bazis 0.128.0 → 0.130.0

package/core/workflow/tasks_module/http/Tasks.controller.ts

@@ -1,30 +1,35 @@
 import { contextOnlyController } from "../../../http/Routing/contextOnlyControllers";
-import { Controller, Get, Post, type HttpContext } from "../../../http";
+import { can } from "../../../access";
+import { Authorize, Controller, Get, Post, type HttpContext } from "../../../http";
 import type { WorkflowActor } from "../../contracts/types";
 import { WorkflowError } from "../../contracts/WorkflowError";
-import { assigneesOf, authorize, body, optionalString, pagingQuery, param } from "../../internal/http";
+import { body, callerOf, optionalString, pagingQuery, param } from "../../internal/http";
 import type { TaskStatus } from "../model/WfTask.model";
 import { IWorkflowTasks, type TaskDetails } from "../services/IWorkflowTasks.service";
 
 /**
- * The caller's tasks (WORKFLOW-001 §5): those addressed to any of
- * `WorkflowAccess.assignees` or claimed by the caller. Another person's task
- * answers 404, as if it did not exist.
+ * The caller's tasks (WORKFLOW-002 §6.2): those addressed to any of the
+ * subject's `principals` in the task's partition or claimed by the caller.
+ * Another person's task answers 404, as if it did not exist.
  */
 @Controller("workflow/tasks")
 export class TasksController {
   constructor(private readonly tasks: IWorkflowTasks) {}
 
   @Get()
+  @Authorize(can("workflow.tasks.work"))
   async list(ctx: HttpContext) {
     const partition = optionalString(ctx.query("partition"), "partition");
-    const actor = await authorize(ctx, "tasks.work", { partition: partition ?? null });
+    const { access, actor } = await callerOf(ctx);
     const status = ctx.query("status");
+    const statuses = status === undefined ? {} : { status: status.split(",") as TaskStatus[] };
     const page = await this.tasks.list({
       ...pagingQuery(ctx),
-      assignees: await assigneesOf(ctx, actor),
+      ...statuses,
+      // Addressees are per partition and counted now, not when the task was created.
+      addressees: await access.principals(partition === undefined ? await this.tasks.partitions(statuses) : [partition]),
       actor,
-      ...(status === undefined ? {} : { status: status.split(",") as TaskStatus[] }),
+      access: await access.filter("workflow.tasks.work"),
       partition,
       processKey: optionalString(ctx.query("processKey"), "processKey"),
     });
@@ -32,35 +37,39 @@ export class TasksController {
   }
 
   @Get(":id")
+  @Authorize(can("workflow.tasks.work"))
   async get(ctx: HttpContext) {
     return (await this.visible(ctx)).task;
   }
 
   @Post(":id/claim")
+  @Authorize(can("workflow.tasks.work"))
   async claim(ctx: HttpContext) {
     const { task, actor } = await this.visible(ctx);
     return await this.tasks.claim(task.id, actor);
   }
 
   @Post(":id/release")
+  @Authorize(can("workflow.tasks.work"))
   async release(ctx: HttpContext) {
     const { task, actor } = await this.visible(ctx);
     return await this.tasks.release(task.id, actor);
   }
 
   @Post(":id/complete")
+  @Authorize(can("workflow.tasks.work"))
   async complete(ctx: HttpContext) {
     const { task, actor } = await this.visible(ctx);
     const request = await body(ctx);
     return await this.tasks.complete(task.id, request.output ?? {}, actor);
   }
 
-  /** The task if the caller may see it: addressed to one of their assignees or claimed by them. */
+  /** The task if the caller may see it: addressed to one of their principals or claimed by them. */
   private async visible(ctx: HttpContext): Promise<{ task: TaskDetails; actor: WorkflowActor }> {
     const task = await this.tasks.get(param(ctx, "id"));
-    const actor = await authorize(ctx, "tasks.work", { processKey: task.processKey, partition: task.partition, instanceId: task.instanceId, taskId: task.id });
-    const assignees = await assigneesOf(ctx, actor);
-    if (!assignees.includes(task.assignee) && task.claimedBy !== actor.id) throw new WorkflowError("not_found", `Task ${task.id} does not exist`);
+    const { access, actor } = await callerOf(ctx, "workflow.tasks.work", { scope: task.partition, process: task.processKey });
+    const addressees = await access.principals([task.partition]);
+    if (!addressees.some(({ principals }) => principals.includes(task.assignee)) && task.claimedBy !== actor.id) throw new WorkflowError("not_found", `Task ${task.id} does not exist`);
     return { task, actor };
   }
 }

package/core/workflow/tasks_module/services/IWorkflowTasks.service.ts

@@ -1,4 +1,5 @@
 import type { FormSpec } from "../../../../library/workflow";
+import type { AccessFilter, ScopePrincipals } from "../../../access";
 import type { WorkflowActor, WorkflowPage, WorkflowPaging } from "../../contracts/types";
 import type { TaskStatus } from "../model/WfTask.model";
 
