bazis 0.129.0 → 0.130.0

package/core/infra/connectors/codex/CodexAppServerClient.ts

@@ -232,7 +232,7 @@ export class CodexAppServerClient implements CodexClient {
         if (method === "account/updated") this.modelCache = undefined;
       }, () => { this.clearLogin(); this.modelCache = undefined; });
       const initialized = await client.request("initialize", {
-        clientInfo: { name: "bazis", title: "Bazis", version: "0.129.0" }, capabilities: { experimentalApi: true },
+        clientInfo: { name: "bazis", title: "Bazis", version: "0.130.0" }, capabilities: { experimentalApi: true },
       }, 15_000, signal);
       if (resolve(text(initialized.codexHome, 4096)) !== this.paths.home) throw new CodexError("PROTOCOL_ERROR");
       client.notify("initialized");

package/core/workflow/definitions_module/WorkflowDefinitions.module.ts

@@ -1,6 +1,9 @@
+import { AccessModule } from "../../access";
 import { HOSTED_SERVICE, Module, scoped, singleton } from "../../di";
 import { SystemWorkflowClock, WorkflowClock } from "../contracts/WorkflowClock";
 import { WorkflowTools } from "../internal/WorkflowTools";
+import { definitionsPermissions } from "./access/Definitions.permissions";
+import { ProcessReferences } from "./access/Process.references";
 import { CodeProcessCatalog } from "./code/CodeProcessCatalog";
 import { CodeProcessPublisher } from "./code/CodeProcessPublisher";
 import { ProcessesController } from "./http/Processes.controller";
@@ -15,12 +18,16 @@ import { WorkflowDefinitions } from "./services/WorkflowDefinitions.service";
  * declared in code ([passport](MODULE.md)).
  */
 @Module({
+  imports: [AccessModule],
+  permissions: definitionsPermissions,
+  references: { "workflow.process": ProcessReferences },
   ormBazis: { context: DefinitionsDbContext, entities: [WfProcess, WfVersion], ownedStore: definitionsStore, registerRepositories: false },
   providers: [
     singleton(WorkflowClock, SystemWorkflowClock),
     singleton(WorkflowTools),
     singleton(CodeProcessCatalog),
     scoped(IWorkflowDefinitions, WorkflowDefinitions),
+    scoped(ProcessReferences),
     singleton(HOSTED_SERVICE, CodeProcessPublisher),
   ],
   controllers: [ProcessesController],

package/core/workflow/definitions_module/access/Definitions.permissions.ts

@@ -0,0 +1,23 @@
+import { definePermissions } from "../../../access";
+
+const process = { ref: "workflow.process", column: "key" };
+
+/**
+ * The rights of the process catalog (WORKFLOW-002 §6.2). A process is one per
+ * application, so these have no partition until `WorkflowPartitions` connects
+ * processes to partitions (stage 4).
+ */
+export const definitionsPermissions = definePermissions({
+  "workflow.processes.read": {
+    title: { en: "See processes", ru: "Видеть процессы" },
+    on: { process },
+  },
+  "workflow.processes.manage": {
+    title: { en: "Edit processes", ru: "Редактировать процессы" },
+    on: { process },
+  },
+  "workflow.processes.publish": {
+    title: { en: "Publish processes", ru: "Публиковать процессы" },
+    on: { process },
+  },
+});

package/core/workflow/definitions_module/access/Process.references.ts

@@ -0,0 +1,27 @@
+import { References, type ReferenceItem, type ReferencePage } from "../../../access";
+import type { DefinitionsDbContext } from "../model/Definitions.dbContext";
+
+/** Reference kind `workflow.process`: what an administrator picks in a condition. */
+export class ProcessReferences extends References {
+  constructor(private readonly db: DefinitionsDbContext) {
+    super();
+  }
+
+  async exists(ids: readonly string[]): Promise<ReadonlySet<string>> {
+    return new Set((await this.describe(ids)).map((item) => item.id));
+  }
+
+  async describe(ids: readonly string[]): Promise<readonly ReferenceItem[]> {
+    if (ids.length === 0) return [];
+    const rows = await this.db.processes.asNoTracking().where((p) => p.key.in([...ids])).toList();
+    return rows.map((row) => ({ id: row.key, title: row.title }));
+  }
+
+  async search(text: string, _context: unknown, page: ReferencePage): Promise<readonly ReferenceItem[]> {
+    const found = text.trim();
+    let source = this.db.processes.asNoTracking();
+    if (found !== "") source = source.where((p) => p.key.contains(found, { ignoreCase: true }).or(p.title.contains(found, { ignoreCase: true })));
+    const rows = await source.orderBy((p) => p.key).skip(page.offset).take(page.limit).toList();
+    return rows.map((row) => ({ id: row.key, title: row.title }));
+  }
+}

package/core/workflow/definitions_module/http/Processes.controller.ts

@@ -1,28 +1,31 @@
 import { contextOnlyController } from "../../../http/Routing/contextOnlyControllers";
-import { Controller, Created, Get, Patch, Post, Put, type HttpContext } from "../../../http";
-import { authorize, body, optionalInteger, optionalString, pagingQuery, param, requiredString } from "../../internal/http";
+import { can } from "../../../access";
+import { Authorize, Controller, Created, Get, Patch, Post, Put, type HttpContext } from "../../../http";
+import { body, callerOf, optionalInteger, optionalString, pagingQuery, param, requiredString } from "../../internal/http";
 import { WorkflowError } from "../../contracts/WorkflowError";
 import { IWorkflowDefinitions } from "../services/IWorkflowDefinitions.service";
 
