRuntime.service.ts

@@ -1,3 +1,4 @@
+import type { AccessFilter } from "../../../access";
 import type { FormIssue } from "../../../../library/workflow";
 import type { WorkflowActor, WorkflowPage, WorkflowPaging } from "../../contracts/types";
 import type { HistoryType } from "../model/WfHistory.model";
@@ -75,6 +76,8 @@ export interface EmitResult {
 }
 
 export interface InstanceListQuery extends WorkflowPaging {
+  /** Which instances the caller may see, from `IAccess`; without it the calling code has decided. */
+  readonly access?: AccessFilter;
   readonly partition?: string;
   readonly status?: InstanceStatus;
   readonly processKey?: string;

package/core/workflow/runtime_module/services/WorkflowRuntime.service.ts

@@ -1,7 +1,9 @@
+import { grantsToWhere } from "../../../access";
 import type { FormIssue, FormSpec } from "../../../../library/workflow";
 import { isUuid, pagingOf, type WorkflowActor, type WorkflowPage } from "../../contracts/types";
 import { WorkflowError } from "../../contracts/WorkflowError";
-import type { WorkflowInputValidator } from "../../contracts/WorkflowInputValidator";
+import type { ServiceProvider } from "../../../di";
+import { WorkflowInputValidator } from "../../contracts/WorkflowInputValidator";
 import type { IWorkflowDefinitions } from "../../definitions_module/services/IWorkflowDefinitions.service";
 import type { WorkflowEngine } from "../internal/WorkflowEngine";
 import type { RuntimeDbContext } from "../model/Runtime.dbContext";
@@ -27,7 +29,8 @@ export class WorkflowRuntime extends IWorkflowRuntime {
     private readonly db: RuntimeDbContext,
     private readonly engine: WorkflowEngine,
     private readonly definitions: IWorkflowDefinitions,
-    private readonly validator: WorkflowInputValidator,
+    /** The scope: the input validator is asked here, so that the application's own registration replaces the default. */
+    private readonly services: ServiceProvider,
   ) {
     super();
   }
@@ -39,7 +42,7 @@ export class WorkflowRuntime extends IWorkflowRuntime {
     const version = await this.definitions.latest(processKey);
     const start = Object.entries(version.document.nodes).find(([, node]) => node.kind === "manualStart");
     if (!start) throw new WorkflowError("wrong_status", `Process ${processKey} has no manual start`);
-    const { value, issues } = await this.validator.validate(version.document.input, options.input, { purpose: "input", processKey, partition });
+    const { value, issues } = await this.validator().validate(version.document.input, options.input, { purpose: "input", processKey, partition });
     if (issues.length > 0) throw new WorkflowError("invalid_input", "The process input is invalid", issues);
     const id = await this.engine.begin(this.engine.cache(version), start[0], { input: value, partition, businessKey, startedVia: "manual", actor: options.actor });
     return await this.instance(id);
@@ -81,7 +84,7 @@ export class WorkflowRuntime extends IWorkflowRuntime {
       if (node?.kind !== "userTask" || !current || current.status !== "waiting" || step.instance.status !== "running") {
         throw new WorkflowError("wrong_status", "The token does not wait for a task");
       }
-      const { value, issues } = await this.validator.validate(node.config?.form as FormSpec | undefined, output, { purpose: "task", processKey: step.instance.processKey, partition: step.instance.partition });
+      const { value, issues } = await this.validator().validate(node.config?.form as FormSpec | undefined, output, { purpose: "task", processKey: step.instance.processKey, partition: step.instance.partition });
       if (issues.length > 0) throw new WorkflowError("invalid_input", "The task form is invalid", issues);
       await this.engine.complete(step, tokenId, value, actor);
       return true;
@@ -117,7 +120,7 @@ export class WorkflowRuntime extends IWorkflowRuntime {
       for (const [nodeId, node] of Object.entries(version.document.nodes)) {
         if (node.kind !== "eventStart" || node.config?.event !== eventKey) continue;
         // An event carries more than a process needs: fields the input does not declare are dropped, not refused.
-        const { value, issues: all } = await this.validator.validate(version.document.input, data, { purpose: "input", processKey: version.key, partition });
+        const { value, issues: all } = await this.validator().validate(version.document.input, data, { purpose: "input", processKey: version.key, partition });
         const issues = all.filter((issue) => issue.code !== "unknown");
         if (issues.length > 0) {
           rejected.push({ processKey: version.key, issues });
@@ -132,7 +135,10 @@ export class WorkflowRuntime extends IWorkflowRuntime {
   async instances(query: InstanceListQuery = {}): Promise<WorkflowPage<InstanceSummary>> {
     const { limit, offset } = pagingOf(query);
     if (query.status !== undefined && !STATUSES.has(query.status)) throw new WorkflowError("invalid_input", "status must be running, completed, cancelled or failed");
+    const where = query.access === undefined ? "all" : grantsToWhere(query.access);
+    if (where === "none") return { items: [], total: 0 };
     let source = this.db.instances.asNoTracking();
+    if (where !== "all") source = source.where(() => where);
     if (query.partition !== undefined) source = source.where((i) => i.partition.eq(query.partition!));
     if (query.status !== undefined) source = source.where((i) => i.status.eq(query.status!));
     if (query.processKey !== undefined) source = source.where((i) => i.processKey.eq(query.processKey!));
@@ -158,6 +164,11 @@ export class WorkflowRuntime extends IWorkflowRuntime {
     const rows = await this.db.history.asNoTracking().where((h) => h.instanceId.eq(instanceId)).orderBy((h) => h.id).toList();
     return rows.map(historyOf);
   }
+
+  /** The application's `WorkflowInputValidator`, or the module's `DefaultWorkflowInputValidator`. */
+  private validator(): WorkflowInputValidator {
+    return this.services.resolve(WorkflowInputValidator);
+  }
 }
 