@@ -23,10 +24,12 @@ export interface TaskDetails {
 }
 
 export interface TaskListQuery extends WorkflowPaging {
-  /** Tasks addressed to any of these (`role:support`, `user:42`), plus those the actor claimed. */
-  readonly assignees: readonly string[];
+  /** Tasks addressed to these (`role:support`, `user:42`) in their partition, plus those the actor claimed. */
+  readonly addressees: readonly ScopePrincipals[];
   /** Whose claimed tasks count as theirs. */
   readonly actor?: WorkflowActor;
+  /** Which tasks the caller may see, from `IAccess`; without it the calling code has decided. */
+  readonly access?: AccessFilter;
   /** `open` and `claimed` by default. */
   readonly status?: readonly TaskStatus[];
   readonly partition?: string;
@@ -40,8 +43,10 @@ export interface TaskListQuery extends WorkflowPaging {
  * by another person), `wrong_status`, `invalid_input` with the form issues.
  */
 export abstract class IWorkflowTasks {
-  /** The tasks of these assignees, oldest first. */
+  /** The tasks of these addressees, oldest first. */
   abstract list(query: TaskListQuery): Promise<WorkflowPage<TaskDetails>>;
+  /** The partitions that have tasks in these statuses (`open` and `claimed` by default): where to ask for addressees. */
+  abstract partitions(query?: { readonly status?: readonly TaskStatus[] }): Promise<readonly (string | null)[]>;
   abstract get(taskId: string): Promise<TaskDetails>;
   /** Takes an open task: nobody else can complete it until it is released. */
   abstract claim(taskId: string, actor: WorkflowActor): Promise<TaskDetails>;

package/core/workflow/tasks_module/services/WorkflowTasks.service.ts

@@ -1,8 +1,7 @@
-import { UniqueViolationError } from "../../../orm";
+import { grantsToWhere, type ScopePrincipals } from "../../../access";
 import { isUuid, pagingOf, type WorkflowActor, type WorkflowPage } from "../../contracts/types";
 import type { WorkflowClock } from "../../contracts/WorkflowClock";
 import { WorkflowError } from "../../contracts/WorkflowError";
-import type { WorkflowInstancesDeleted, WorkflowTaskRequested, WorkflowTokenClosed } from "../../runtime_module/events/Runtime.events";
 import type { IWorkflowRuntime } from "../../runtime_module/services/IWorkflowRuntime.service";
 import type { TasksDbContext } from "../model/Tasks.dbContext";
 import { WfTask, type TaskStatus } from "../model/WfTask.model";
@@ -21,17 +20,22 @@ export class WorkflowTasks extends IWorkflowTasks {
 
   async list(query: TaskListQuery): Promise<WorkflowPage<TaskDetails>> {
     const { limit, offset } = pagingOf(query);
-    const statuses = [...(query.status ?? ["open", "claimed"])];
-    if (statuses.length === 0 || statuses.some((status) => !STATUSES.has(status))) throw new WorkflowError("invalid_input", "status must be open, claimed, completed or cancelled");
-    const assignees = [...query.assignees];
+    const statuses = statusesOf(query.status);
+    const groups = groupByPrincipals(query.addressees);
     const mine = query.actor?.id;
-    if (assignees.length === 0 && mine === undefined) return { items: [], total: 0 };
+    const where = query.access === undefined ? "all" : grantsToWhere(query.access);
+    if (where === "none" || (groups.length === 0 && mine === undefined)) return { items: [], total: 0 };
     let source = this.db.tasks.asNoTracking().where((t) => t.status.in(statuses));
-    source = mine === undefined
-      ? source.where((t) => t.assignee.in(assignees))
-      : assignees.length === 0
-        ? source.where((t) => t.claimedById.eq(mine))
-        : source.where((t) => t.assignee.in(assignees).or(t.claimedById.eq(mine)));
+    if (where !== "all") source = source.where(() => where);
+    source = source.where((t) => {
+      const theirs = groups.map(({ scopes, principals }) => {
+        const named = scopes.filter((scope): scope is string => scope !== null);
+        const partition = !scopes.includes(null) ? t.partition.in(named) : named.length === 0 ? t.partition.isNull() : t.partition.isNull().or(t.partition.in(named));
+        return t.assignee.in(principals).and(partition);
+      });
+      if (mine !== undefined) theirs.push(t.claimedById.eq(mine));
+      return theirs.reduce((left, right) => left.or(right));
+    });
     if (query.partition !== undefined) source = source.where((t) => t.partition.eq(query.partition!));
     if (query.processKey !== undefined) source = source.where((t) => t.processKey.eq(query.processKey!));
     const total = await source.count();
@@ -39,6 +43,12 @@ export class WorkflowTasks extends IWorkflowTasks {
     return { items: rows.map(detailsOf), total };
   }
 