-/** The process catalog over HTTP (WORKFLOW-001 §3); rights come from `WorkflowAccess`. */
+/** The process catalog over HTTP (WORKFLOW-001 §3); rights are `workflow.processes.*` (WORKFLOW-002 §6.2). */
 @Controller("workflow")
 export class ProcessesController {
   constructor(private readonly definitions: IWorkflowDefinitions) {}
 
   @Get("processes")
+  @Authorize(can("workflow.processes.read"))
   async list(ctx: HttpContext) {
-    await authorize(ctx, "processes.read");
+    const { access } = await callerOf(ctx);
     const archived = ctx.query("archived");
     if (archived !== undefined && archived !== "true" && archived !== "false") throw new WorkflowError("invalid_input", "archived must be true or false");
-    const page = await this.definitions.list({ ...pagingQuery(ctx), archived: archived === undefined ? undefined : archived === "true", search: optionalString(ctx.query("search"), "search") });
+    const page = await this.definitions.list({ ...pagingQuery(ctx), access: await access.filter("workflow.processes.read"), archived: archived === undefined ? undefined : archived === "true", search: optionalString(ctx.query("search"), "search") });
     return { data: page.items, meta: { total: page.total } };
   }
 
   @Post("processes")
+  @Authorize(can("workflow.processes.manage"))
   async create(ctx: HttpContext) {
     const request = await body(ctx);
     const key = requiredString(request.key, "key", 64);
-    const actor = await authorize(ctx, "processes.manage", { processKey: key });
+    const { actor } = await callerOf(ctx, "workflow.processes.manage", { process: key });
     const process = await this.definitions.create({
       key,
       title: requiredString(request.title, "title"),
@@ -33,17 +36,19 @@ export class ProcessesController {
   }
 
   @Get("processes/:key")
+  @Authorize(can("workflow.processes.read"))
   async get(ctx: HttpContext) {
     const key = param(ctx, "key");
-    await authorize(ctx, "processes.read", { processKey: key });
+    await callerOf(ctx, "workflow.processes.read", { process: key });
     return await this.definitions.get(key);
   }
 
   @Patch("processes/:key")
+  @Authorize(can("workflow.processes.manage"))
   async update(ctx: HttpContext) {
     const key = param(ctx, "key");
     const request = await body(ctx);
-    const actor = await authorize(ctx, "processes.manage", { processKey: key });
+    const { actor } = await callerOf(ctx, "workflow.processes.manage", { process: key });
     if (request.archived !== undefined && typeof request.archived !== "boolean") throw new WorkflowError("invalid_input", "archived must be a boolean");
     return await this.definitions.update(key, {
       ...(request.title === undefined ? {} : { title: requiredString(request.title, "title") }),
@@ -54,40 +59,44 @@ export class ProcessesController {
   }
 
   @Put("processes/:key/draft")
+  @Authorize(can("workflow.processes.manage"))
   async saveDraft(ctx: HttpContext) {
     const key = param(ctx, "key");
     const request = await body(ctx);
-    const actor = await authorize(ctx, "processes.manage", { processKey: key });
+    const { actor } = await callerOf(ctx, "workflow.processes.manage", { process: key });
     return await this.definitions.saveDraft(key, request.document, actor);
   }
 
   @Post("processes/:key/publish")
+  @Authorize(can("workflow.processes.publish"))
   async publish(ctx: HttpContext) {
     const key = param(ctx, "key");
-    const actor = await authorize(ctx, "processes.publish", { processKey: key });
+    const { actor } = await callerOf(ctx, "workflow.processes.publish", { process: key });
     const version = await this.definitions.publish(key, actor);
     return Created(`${ctx.path.replace(/\/publish$/, "")}/versions/${version.version}`, version);
   }
 
   @Get("processes/:key/versions")
+  @Authorize(can("workflow.processes.read"))
   async versions(ctx: HttpContext) {
     const key = param(ctx, "key");
-    await authorize(ctx, "processes.read", { processKey: key });
+    await callerOf(ctx, "workflow.processes.read", { process: key });
     return { data: await this.definitions.versions(key) };
   }
 
   @Get("processes/:key/versions/:version")
+  @Authorize(can("workflow.processes.read"))
   async version(ctx: HttpContext) {
     const key = param(ctx, "key");
-    await authorize(ctx, "processes.read", { processKey: key });
+    await callerOf(ctx, "workflow.processes.read", { process: key });
     const version = optionalInteger(param(ctx, "version"), "version");
     if (version === undefined) throw new WorkflowError("invalid_input", "version must be an integer");
     return await this.definitions.version(key, version);
   }
 
   @Get("tools")
-  async tools(ctx: HttpContext) {
-    await authorize(ctx, "processes.read");
+  @Authorize(can("workflow.processes.read"))
+  async tools() {
     return { data: this.definitions.tools() };
   }
 }

package/core/workflow/definitions_module/services/IWorkflowDefinitions.service.ts

