create-safest-tools 0.6.0 → 0.7.0

package/template/src/human-tasks.ts

@@ -5,7 +5,6 @@ import { assertOperatorQueueAccess } from "./report-auth";
 import type { OperatorSession } from "./report-types";
 import { validateJsonSchemaValue } from "./workflow-expressions";
 import type { JsonObject, JsonValue } from "./workflow-platform-types";
-import { sendWorkflowEvent } from "./workflow-runs";
 
 function now(): string {
   return new Date().toISOString();
@@ -30,7 +29,7 @@ function parsedObject(value: string): JsonObject {
 
 export async function listHumanTasks(
   db: D1Database,
-  input: { state?: string; queueId?: string; operatorId?: string; allowedQueueIds?: string[] | null; limit: number },
+  input: { state?: string; queueId?: string; reportId?: string; operatorId?: string; allowedQueueIds?: string[] | null; limit: number },
 ): Promise<Record<string, unknown>[]> {
   const timestamp = now();
   await db.batch([
@@ -58,13 +57,14 @@ export async function listHumanTasks(
       ON c.task_id = t.id AND c.released_at IS NULL AND c.expires_at > ?1
     WHERE (?2 IS NULL OR t.state = ?2) AND (?3 IS NULL OR t.queue_id = ?3)
       AND (?4 IS NULL OR t.assigned_operator_id = ?4)
+      AND (?8 IS NULL OR t.report_id = ?8)
       AND (?5 = 1 OR t.queue_id IN (SELECT value FROM json_each(?6)))
     ORDER BY CASE WHEN t.due_at IS NULL THEN 1 ELSE 0 END, t.due_at, t.created_at, t.id
     LIMIT ?7
   `).bind(
     timestamp, input.state ?? null, input.queueId ?? null, input.operatorId ?? null,
     input.allowedQueueIds === null || input.allowedQueueIds === undefined ? 1 : 0,
-    canonicalJson(input.allowedQueueIds ?? []), Math.max(1, Math.min(input.limit, 100)),
+    canonicalJson(input.allowedQueueIds ?? []), Math.max(1, Math.min(input.limit, 100)), input.reportId ?? null,
   ).all<Record<string, unknown>>();
   return rows.results.map((row) => ({
     ...row,
@@ -135,16 +135,20 @@ export async function reassignHumanTask(
   if (!queue) throw new ApiError(409, "human_task_queue_unavailable", "The destination queue is not active.");
   if (!["open", "claimed"].includes(task.state)) throw new ApiError(409, "human_task_not_reassignable", "Only an open or claimed task can be reassigned.");
   const timestamp = now();
-  await db.batch([
-    db.prepare(`UPDATE human_task_claims SET released_at = ?2, release_reason = 'task_reassigned' WHERE task_id = ?1 AND released_at IS NULL`)
-      .bind(taskId, timestamp),
-    db.prepare(`UPDATE human_tasks SET state = 'open', queue_id = ?2, assigned_operator_id = NULL, updated_at = ?3 WHERE id = ?1`)
-      .bind(taskId, queueId, timestamp),
+  const auditId = crypto.randomUUID();
+  const written = await db.batch([
+    db.prepare(`UPDATE human_tasks SET state = 'open', queue_id = ?2, assigned_operator_id = NULL, updated_at = ?3
+      WHERE id = ?1 AND state IN ('open','claimed') AND queue_id IS ?4`)
+      .bind(taskId, queueId, timestamp, task.queueId),
     db.prepare(`
       INSERT INTO audit_events (id, idempotency_key, action, actor_type, actor_id, target_type, target_id, details_json, created_at)
-      VALUES (?1, ?2, 'human_task.reassigned', ?3, ?4, 'human_task', ?5, ?6, ?7)
-    `).bind(crypto.randomUUID(), auditKey, session.actor.type, session.actor.id, taskId, canonicalJson({ previousQueueId: task.queueId, queueId, reason }), timestamp),
+      SELECT ?1, ?2, 'human_task.reassigned', ?3, ?4, 'human_task', ?5, ?6, ?7 WHERE changes() = 1
+    `).bind(auditId, auditKey, session.actor.type, session.actor.id, taskId, canonicalJson({ previousQueueId: task.queueId, queueId, reason }), timestamp),
+    db.prepare(`UPDATE human_task_claims SET released_at = ?2, release_reason = 'task_reassigned'
+      WHERE task_id = ?1 AND released_at IS NULL AND EXISTS (SELECT 1 FROM audit_events WHERE id = ?3)`)