+  async partitions(query: { readonly status?: readonly TaskStatus[] } = {}): Promise<readonly (string | null)[]> {
+    const statuses = statusesOf(query.status);
+    const rows = await this.db.database.querySqlRaw(`SELECT DISTINCT "partition" FROM "bazis_wf_task_items" WHERE "status" IN (${statuses.map((_, index) => `{${index}}`).join(", ")})`, ...statuses);
+    return rows.map((row) => row.partition as string | null);
+  }
+
   async get(taskId: string): Promise<TaskDetails> {
     return detailsOf(await this.task(taskId, false));
   }
@@ -91,37 +101,6 @@ export class WorkflowTasks extends IWorkflowTasks {
     return await this.get(task.id);
   }
 
-  /** A step started waiting for a person: its task. Repeated events of one token make one task. */
-  async requested(event: WorkflowTaskRequested): Promise<void> {
-    const assignee = "role" in event.assignee ? `role:${event.assignee.role}` : `user:${event.assignee.user}`;
-    this.db.tasks.add(Object.assign(new WfTask(), {
-      tokenId: event.tokenId,
-      instanceId: event.instanceId,
-      processKey: event.processKey,
-      nodeId: event.nodeId,
-      partition: event.partition,
-      title: event.title,
-      assignee,
-      form: event.form,
-      dueAt: event.dueAt,
-    }));
-    try {
-      await this.db.saveChanges();
-    } catch (error) {
-      if (!(error instanceof UniqueViolationError)) throw error;
-    }
-  }
-
-  /** The step closed otherwise than by its task: the task is cancelled. */
-  async closed(event: WorkflowTokenClosed): Promise<void> {
-    await this.close(event.tokenId, "cancelled");
-  }
-
-  /** Retention deleted the instances: their tasks go too. */
-  async deleted(event: WorkflowInstancesDeleted): Promise<void> {
-    if (event.instanceIds.length > 0) await this.db.tasks.asNoTracking().where((t) => t.instanceId.in([...event.instanceIds])).executeDelete();
-  }
-
   private async close(tokenId: string, status: "cancelled"): Promise<void> {
     await this.db.tasks.asNoTracking().where((t) => t.tokenId.eq(tokenId).and(t.status.in(["open", "claimed"]))).executeUpdate({ status });
   }
@@ -142,6 +121,26 @@ export class WorkflowTasks extends IWorkflowTasks {
   }
 }
 
+function statusesOf(status: readonly TaskStatus[] | undefined): TaskStatus[] {
+  const statuses = [...(status ?? ["open", "claimed"] as const)];
+  if (statuses.length === 0 || statuses.some((item) => !STATUSES.has(item))) throw new WorkflowError("invalid_input", "status must be open, claimed, completed or cancelled");
+  return statuses;
+}
+
+/** Partitions with the same addressees go together: usually all of them, so the query stays short. */
+function groupByPrincipals(addressees: readonly ScopePrincipals[]): { scopes: (string | null)[]; principals: string[] }[] {
+  const groups = new Map<string, { scopes: (string | null)[]; principals: string[] }>();
+  for (const { scope, principals } of addressees) {
+    if (principals.length === 0) continue;
+    const list = [...new Set(principals)].sort();
+    const key = JSON.stringify(list);
+    const group = groups.get(key);
+    if (group === undefined) groups.set(key, { scopes: [scope], principals: list });
+    else group.scopes.push(scope);
+  }
+  return [...groups.values()];
+}
+
 function notFound(taskId: string): WorkflowError {
   return new WorkflowError("not_found", `Task ${taskId} does not exist`);
 }