@@ -1,3 +1,4 @@
+import type { AccessFilter } from "../../../access";
 import type { AgentToolContract } from "../../../agent";
 import type { ProcessDocument, ProcessIssue } from "../../../../library/workflow";
 import type { WorkflowActor, WorkflowPage, WorkflowPaging } from "../../contracts/types";
@@ -53,6 +54,8 @@ export interface UpdateProcess {
 }
 
 export interface ProcessListQuery extends WorkflowPaging {
+  /** Which processes the caller may see, from `IAccess`; without it the calling code has decided. */
+  readonly access?: AccessFilter;
   readonly archived?: boolean;
   /** Part of the key or title, case-insensitive. */
   readonly search?: string;

package/core/workflow/definitions_module/services/WorkflowDefinitions.service.ts

@@ -1,3 +1,4 @@
+import { grantsToWhere } from "../../../access";
 import { createHash } from "node:crypto";
 import { UniqueViolationError } from "../../../orm";
 import type { AgentToolContract } from "../../../agent";
@@ -38,7 +39,10 @@ export class WorkflowDefinitions extends IWorkflowDefinitions {
 
   async list(query: ProcessListQuery = {}): Promise<WorkflowPage<ProcessSummary>> {
     const { limit, offset } = pagingOf(query);
+    const where = query.access === undefined ? "all" : grantsToWhere(query.access);
+    if (where === "none") return { items: [], total: 0 };
     let source = this.db.processes.asNoTracking();
+    if (where !== "all") source = source.where(() => where);
     if (query.archived === true) source = source.where((p) => p.archivedAt.isNotNull());
     if (query.archived === false) source = source.where((p) => p.archivedAt.isNull());
     if (query.search !== undefined && query.search.trim() !== "") {

package/core/workflow/generated/deps.ts

@@ -5,6 +5,7 @@ import { DbContextOptions } from "../../../library/orm/DbContextOptions";
 import { ServiceProvider } from "../../di/ServiceProvider";
 import { EventBus } from "../../kernel/events/EventBus";
 import { WorkflowClock } from "../contracts/WorkflowClock";
+import { ProcessReferences } from "../definitions_module/access/Process.references";
 import { CodeProcessCatalog } from "../definitions_module/code/CodeProcessCatalog";
 import { CodeProcessPublisher } from "../definitions_module/code/CodeProcessPublisher";
 import { ProcessesController } from "../definitions_module/http/Processes.controller";
@@ -37,6 +38,7 @@ registerFrameworkClassDeps([
   [EventsController, [IWorkflowRuntime]],
   [InstancesController, [IWorkflowRuntime]],
   [ProcessesController, [IWorkflowDefinitions]],
+  [ProcessReferences, [DefinitionsDbContext]],
   [RuntimeDbContext, [DbContextOptions]],
   [Schedules, [RuntimeDbContext, WorkflowEngine, IWorkflowDefinitions]],
   [TaskEvents, [TasksDbContext]],

package/core/workflow/index.ts

@@ -50,7 +50,6 @@ export { workflowRuntimeConfig } from "./runtime_module/config/Runtime.config";
 export type { HistoryType } from "./runtime_module/model/WfHistory.model";
 export type { InstanceStatus, StartedVia } from "./runtime_module/model/WfInstance.model";
 export type { TokenStatus } from "./runtime_module/model/WfToken.model";
-export { WorkflowAccess, DenyWorkflowAccess, type WorkflowAccessTarget, type WorkflowAction } from "./access/WorkflowAccess";
 export { WorkflowInputValidator, DefaultWorkflowInputValidator, type WorkflowInputContext } from "./contracts/WorkflowInputValidator";
 export { WorkflowError, type WorkflowErrorCode } from "./contracts/WorkflowError";
 export type { WorkflowActor, WorkflowPage, WorkflowPaging } from "./contracts/types";

package/core/workflow/internal/http.ts

@@ -1,25 +1,26 @@
-import { ForbiddenError, UnauthorizedError, type HttpContext } from "../../http";
-import { WorkflowAccess, type WorkflowAccessTarget, type WorkflowAction } from "../access/WorkflowAccess";
+import { IAccess, type AccessObject, type SubjectAccess } from "../../access";
+import { ForbiddenError, type HttpContext } from "../../http";
 import type { WorkflowActor } from "../contracts/types";
 import { WorkflowError } from "../contracts/WorkflowError";
 
-/**
- * Asks the application's {@link WorkflowAccess} who calls and whether the action
- * is allowed. Without a registered access every route answers 403.
- */
-export async function authorize(ctx: HttpContext, action: WorkflowAction, target: WorkflowAccessTarget = {}): Promise<WorkflowActor> {
-  const access = ctx.services.tryResolve(WorkflowAccess);
-  if (access === undefined) throw new ForbiddenError("Workflow HTTP is closed: register a WorkflowAccess implementation");
-  const actor = await access.actor(ctx);
-  if (actor === undefined) throw new UnauthorizedError();
-  if (!await access.can(ctx, action, target)) throw new ForbiddenError();
-  return actor;
+/** Who calls a route: their rights and how they are recorded as an actor. */
+export interface WorkflowCaller {
+  readonly access: SubjectAccess;
+  readonly actor: WorkflowActor;
 }
 