+      .bind(taskId, timestamp, auditId),
   ]);
+  if (written[0]?.meta.changes !== 1) throw new ApiError(409, "human_task_not_reassignable", "This task changed before reassignment. Reload its current state.");
   return { taskId, queueId, state: "open", idempotentReplay: false };
 }
 
@@ -167,16 +171,20 @@ export async function cancelHumanTask(
   }
   if (!["open", "claimed"].includes(task.state)) throw new ApiError(409, "human_task_not_cancellable", "Only an open or claimed task can be cancelled.");
   const timestamp = now();
-  await db.batch([
-    db.prepare(`UPDATE human_task_claims SET released_at = ?2, release_reason = 'task_cancelled' WHERE task_id = ?1 AND released_at IS NULL`)
-      .bind(taskId, timestamp),
-    db.prepare(`UPDATE human_tasks SET state = 'cancelled', assigned_operator_id = NULL, updated_at = ?2 WHERE id = ?1`)
+  const auditId = crypto.randomUUID();
+  const written = await db.batch([
+    db.prepare(`UPDATE human_tasks SET state = 'cancelled', assigned_operator_id = NULL, updated_at = ?2
+      WHERE id = ?1 AND state IN ('open','claimed')`)
       .bind(taskId, timestamp),
     db.prepare(`
       INSERT INTO audit_events (id, idempotency_key, action, actor_type, actor_id, target_type, target_id, details_json, created_at)
-      VALUES (?1, ?2, 'human_task.cancelled', ?3, ?4, 'human_task', ?5, ?6, ?7)
-    `).bind(crypto.randomUUID(), auditKey, session.actor.type, session.actor.id, taskId, canonicalJson({ reason, runId: task.runId }), timestamp),
+      SELECT ?1, ?2, 'human_task.cancelled', ?3, ?4, 'human_task', ?5, ?6, ?7 WHERE changes() = 1
+    `).bind(auditId, auditKey, session.actor.type, session.actor.id, taskId, canonicalJson({ reason, runId: task.runId }), timestamp),
+    db.prepare(`UPDATE human_task_claims SET released_at = ?2, release_reason = 'task_cancelled'
+      WHERE task_id = ?1 AND released_at IS NULL AND EXISTS (SELECT 1 FROM audit_events WHERE id = ?3)`)
+      .bind(taskId, timestamp, auditId),
   ]);
+  if (written[0]?.meta.changes !== 1) throw new ApiError(409, "human_task_not_cancellable", "This task changed before cancellation. Reload its current state.");
   return { taskId, runId: task.runId, state: "cancelled", idempotentReplay: false };
 }
 
@@ -203,12 +211,26 @@ export async function claimHumanTask(
     throw new ApiError(409, "human_task_already_claimed", "The task is already claimed by another operator.");
   }
   const claimId = crypto.randomUUID();
-  await db.batch([
-    db.prepare(`INSERT INTO human_task_claims (id, task_id, operator_id, claimed_at, expires_at) VALUES (?1, ?2, ?3, ?4, ?5)`)
-      .bind(claimId, taskId, session.actor.id, timestamp, expiresAt),
-    db.prepare(`UPDATE human_tasks SET state = 'claimed', assigned_operator_id = ?2, updated_at = ?3 WHERE id = ?1 AND state IN ('open','claimed')`)
-      .bind(taskId, session.actor.id, timestamp),
-  ]);
+  let written: D1Result[];
+  try {
+    written = await db.batch([
+      db.prepare(`
+        INSERT INTO human_task_claims (id, task_id, operator_id, claimed_at, expires_at)
+        SELECT ?1, t.id, ?3, ?4, ?5 FROM human_tasks t
+        WHERE t.id = ?2 AND t.state IN ('open','claimed') AND t.queue_id IS ?6
+          AND (t.due_at IS NULL OR t.due_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+          AND EXISTS (SELECT 1 FROM workflow_runs wr WHERE wr.id = t.run_id AND wr.state NOT IN ('succeeded','failed','terminated','superseded') AND wr.authority_mode IN ('assist','bounded_auto'))
+          AND NOT EXISTS (SELECT 1 FROM human_task_claims c WHERE c.task_id = t.id AND c.released_at IS NULL)
+      `).bind(claimId, taskId, session.actor.id, timestamp, expiresAt, task.queueId),
+      db.prepare(`UPDATE human_tasks SET state = 'claimed', assigned_operator_id = ?2, updated_at = ?3