package/core/workflow/testing/index.ts

@@ -1,4 +1,5 @@
 import { DI } from "../../di";
+import "../generated/deps";
 import { startTestApp, type TestApp, type TestAppOptions } from "../../testing";
 import { durationMs } from "../../../library/workflow";
 import { WorkflowClock } from "../contracts/WorkflowClock";

package/index.ts

@@ -41,7 +41,7 @@ export * as validation from "./library/validation";
 // Golden-path application API.
 export {
   GrpcController, GrpcMethod, GrpcError, GrpcStatus, grpcModule, grpcService, loadGrpcPackage,
-  GrpcClient, grpcClientProvider,
+  GrpcClient, GrpcClientBase,
   type GrpcClientOptions, type GrpcClientTlsOptions, type GrpcCallOptions, type GrpcResponse, type GrpcResponseStream,
   type GrpcContext, type GrpcModuleOptions,
 } from "./core/grpc";

package/library/http-client/{HttpClient.ts → HttpClientBase.ts}

@@ -78,7 +78,7 @@ function delay(ms: number, signal?: AbortSignal): Promise<void> {
  * Basic `auth`, `withCredentials`, idempotent retries with backoff, and
  * pluggable correlation-header propagation. No dependency on the Bazis core.
  */
-export class HttpClient {
+export class HttpClientBase {
   public readonly defaults: RequestConfig;
   public readonly interceptors: {
     readonly request: InterceptorManager<ResolvedRequestConfig>;
@@ -95,12 +95,12 @@ export class HttpClient {
   }
 
   /** Creates a new client whose defaults are this client's defaults merged with `config`. */
-  public create(config: RequestConfig = {}): HttpClient {
-    return new HttpClient(this.mergeConfig(this.defaults, config));
+  public create(config: RequestConfig = {}): HttpClientBase {
+    return new HttpClientBase(this.mergeConfig(this.defaults, config));
   }
 
-  public static create(config: RequestConfig = {}): HttpClient {
-    return new HttpClient(config);
+  public static create(config: RequestConfig = {}): HttpClientBase {
+    return new HttpClientBase(config);
   }
 
   public request<T = unknown>(config: RequestConfig): Promise<HttpResponse<T>>;

package/library/http-client/HttpClientFactory.ts

@@ -1,4 +1,4 @@
-import { HttpClient } from "./HttpClient";
+import { HttpClientBase } from "./HttpClientBase";
 import { HttpClientConfigError } from "./errors";
 import type { RequestConfig } from "./types";
 
@@ -7,7 +7,7 @@ import type { RequestConfig } from "./types";
  * An abstract class, so a service can take it by type in its constructor.
  */
 export abstract class HttpClientFactory {
-  public abstract createClient(name?: string): HttpClient;
+  public abstract createClient(name?: string): HttpClientBase;
 }
 
 class ConfiguredHttpClientFactory extends HttpClientFactory {
@@ -18,15 +18,15 @@ class ConfiguredHttpClientFactory extends HttpClientFactory {
     super();
   }
 
-  public createClient(name?: string): HttpClient {
+  public createClient(name?: string): HttpClientBase {
     if (name === undefined) {
-      return new HttpClient(this.defaults);
+      return new HttpClientBase(this.defaults);
     }
     const config = this.named.get(name);
     if (config === undefined) {
       throw new HttpClientConfigError(name, [...this.named.keys()]);
     }
-    return new HttpClient(this.defaults).create(config);
+    return new HttpClientBase(this.defaults).create(config);
   }
 }
 

package/library/http-client/index.ts

@@ -4,13 +4,13 @@
  * Bun, browsers and Node 18+.
  *
  * ```ts
- * import { HttpClient } from "@/library/http-client";
+ * import { HttpClientBase } from "@/library/http-client";
  *
- * const api = new HttpClient({ baseUrl: "https://api.example.com", timeoutMs: 5000 });
+ * const api = new HttpClientBase({ baseUrl: "https://api.example.com", timeoutMs: 5000 });
  * const { data } = await api.get<User[]>("/users", { params: { page: 2 } });
  * ```
  */
-export { HttpClient } from "./HttpClient";
+export { HttpClientBase } from "./HttpClientBase";
 export { InspectableRedirectProtocol } from "./redirectProtocol";
 export { HttpClientFactoryBuilder, HttpClientFactory } from "./HttpClientFactory";
 export { HttpClientError, HttpClientConfigError, HttpErrorCode } from "./errors";