-/** Whom the caller's tasks are addressed to, from the application's {@link WorkflowAccess}. */
-export async function assigneesOf(ctx: HttpContext, actor: WorkflowActor): Promise<readonly string[]> {
-  const access = ctx.services.tryResolve(WorkflowAccess);
-  return access === undefined ? [] : await access.assignees(ctx, actor);
+/**
+ * The caller of a route; 401 without a subject. With `permission` and `object`
+ * also checks the object the route's `can` could not know: 403 without the
+ * right. The actor's id is the first owner id, so that `{ own: true }` means
+ * the instances the subject started.
+ */
+export async function callerOf(ctx: HttpContext, permission?: string, object?: AccessObject): Promise<WorkflowCaller> {
+  const access = await ctx.services.resolve(IAccess).for(ctx);
+  if (permission !== undefined && !await access.can(permission, object)) throw new ForbiddenError();
+  const sub = access.subject.sub;
+  const [id = sub.slice(sub.lastIndexOf(":") + 1)] = await access.ownerIds();
+  return { access, actor: { kind: "user", id } };
 }
 
 /** A route parameter as a string. */

package/core/workflow/runtime_module/WorkflowRuntime.module.ts

@@ -1,6 +1,8 @@
+import { AccessModule } from "../../access";
 import { Module, scoped, singleton } from "../../di";
 import { DefaultWorkflowInputValidator, WorkflowInputValidator } from "../contracts/WorkflowInputValidator";
 import { WorkflowDefinitionsModule } from "../definitions_module/WorkflowDefinitions.module";
+import { runtimePermissions } from "./access/Runtime.permissions";
 import { WorkflowRetention } from "./background/WorkflowRetention";
 import { WorkflowWorker } from "./background/WorkflowWorker";
 import { workflowRuntimeConfig } from "./config/Runtime.config";
@@ -21,7 +23,8 @@ import { WorkflowRuntime } from "./services/WorkflowRuntime.service";
  * validator by registering its own `WorkflowInputValidator`.
  */
 @Module({
-  imports: [WorkflowDefinitionsModule],
+  imports: [AccessModule, WorkflowDefinitionsModule],
+  permissions: runtimePermissions,
   config: [workflowRuntimeConfig],
   ormBazis: { context: RuntimeDbContext, entities: [...RUNTIME_ENTITIES], ownedStore: runtimeStore, registerRepositories: false },
   providers: [

package/core/workflow/runtime_module/access/Runtime.permissions.ts

@@ -0,0 +1,28 @@
+import { definePermissions } from "../../../access";
+
+const process = { ref: "workflow.process", column: "processKey" };
+
+/** The rights of running processes (WORKFLOW-002 §6.2). */
+export const runtimePermissions = definePermissions({
+  "workflow.instances.start": {
+    title: { en: "Start processes", ru: "Запускать процессы" },
+    scope: "request",
+    on: { process },
+  },
+  "workflow.instances.read": {
+    title: { en: "See instances", ru: "Видеть экземпляры" },
+    scope: { column: "partition" },
+    on: { process },
+    owner: "startedById",
+  },
+  "workflow.instances.manage": {
+    title: { en: "Cancel and retry instances", ru: "Отменять и повторять экземпляры" },
+    scope: { column: "partition" },
+    on: { process },
+  },
+  "workflow.events.emit": {
+    title: { en: "Send events to processes", ru: "Отправлять события процессам" },
+    scope: "request",
+    on: { event: { type: "string" } },
+  },
+});

package/core/workflow/runtime_module/http/Events.controller.ts

@@ -1,6 +1,7 @@
 import { contextOnlyController } from "../../../http/Routing/contextOnlyControllers";
-import { Controller, Post, type HttpContext } from "../../../http";
-import { authorize, body, optionalString, param } from "../../internal/http";
+import { can } from "../../../access";
+import { Authorize, Controller, Post, type HttpContext } from "../../../http";
+import { body, callerOf, optionalString, param } from "../../internal/http";
 import { IWorkflowRuntime } from "../services/IWorkflowRuntime.service";
 
 /** Events from outside — a webhook, another service — over HTTP (WORKFLOW-001 §4). */
@@ -9,11 +10,12 @@ export class EventsController {
   constructor(private readonly runtime: IWorkflowRuntime) {}
 
   @Post(":eventKey")
+  @Authorize(can("workflow.events.emit"))
   async emit(ctx: HttpContext) {
     const eventKey = param(ctx, "eventKey");
     const request = await body(ctx);
     const partition = optionalString(request.partition, "partition") ?? null;
-    const actor = await authorize(ctx, "events.emit", { partition });
+    const { actor } = await callerOf(ctx, "workflow.events.emit", { scope: partition, event: eventKey });
     const result = await this.runtime.emit(eventKey, request.payload ?? {}, {
       correlation: optionalString(request.correlation, "correlation") ?? null,
       partition,

package/core/workflow/runtime_module/http/Instances.controller.ts

@@ -1,21 +1,22 @@
 import { contextOnlyController } from "../../../http/Routing/contextOnlyControllers";
-import { Controller, Created, Get, Post, type HttpContext } from "../../../http";
-import { WorkflowError } from "../../contracts/WorkflowError";
-import { authorize, body, optionalString, pagingQuery, param, requiredString } from "../../internal/http";
+import { can, type AccessObject } from "../../../access";
+import { Authorize, Controller, Created, Get, Post, type HttpContext } from "../../../http";
+import { body, callerOf, optionalString, pagingQuery, param, requiredString } from "../../internal/http";
 import type { InstanceStatus } from "../model/WfInstance.model";
-import { IWorkflowRuntime } from "../services/IWorkflowRuntime.service";
+import { IWorkflowRuntime, type InstanceSummary } from "../services/IWorkflowRuntime.service";
 