+        WHERE id = ?1 AND state IN ('open','claimed') AND EXISTS (SELECT 1 FROM human_task_claims WHERE id = ?4)`)
+        .bind(taskId, session.actor.id, timestamp, claimId),
+    ]);
+  } catch (error) {
+    if (String(error).includes("UNIQUE constraint failed: human_task_claims")) throw new ApiError(409, "human_task_already_claimed", "Another reviewer claimed this task. Reload it to see the current owner.");
+    throw error;
+  }
+  if (written[0]?.meta.changes !== 1) throw new ApiError(409, "human_task_not_claimable", "This task changed or reached its deadline. Reload it before claiming.");
   return { claimId, expiresAt };
 }
 
@@ -218,13 +240,16 @@ export async function releaseHumanTaskClaim(
   session: OperatorSession,
 ): Promise<void> {
   const timestamp = now();
-  const released = await db.prepare(`
-    UPDATE human_task_claims SET released_at = ?3, release_reason = 'operator_released'
-    WHERE task_id = ?1 AND operator_id = ?2 AND released_at IS NULL
-  `).bind(taskId, session.actor.id, timestamp).run();
-  if (released.meta.changes !== 1) throw new ApiError(409, "human_task_claim_missing", "You do not hold the active claim for this task.");
-  await db.prepare(`UPDATE human_tasks SET state = 'open', assigned_operator_id = NULL, updated_at = ?2 WHERE id = ?1 AND state = 'claimed'`)
-    .bind(taskId, timestamp).run();
+  const result = await db.batch([
+    db.prepare(`UPDATE human_tasks SET state = 'open', assigned_operator_id = NULL, updated_at = ?3
+      WHERE id = ?1 AND state = 'claimed' AND assigned_operator_id = ?2
+        AND EXISTS (SELECT 1 FROM human_task_claims c WHERE c.task_id = ?1 AND c.operator_id = ?2 AND c.released_at IS NULL)`)
+      .bind(taskId, session.actor.id, timestamp),
+    db.prepare(`UPDATE human_task_claims SET released_at = ?3, release_reason = 'operator_released'
+      WHERE task_id = ?1 AND operator_id = ?2 AND released_at IS NULL`)
+      .bind(taskId, session.actor.id, timestamp),
+  ]);
+  if (result[1]?.meta.changes !== 1) throw new ApiError(409, "human_task_claim_missing", "You do not hold the active claim for this task.");
 }
 
 export async function respondToHumanTask(
@@ -234,17 +259,32 @@ export async function respondToHumanTask(
   session: OperatorSession,
   idempotencyKey: string,
 ): Promise<{ responseId: string; eventId: string; eventDelivered: boolean; idempotentReplay: boolean }> {
+  const response = jsonObject(responseValue);
+  const responseJson = canonicalJson(response);
+  const responseDigest = `sha256:${await sha256(responseJson)}`;
   const existing = await env.DB.prepare(`
-    SELECT r.id, t.run_id AS runId, t.action_proposal_id AS actionProposalId FROM human_task_responses r
-    JOIN human_tasks t ON t.id = r.task_id
+    SELECT r.id, r.task_id AS taskId, r.response_json AS responseJson,
+      r.response_digest AS responseDigest, t.queue_id AS queueId,
+      t.run_id AS runId, t.action_proposal_id AS actionProposalId
+    FROM human_task_responses r JOIN human_tasks t ON t.id = r.task_id
     WHERE r.operator_id = ?1 AND r.idempotency_key = ?2 LIMIT 1
-  `).bind(session.actor.id, idempotencyKey).first<{ id: string; runId: string; actionProposalId: string | null }>();
+  `).bind(session.actor.id, idempotencyKey).first<{
+    id: string; taskId: string; responseJson: string; responseDigest: string;
+    queueId: string | null; runId: string; actionProposalId: string | null;
+  }>();
   if (existing) {
-    const event = await sendWorkflowEvent(env, existing.runId, {
-      eventType: existing.actionProposalId ? `action.${existing.actionProposalId}.resolved` : `task.${taskId}.completed`, eventKey: `task-response:${existing.id}`,
-      sourceType: "operator", sourceId: session.actor.id, payload: { task_id: taskId, response_id: existing.id },