 function notFound(instanceId: string): WorkflowError {

package/core/workflow/tasks_module/WorkflowTasks.module.ts

@@ -1,9 +1,9 @@
-import { DI, Module, scoped } from "../../di";
-import { WorkflowClock } from "../contracts/WorkflowClock";
+import { AccessModule } from "../../access";
+import { Module, scoped } from "../../di";
 import { WorkflowDefinitionsModule } from "../definitions_module/WorkflowDefinitions.module";
 import { withEventSubscribers } from "../../kernel";
-import { IWorkflowRuntime } from "../runtime_module/services/IWorkflowRuntime.service";
 import { WorkflowRuntimeModule } from "../runtime_module/WorkflowRuntime.module";
+import { tasksPermissions } from "./access/Tasks.permissions";
 import { TaskEvents } from "./events/TaskEvents";
 import { TasksController } from "./http/Tasks.controller";
 import { TasksDbContext, tasksStore } from "./model/Tasks.dbContext";
@@ -13,19 +13,17 @@ import { WorkflowTasks } from "./services/WorkflowTasks.service";
 
 /**
  * Tasks for people: the inbox of `userTask` steps ([passport](MODULE.md)).
- * Dependencies are explicit: the framework's classes are not covered by the
- * application's codegen.
  */
 @Module({
-  imports: [WorkflowDefinitionsModule, WorkflowRuntimeModule],
+  imports: [AccessModule, WorkflowDefinitionsModule, WorkflowRuntimeModule],
+  permissions: tasksPermissions,
   ormBazis: { context: TasksDbContext, entities: [WfTask], ownedStore: tasksStore, registerRepositories: false },
   providers: [
-    scoped(WorkflowTasks, WorkflowTasks, [TasksDbContext, IWorkflowRuntime, WorkflowClock] as const),
-    DI.scoped(DI.factoryProviderWithResolver(IWorkflowTasks, [], (resolver) => resolver.resolve(WorkflowTasks))),
-    scoped(TaskEvents, TaskEvents, [WorkflowTasks] as const),
+    scoped(IWorkflowTasks, WorkflowTasks),
+    scoped(TaskEvents),
     ...withEventSubscribers(TaskEvents),
   ],
-  controllers: [DI.bindDeps(TasksController, IWorkflowTasks)],
+  controllers: [TasksController],
   exports: [IWorkflowTasks],
 })
 export class WorkflowTasksModule {}