-/** Instances over HTTP (WORKFLOW-001 §4); rights come from `WorkflowAccess` with the instance's partition. */
+/** Instances over HTTP (WORKFLOW-001 §4); rights are `workflow.instances.*` (WORKFLOW-002 §6.2). */
 @Controller("workflow/instances")
 export class InstancesController {
   constructor(private readonly runtime: IWorkflowRuntime) {}
 
   @Post()
+  @Authorize(can("workflow.instances.start"))
   async start(ctx: HttpContext) {
     const request = await body(ctx);
     const processKey = requiredString(request.processKey, "processKey", 64);
     const partition = optionalString(request.partition, "partition") ?? null;
-    const actor = await authorize(ctx, "instances.start", { processKey, partition });
+    const { actor } = await callerOf(ctx, "workflow.instances.start", { scope: partition, process: processKey });
     const instance = await this.runtime.start(processKey, {
       input: request.input,
       partition,
@@ -26,14 +27,14 @@ export class InstancesController {
   }
 
   @Get()
+  @Authorize(can("workflow.instances.read"))
   async list(ctx: HttpContext) {
-    const partition = optionalString(ctx.query("partition"), "partition");
-    const processKey = optionalString(ctx.query("processKey"), "processKey");
-    await authorize(ctx, "instances.read", { partition: partition ?? null, ...(processKey === undefined ? {} : { processKey }) });
+    const { access } = await callerOf(ctx);
     const page = await this.runtime.instances({
       ...pagingQuery(ctx),
-      partition,
-      processKey,
+      access: await access.filter("workflow.instances.read"),
+      partition: optionalString(ctx.query("partition"), "partition"),
+      processKey: optionalString(ctx.query("processKey"), "processKey"),
       status: optionalString(ctx.query("status"), "status") as InstanceStatus | undefined,
       businessKey: optionalString(ctx.query("businessKey"), "businessKey"),
       startedById: optionalString(ctx.query("startedById"), "startedById"),
@@ -42,33 +43,42 @@ export class InstancesController {
   }
 
   @Get(":id")
+  @Authorize(can("workflow.instances.read"))
   async get(ctx: HttpContext) {
     const instance = await this.runtime.instance(param(ctx, "id"));
-    await authorize(ctx, "instances.read", { processKey: instance.processKey, partition: instance.partition, instanceId: instance.id });
+    await callerOf(ctx, "workflow.instances.read", objectOf(instance));
     return instance;
   }
 
   @Get(":id/history")
+  @Authorize(can("workflow.instances.read"))
   async history(ctx: HttpContext) {
     const instance = await this.runtime.instance(param(ctx, "id"));
-    await authorize(ctx, "instances.read", { processKey: instance.processKey, partition: instance.partition, instanceId: instance.id });
+    await callerOf(ctx, "workflow.instances.read", objectOf(instance));
     return { data: await this.runtime.history(instance.id) };
   }
 
   @Post(":id/cancel")
+  @Authorize(can("workflow.instances.manage"))
   async cancel(ctx: HttpContext) {
     const instance = await this.runtime.instance(param(ctx, "id"));
     const request = await body(ctx);
-    const actor = await authorize(ctx, "instances.manage", { processKey: instance.processKey, partition: instance.partition, instanceId: instance.id });
+    const { actor } = await callerOf(ctx, "workflow.instances.manage", objectOf(instance));
     return await this.runtime.cancel(instance.id, { reason: optionalString(request.reason, "reason", 1000) ?? null, actor });
   }
 
   @Post(":id/retry")
+  @Authorize(can("workflow.instances.manage"))
   async retry(ctx: HttpContext) {
     const instance = await this.runtime.instance(param(ctx, "id"));
-    const actor = await authorize(ctx, "instances.manage", { processKey: instance.processKey, partition: instance.partition, instanceId: instance.id });
+    const { actor } = await callerOf(ctx, "workflow.instances.manage", objectOf(instance));
     return await this.runtime.retry(instance.id, { actor });
   }
 }
 contextOnlyController(InstancesController);
 
+/** The instance as the object of a permission. */
+function objectOf(instance: InstanceSummary): AccessObject {
+  return { scope: instance.partition, process: instance.processKey, startedById: instance.startedBy.id };
+}
+

package/core/workflow/runtime_module/services/IWorkflowRuntime.service.ts

@@ -1,3 +1,4 @@
+import type { AccessFilter } from "../../../access";
 import type { FormIssue } from "../../../../library/workflow";
 import type { WorkflowActor, WorkflowPage, WorkflowPaging } from "../../contracts/types";
 import type { HistoryType } from "../model/WfHistory.model";
@@ -75,6 +76,8 @@ export interface EmitResult {
 }
 
 export interface InstanceListQuery extends WorkflowPaging {
+  /** Which instances the caller may see, from `IAccess`; without it the calling code has decided. */
+  readonly access?: AccessFilter;
   readonly partition?: string;
   readonly status?: InstanceStatus;
   readonly processKey?: string;