+    if (existing.taskId !== taskId || existing.responseDigest !== responseDigest) {
+      throw new ApiError(409, "idempotency_key_reused", "This submission key belongs to a different task or response. Reload the saved task before submitting changes.");
+    }
+    assertOperatorQueueAccess(session, existing.queueId);
+    const event = await taskCompletionEvent(env.DB, {
+      taskId, responseId: existing.id, response: parsedObject(existing.responseJson),
+      runId: existing.runId, actionProposalId: existing.actionProposalId, operatorId: session.actor.id,
     });
-    return { responseId: existing.id, eventId: event.eventId, eventDelivered: event.delivered, idempotentReplay: true };
+    // Older responses may have committed before their event was recorded.
+    await env.DB.batch(event.statements);
+    const delivered = await enqueueTaskCompletion(env, event);
+    return { responseId: existing.id, eventId: event.id, eventDelivered: delivered, idempotentReplay: true };
   }
   const timestamp = now();
   const task = await env.DB.prepare(`
@@ -265,22 +305,29 @@ export async function respondToHumanTask(
   if (task.state !== "claimed" || task.operatorId !== session.actor.id || !task.claimId || !task.expiresAt || task.expiresAt <= timestamp) {
     throw new ApiError(409, "human_task_claim_required", "A current claim held by this operator is required.");
   }
-  const response = jsonObject(responseValue);
+  if ("decision_code" in response && !session.permissions.decideReports) throw new ApiError(403, "review_decision_permission_denied", "Your role cannot submit a case decision.");
   const errors = validateJsonSchemaValue(response as JsonValue, parsedObject(task.responseSchemaJson));
   if (errors.length) throw new ApiError(422, "human_task_response_schema_invalid", "The task response does not match its published schema.", { errors });
-  const responseJson = canonicalJson(response);
   const responseId = crypto.randomUUID();
   const statements: D1PreparedStatement[] = [
     env.DB.prepare(`
       INSERT INTO human_task_responses (
         id, task_id, claim_id, operator_id, response_json, response_digest,
         idempotency_key, submitted_at
-      ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)
-    `).bind(responseId, taskId, task.claimId, session.actor.id, responseJson, `sha256:${await sha256(responseJson)}`, idempotencyKey, timestamp),
-    env.DB.prepare(`UPDATE human_task_claims SET released_at = ?2, release_reason = 'task_completed' WHERE id = ?1 AND released_at IS NULL`)
-      .bind(task.claimId, timestamp),
-    env.DB.prepare(`UPDATE human_tasks SET state = 'completed', completed_at = ?2, updated_at = ?2 WHERE id = ?1 AND state = 'claimed'`)
-      .bind(taskId, timestamp),
+      ) SELECT ?1, t.id, c.id, ?4, ?5, ?6, ?7, ?8
+      FROM human_tasks t JOIN human_task_claims c ON c.task_id = t.id
+      LEFT JOIN action_proposals p ON p.id = t.action_proposal_id
+      WHERE t.id = ?2 AND c.id = ?3 AND t.state = 'claimed'
+        AND c.operator_id = ?4 AND c.released_at IS NULL
+        AND c.expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+        AND (t.due_at IS NULL OR t.due_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+          AND EXISTS (SELECT 1 FROM workflow_runs wr WHERE wr.id = t.run_id AND wr.state NOT IN ('succeeded','failed','terminated','superseded') AND wr.authority_mode IN ('assist','bounded_auto'))
+        AND (t.action_proposal_id IS NULL OR (p.state = 'approval_required' AND p.payload_digest = ?9))
+    `).bind(responseId, taskId, task.claimId, session.actor.id, responseJson, responseDigest, idempotencyKey, timestamp, task.actionPayloadDigest),
+    env.DB.prepare(`UPDATE human_task_claims SET released_at = ?2, release_reason = 'task_completed' WHERE id = ?1 AND released_at IS NULL AND EXISTS (SELECT 1 FROM human_task_responses WHERE id = ?3)`)