package/library/terminal/messages.ts

@@ -211,7 +211,7 @@ const en = {
     outputs: "generated",
     sqlFix: "inject IPostgres from bazis/core/infra instead of Bun's SQL",
     redisFix: "inject IRedis from bazis/core/infra instead of Bun's RedisClient",
-    unknownDepFix: "register the class in a module, declare a token with createToken, or bind it with an explicit factory",
+    unknownDepFix: "register the class in a module or declare a token with createToken",
     run: "run",
   },
   dev: {
@@ -388,7 +388,7 @@ const ru: Messages = {
     outputs: "сгенерировано",
     sqlFix: "внедряйте IPostgres из bazis/core/infra вместо SQL из Bun",
     redisFix: "внедряйте IRedis из bazis/core/infra вместо RedisClient из Bun",
-    unknownDepFix: "зарегистрируйте класс в модуле, объявите токен через createToken или привяжите явной фабрикой",
+    unknownDepFix: "зарегистрируйте класс в модуле или объявите токен через createToken",
     run: "запуск",
   },
   dev: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.128.0",
+  "version": "0.130.0",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",
@@ -28,6 +28,8 @@
   "module": "./index.ts",
   "exports": {
     ".": "./index.ts",
+    "./core/access": "./core/access/index.ts",
+    "./core/access/testing": "./core/access/testing/index.ts",
     "./core/agent": "./core/agent/index.ts",
     "./core/app": "./core/app/index.ts",
     "./core/background": "./core/background/index.ts",

package/core/grpc/grpcClientProvider.ts

@@ -1,9 +0,0 @@
-import { singletonFactory, type ProviderDefinition, type Token } from "../di";
-import { GrpcClient } from "./GrpcClient";
-import type { GrpcClientOptions } from "./clientContracts";
-import type { ServiceDefinition } from "./serviceDefinition";
-
-/** Container-owned singleton: lazy network connection and automatic dispose(). */
-export function grpcClientProvider(service: ServiceDefinition, options: GrpcClientOptions, token: Token<GrpcClient> = GrpcClient): ProviderDefinition<GrpcClient> {
-  return singletonFactory(token, [], () => new GrpcClient(service, options));
-}

package/core/workflow/access/WorkflowAccess.ts

@@ -1,52 +0,0 @@
-import type { HttpContext } from "../../http";
-import type { WorkflowActor } from "../contracts/types";
-
-export type WorkflowAction =
-  | "processes.read"
-  | "processes.manage"
-  | "processes.publish"
-  | "instances.start"
-  | "instances.read"
-  | "instances.manage"
-  | "events.emit"
-  | "tasks.work";
-
-/** What an action is about; the fields known for the route. */
-export interface WorkflowAccessTarget {
-  readonly processKey?: string;
-  readonly partition?: string | null;
-  readonly instanceId?: string;
-  readonly taskId?: string;
-}
-
-/**
- * Rights and identity of the workflow HTTP (WORKFLOW-001 §6). The framework's
- * controllers do not know how the application signs people in, so they ask this
- * port. It is the DI token too: register the application's implementation in any
- * module, `DI.singleton(DI.classProvider(WorkflowAccess, AppWorkflowAccess))`.
- * Without one every workflow route answers 403. The services never ask it: the
- * application's code that calls them decides itself.
- */
-export abstract class WorkflowAccess {
-  /** Who makes the request; `undefined` answers 401. */
-  abstract actor(ctx: HttpContext): WorkflowActor | undefined | Promise<WorkflowActor | undefined>;
-
-  /** Whether the actor may do `action` on `target`; `false` answers 403. */
-  abstract can(ctx: HttpContext, action: WorkflowAction, target: WorkflowAccessTarget): boolean | Promise<boolean>;
-
-  /** Whom the user's tasks are addressed to: `user:<id>`, `role:<code>`. */
-  assignees(_ctx: HttpContext, actor: WorkflowActor): readonly string[] | Promise<readonly string[]> {
-    return [`user:${actor.id}`];
-  }
-}
-
-/** The default: nothing is allowed until the application says otherwise. */
-export class DenyWorkflowAccess extends WorkflowAccess {
-  actor(): undefined {
-    return undefined;
-  }
-
-  can(): boolean {
-    return false;
-  }
-}