package/core/workflow/runtime_module/services/WorkflowRuntime.service.ts

@@ -1,3 +1,4 @@
+import { grantsToWhere } from "../../../access";
 import type { FormIssue, FormSpec } from "../../../../library/workflow";
 import { isUuid, pagingOf, type WorkflowActor, type WorkflowPage } from "../../contracts/types";
 import { WorkflowError } from "../../contracts/WorkflowError";
@@ -134,7 +135,10 @@ export class WorkflowRuntime extends IWorkflowRuntime {
   async instances(query: InstanceListQuery = {}): Promise<WorkflowPage<InstanceSummary>> {
     const { limit, offset } = pagingOf(query);
     if (query.status !== undefined && !STATUSES.has(query.status)) throw new WorkflowError("invalid_input", "status must be running, completed, cancelled or failed");
+    const where = query.access === undefined ? "all" : grantsToWhere(query.access);
+    if (where === "none") return { items: [], total: 0 };
     let source = this.db.instances.asNoTracking();
+    if (where !== "all") source = source.where(() => where);
     if (query.partition !== undefined) source = source.where((i) => i.partition.eq(query.partition!));
     if (query.status !== undefined) source = source.where((i) => i.status.eq(query.status!));
     if (query.processKey !== undefined) source = source.where((i) => i.processKey.eq(query.processKey!));

package/core/workflow/tasks_module/WorkflowTasks.module.ts

@@ -1,7 +1,9 @@
+import { AccessModule } from "../../access";
 import { Module, scoped } from "../../di";
 import { WorkflowDefinitionsModule } from "../definitions_module/WorkflowDefinitions.module";
 import { withEventSubscribers } from "../../kernel";
 import { WorkflowRuntimeModule } from "../runtime_module/WorkflowRuntime.module";
+import { tasksPermissions } from "./access/Tasks.permissions";
 import { TaskEvents } from "./events/TaskEvents";
 import { TasksController } from "./http/Tasks.controller";
 import { TasksDbContext, tasksStore } from "./model/Tasks.dbContext";
@@ -13,7 +15,8 @@ import { WorkflowTasks } from "./services/WorkflowTasks.service";
  * Tasks for people: the inbox of `userTask` steps ([passport](MODULE.md)).
  */
 @Module({
-  imports: [WorkflowDefinitionsModule, WorkflowRuntimeModule],
+  imports: [AccessModule, WorkflowDefinitionsModule, WorkflowRuntimeModule],
+  permissions: tasksPermissions,
   ormBazis: { context: TasksDbContext, entities: [WfTask], ownedStore: tasksStore, registerRepositories: false },
   providers: [
     scoped(IWorkflowTasks, WorkflowTasks),

package/core/workflow/tasks_module/access/Tasks.permissions.ts

@@ -0,0 +1,13 @@
+import { definePermissions } from "../../../access";
+
+/**
+ * The right to work on tasks (WORKFLOW-002 §6.2). Which tasks are the
+ * subject's is decided by their addressees, not by an owner column.
+ */
+export const tasksPermissions = definePermissions({
+  "workflow.tasks.work": {
+    title: { en: "Work on tasks", ru: "Работать с задачами" },
+    scope: { column: "partition" },
+    on: { process: { ref: "workflow.process", column: "processKey" } },
+  },
+});

package/core/workflow/tasks_module/http/Tasks.controller.ts

@@ -1,30 +1,35 @@
 import { contextOnlyController } from "../../../http/Routing/contextOnlyControllers";
-import { Controller, Get, Post, type HttpContext } from "../../../http";
+import { can } from "../../../access";
+import { Authorize, Controller, Get, Post, type HttpContext } from "../../../http";
 import type { WorkflowActor } from "../../contracts/types";
 import { WorkflowError } from "../../contracts/WorkflowError";
-import { assigneesOf, authorize, body, optionalString, pagingQuery, param } from "../../internal/http";
+import { body, callerOf, optionalString, pagingQuery, param } from "../../internal/http";
 import type { TaskStatus } from "../model/WfTask.model";
 import { IWorkflowTasks, type TaskDetails } from "../services/IWorkflowTasks.service";
 
 /**
- * The caller's tasks (WORKFLOW-001 §5): those addressed to any of
- * `WorkflowAccess.assignees` or claimed by the caller. Another person's task
- * answers 404, as if it did not exist.
+ * The caller's tasks (WORKFLOW-002 §6.2): those addressed to any of the
+ * subject's `principals` in the task's partition or claimed by the caller.
+ * Another person's task answers 404, as if it did not exist.
  */
 @Controller("workflow/tasks")
 export class TasksController {
   constructor(private readonly tasks: IWorkflowTasks) {}
 
   @Get()
+  @Authorize(can("workflow.tasks.work"))
   async list(ctx: HttpContext) {
     const partition = optionalString(ctx.query("partition"), "partition");
-    const actor = await authorize(ctx, "tasks.work", { partition: partition ?? null });
+    const { access, actor } = await callerOf(ctx);
     const status = ctx.query("status");
+    const statuses = status === undefined ? {} : { status: status.split(",") as TaskStatus[] };
     const page = await this.tasks.list({
       ...pagingQuery(ctx),
-      assignees: await assigneesOf(ctx, actor),
+      ...statuses,
+      // Addressees are per partition and counted now, not when the task was created.
+      addressees: await access.principals(partition === undefined ? await this.tasks.partitions(statuses) : [partition]),
       actor,
-      ...(status === undefined ? {} : { status: status.split(",") as TaskStatus[] }),
+      access: await access.filter("workflow.tasks.work"),
       partition,
       processKey: optionalString(ctx.query("processKey"), "processKey"),
     });
@@ -32,35 +37,39 @@ export class TasksController {
   }
 