package/core/workflow/tasks_module/access/Tasks.permissions.ts

@@ -0,0 +1,13 @@
+import { definePermissions } from "../../../access";
+
+/**
+ * The right to work on tasks (WORKFLOW-002 §6.2). Which tasks are the
+ * subject's is decided by their addressees, not by an owner column.
+ */
+export const tasksPermissions = definePermissions({
+  "workflow.tasks.work": {
+    title: { en: "Work on tasks", ru: "Работать с задачами" },
+    scope: { column: "partition" },
+    on: { process: { ref: "workflow.process", column: "processKey" } },
+  },
+});

package/core/workflow/tasks_module/events/TaskEvents.ts

@@ -1,23 +1,44 @@
 import { OnEvent } from "../../../kernel";
+import { UniqueViolationError } from "../../../orm";
 import { WORKFLOW_INSTANCES_DELETED, WORKFLOW_TASK_REQUESTED, WORKFLOW_TOKEN_CLOSED, type WorkflowInstancesDeleted, type WorkflowTaskRequested, type WorkflowTokenClosed } from "../../runtime_module/events/Runtime.events";
-import type { WorkflowTasks } from "../services/WorkflowTasks.service";
+import type { TasksDbContext } from "../model/Tasks.dbContext";
+import { WfTask } from "../model/WfTask.model";
 
 /** Keeps the inbox in line with the steps: a waiting user task gets a task, a closed one cancels it. */
 export class TaskEvents {
-  constructor(private readonly tasks: WorkflowTasks) {}
+  constructor(private readonly db: TasksDbContext) {}
 
+  /** A step started waiting for a person: its task. Repeated events of one token make one task. */
   @OnEvent(WORKFLOW_TASK_REQUESTED)
-  requested(event: WorkflowTaskRequested): Promise<void> {
-    return this.tasks.requested(event);
+  async requested(event: WorkflowTaskRequested): Promise<void> {
+    const assignee = "role" in event.assignee ? `role:${event.assignee.role}` : `user:${event.assignee.user}`;
+    this.db.tasks.add(Object.assign(new WfTask(), {
+      tokenId: event.tokenId,
+      instanceId: event.instanceId,
+      processKey: event.processKey,
+      nodeId: event.nodeId,
+      partition: event.partition,
+      title: event.title,
+      assignee,
+      form: event.form,
+      dueAt: event.dueAt,
+    }));
+    try {
+      await this.db.saveChanges();
+    } catch (error) {
+      if (!(error instanceof UniqueViolationError)) throw error;
+    }
   }
 
+  /** The step closed otherwise than by its task: the task is cancelled. */
   @OnEvent(WORKFLOW_TOKEN_CLOSED)
-  closed(event: WorkflowTokenClosed): Promise<void> {
-    return this.tasks.closed(event);
+  async closed(event: WorkflowTokenClosed): Promise<void> {
+    await this.db.tasks.asNoTracking().where((t) => t.tokenId.eq(event.tokenId).and(t.status.in(["open", "claimed"]))).executeUpdate({ status: "cancelled" });
   }
 
+  /** Retention deleted the instances: their tasks go too. */
   @OnEvent(WORKFLOW_INSTANCES_DELETED)
-  deleted(event: WorkflowInstancesDeleted): Promise<void> {
-    return this.tasks.deleted(event);
+  async deleted(event: WorkflowInstancesDeleted): Promise<void> {
+    if (event.instanceIds.length > 0) await this.db.tasks.asNoTracking().where((t) => t.instanceId.in([...event.instanceIds])).executeDelete();
   }
 }