   @Get(":id")
+  @Authorize(can("workflow.tasks.work"))
   async get(ctx: HttpContext) {
     return (await this.visible(ctx)).task;
   }
 
   @Post(":id/claim")
+  @Authorize(can("workflow.tasks.work"))
   async claim(ctx: HttpContext) {
     const { task, actor } = await this.visible(ctx);
     return await this.tasks.claim(task.id, actor);
   }
 
   @Post(":id/release")
+  @Authorize(can("workflow.tasks.work"))
   async release(ctx: HttpContext) {
     const { task, actor } = await this.visible(ctx);
     return await this.tasks.release(task.id, actor);
   }
 
   @Post(":id/complete")
+  @Authorize(can("workflow.tasks.work"))
   async complete(ctx: HttpContext) {
     const { task, actor } = await this.visible(ctx);
     const request = await body(ctx);
     return await this.tasks.complete(task.id, request.output ?? {}, actor);
   }
 
-  /** The task if the caller may see it: addressed to one of their assignees or claimed by them. */
+  /** The task if the caller may see it: addressed to one of their principals or claimed by them. */
   private async visible(ctx: HttpContext): Promise<{ task: TaskDetails; actor: WorkflowActor }> {
     const task = await this.tasks.get(param(ctx, "id"));
-    const actor = await authorize(ctx, "tasks.work", { processKey: task.processKey, partition: task.partition, instanceId: task.instanceId, taskId: task.id });
-    const assignees = await assigneesOf(ctx, actor);
-    if (!assignees.includes(task.assignee) && task.claimedBy !== actor.id) throw new WorkflowError("not_found", `Task ${task.id} does not exist`);
+    const { access, actor } = await callerOf(ctx, "workflow.tasks.work", { scope: task.partition, process: task.processKey });
+    const addressees = await access.principals([task.partition]);
+    if (!addressees.some(({ principals }) => principals.includes(task.assignee)) && task.claimedBy !== actor.id) throw new WorkflowError("not_found", `Task ${task.id} does not exist`);
     return { task, actor };
   }
 }

package/core/workflow/tasks_module/services/IWorkflowTasks.service.ts

@@ -1,4 +1,5 @@
 import type { FormSpec } from "../../../../library/workflow";
+import type { AccessFilter, ScopePrincipals } from "../../../access";
 import type { WorkflowActor, WorkflowPage, WorkflowPaging } from "../../contracts/types";
 import type { TaskStatus } from "../model/WfTask.model";
 
@@ -23,10 +24,12 @@ export interface TaskDetails {
 }
 
 export interface TaskListQuery extends WorkflowPaging {
-  /** Tasks addressed to any of these (`role:support`, `user:42`), plus those the actor claimed. */
-  readonly assignees: readonly string[];
+  /** Tasks addressed to these (`role:support`, `user:42`) in their partition, plus those the actor claimed. */
+  readonly addressees: readonly ScopePrincipals[];
   /** Whose claimed tasks count as theirs. */
   readonly actor?: WorkflowActor;
+  /** Which tasks the caller may see, from `IAccess`; without it the calling code has decided. */
+  readonly access?: AccessFilter;
   /** `open` and `claimed` by default. */
   readonly status?: readonly TaskStatus[];
   readonly partition?: string;
@@ -40,8 +43,10 @@ export interface TaskListQuery extends WorkflowPaging {
  * by another person), `wrong_status`, `invalid_input` with the form issues.
  */
 export abstract class IWorkflowTasks {
-  /** The tasks of these assignees, oldest first. */
+  /** The tasks of these addressees, oldest first. */
   abstract list(query: TaskListQuery): Promise<WorkflowPage<TaskDetails>>;
+  /** The partitions that have tasks in these statuses (`open` and `claimed` by default): where to ask for addressees. */
+  abstract partitions(query?: { readonly status?: readonly TaskStatus[] }): Promise<readonly (string | null)[]>;
   abstract get(taskId: string): Promise<TaskDetails>;
   /** Takes an open task: nobody else can complete it until it is released. */
   abstract claim(taskId: string, actor: WorkflowActor): Promise<TaskDetails>;

package/core/workflow/tasks_module/services/WorkflowTasks.service.ts

@@ -1,3 +1,4 @@
+import { grantsToWhere, type ScopePrincipals } from "../../../access";
 import { isUuid, pagingOf, type WorkflowActor, type WorkflowPage } from "../../contracts/types";
 import type { WorkflowClock } from "../../contracts/WorkflowClock";
 import { WorkflowError } from "../../contracts/WorkflowError";
@@ -19,17 +20,22 @@ export class WorkflowTasks extends IWorkflowTasks {
 
   async list(query: TaskListQuery): Promise<WorkflowPage<TaskDetails>> {
     const { limit, offset } = pagingOf(query);
-    const statuses = [...(query.status ?? ["open", "claimed"])];
-    if (statuses.length === 0 || statuses.some((status) => !STATUSES.has(status))) throw new WorkflowError("invalid_input", "status must be open, claimed, completed or cancelled");
-    const assignees = [...query.assignees];
+    const statuses = statusesOf(query.status);
+    const groups = groupByPrincipals(query.addressees);
     const mine = query.actor?.id;
-    if (assignees.length === 0 && mine === undefined) return { items: [], total: 0 };
+    const where = query.access === undefined ? "all" : grantsToWhere(query.access);
+    if (where === "none" || (groups.length === 0 && mine === undefined)) return { items: [], total: 0 };
     let source = this.db.tasks.asNoTracking().where((t) => t.status.in(statuses));
-    source = mine === undefined
-      ? source.where((t) => t.assignee.in(assignees))
-      : assignees.length === 0
-        ? source.where((t) => t.claimedById.eq(mine))
-        : source.where((t) => t.assignee.in(assignees).or(t.claimedById.eq(mine)));
+    if (where !== "all") source = source.where(() => where);
+    source = source.where((t) => {
+      const theirs = groups.map(({ scopes, principals }) => {
+        const named = scopes.filter((scope): scope is string => scope !== null);
+        const partition = !scopes.includes(null) ? t.partition.in(named) : named.length === 0 ? t.partition.isNull() : t.partition.isNull().or(t.partition.in(named));
+        return t.assignee.in(principals).and(partition);
+      });
+      if (mine !== undefined) theirs.push(t.claimedById.eq(mine));
+      return theirs.reduce((left, right) => left.or(right));
+    });
     if (query.partition !== undefined) source = source.where((t) => t.partition.eq(query.partition!));
     if (query.processKey !== undefined) source = source.where((t) => t.processKey.eq(query.processKey!));
     const total = await source.count();
@@ -37,6 +43,12 @@ export class WorkflowTasks extends IWorkflowTasks {
     return { items: rows.map(detailsOf), total };
   }
 
+  async partitions(query: { readonly status?: readonly TaskStatus[] } = {}): Promise<readonly (string | null)[]> {
+    const statuses = statusesOf(query.status);
+    const rows = await this.db.database.querySqlRaw(`SELECT DISTINCT "partition" FROM "bazis_wf_task_items" WHERE "status" IN (${statuses.map((_, index) => `{${index}}`).join(", ")})`, ...statuses);
+    return rows.map((row) => row.partition as string | null);
+  }
+
   async get(taskId: string): Promise<TaskDetails> {
     return detailsOf(await this.task(taskId, false));
   }
@@ -109,6 +121,26 @@ export class WorkflowTasks extends IWorkflowTasks {
   }
 }
 
+function statusesOf(status: readonly TaskStatus[] | undefined): TaskStatus[] {
+  const statuses = [...(status ?? ["open", "claimed"] as const)];
+  if (statuses.length === 0 || statuses.some((item) => !STATUSES.has(item))) throw new WorkflowError("invalid_input", "status must be open, claimed, completed or cancelled");
+  return statuses;
+}
+
+/** Partitions with the same addressees go together: usually all of them, so the query stays short. */
+function groupByPrincipals(addressees: readonly ScopePrincipals[]): { scopes: (string | null)[]; principals: string[] }[] {
+  const groups = new Map<string, { scopes: (string | null)[]; principals: string[] }>();
+  for (const { scope, principals } of addressees) {
+    if (principals.length === 0) continue;
+    const list = [...new Set(principals)].sort();
+    const key = JSON.stringify(list);
+    const group = groups.get(key);
+    if (group === undefined) groups.set(key, { scopes: [scope], principals: list });
+    else group.scopes.push(scope);
+  }
+  return [...groups.values()];
+}
+
 function notFound(taskId: string): WorkflowError {
   return new WorkflowError("not_found", `Task ${taskId} does not exist`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.129.0",
+  "version": "0.130.0",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",

package/core/workflow/access/WorkflowAccess.ts

@@ -1,52 +0,0 @@
-import type { HttpContext } from "../../http";
-import type { WorkflowActor } from "../contracts/types";
-
-export type WorkflowAction =
-  | "processes.read"
-  | "processes.manage"
-  | "processes.publish"
-  | "instances.start"
-  | "instances.read"
-  | "instances.manage"
-  | "events.emit"
-  | "tasks.work";
-
-/** What an action is about; the fields known for the route. */
-export interface WorkflowAccessTarget {
-  readonly processKey?: string;
-  readonly partition?: string | null;
-  readonly instanceId?: string;
-  readonly taskId?: string;
-}
-
-/**
- * Rights and identity of the workflow HTTP (WORKFLOW-001 §6). The framework's
- * controllers do not know how the application signs people in, so they ask this
- * port. It is the DI token too: register the application's implementation in any
- * module, `DI.singleton(DI.classProvider(WorkflowAccess, AppWorkflowAccess))`.
- * Without one every workflow route answers 403. The services never ask it: the
- * application's code that calls them decides itself.
- */
-export abstract class WorkflowAccess {
-  /** Who makes the request; `undefined` answers 401. */
-  abstract actor(ctx: HttpContext): WorkflowActor | undefined | Promise<WorkflowActor | undefined>;
-
-  /** Whether the actor may do `action` on `target`; `false` answers 403. */
-  abstract can(ctx: HttpContext, action: WorkflowAction, target: WorkflowAccessTarget): boolean | Promise<boolean>;
-
-  /** Whom the user's tasks are addressed to: `user:<id>`, `role:<code>`. */
-  assignees(_ctx: HttpContext, actor: WorkflowActor): readonly string[] | Promise<readonly string[]> {
-    return [`user:${actor.id}`];
-  }
-}
-
-/** The default: nothing is allowed until the application says otherwise. */
-export class DenyWorkflowAccess extends WorkflowAccess {
-  actor(): undefined {
-    return undefined;
-  }
-
-  can(): boolean {
-    return false;
-  }
-}