+      .bind(task.claimId, timestamp, responseId),
+    env.DB.prepare(`UPDATE human_tasks SET state = 'completed', completed_at = ?2, updated_at = ?2 WHERE id = ?1 AND state = 'claimed' AND EXISTS (SELECT 1 FROM human_task_responses WHERE id = ?3)`)
+      .bind(taskId, timestamp, responseId),
   ];
   if (task.actionProposalId) {
     if (!session.permissions.approveActions) throw new ApiError(403, "action_approval_permission_denied", "Your role cannot approve or reject actions.");
@@ -293,24 +340,74 @@ export async function respondToHumanTask(
         INSERT INTO action_approvals (
           id, proposal_id, task_id, approver_id, payload_digest,
           decision, reason, idempotency_key, created_at
-        ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
+        ) SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9
+          WHERE EXISTS (SELECT 1 FROM human_task_responses WHERE id = ?10)
       `).bind(
         crypto.randomUUID(), task.actionProposalId, taskId, session.actor.id,
         task.actionPayloadDigest, decision,
         typeof response.reason === "string" ? response.reason : null,
-        idempotencyKey, timestamp,
+        idempotencyKey, timestamp, responseId,
       ),
       env.DB.prepare(`
         UPDATE action_proposals SET state = ?2, updated_at = ?3
-        WHERE id = ?1 AND state = 'approval_required'
-      `).bind(task.actionProposalId, decision, timestamp),
+        WHERE id = ?1 AND state = 'approval_required' AND EXISTS (SELECT 1 FROM human_task_responses WHERE id = ?4)
+      `).bind(task.actionProposalId, decision, timestamp, responseId),
     );
   }
-  await env.DB.batch(statements);
-  const event = await sendWorkflowEvent(env, task.runId, {
-    eventType: task.actionProposalId ? `action.${task.actionProposalId}.resolved` : `task.${taskId}.completed`, eventKey: `task-response:${responseId}`,
-    sourceType: "operator", sourceId: session.actor.id,
-    payload: { task_id: taskId, response_id: responseId, response },
-  });
-  return { responseId, eventId: event.eventId, eventDelivered: event.delivered, idempotentReplay: false };
+  const event = await taskCompletionEvent(env.DB, { taskId, responseId, response, runId: task.runId, actionProposalId: task.actionProposalId, operatorId: session.actor.id });
+  statements.push(...event.statements);
+  let written: D1Result[];
+  try { written = await env.DB.batch(statements); }
+  catch (error) {
+    if (String(error).includes("action_approval_state_changed")) throw new ApiError(409, "action_approval_changed", "The action changed or its authorization expired. Your unsent response is preserved; refresh the task before submitting again.");
+    if (String(error).includes("UNIQUE constraint failed: human_task_responses")) {
+      throw new ApiError(409, "human_task_response_conflict", "This task already has a submitted response. Reload it to see the saved result.");
+    }
+    throw error;
+  }
+  if (written[0]?.meta.changes !== 1) throw new ApiError(409, "human_task_claim_required", "The review claim or approval changed before submission. Reload the task and review its current state.");
+  const delivered = await enqueueTaskCompletion(env, event);
+  return { responseId, eventId: event.id, eventDelivered: delivered, idempotentReplay: false };
+}
+
+async function taskCompletionEvent(db: D1Database, input: {
+  taskId: string; responseId: string; response: JsonObject; runId: string;
+  actionProposalId: string | null; operatorId: string;
+}): Promise<{ id: string; runId: string; statements: D1PreparedStatement[] }> {
+  const eventType = input.actionProposalId ? `action.${input.actionProposalId}.resolved` : `task.${input.taskId}.completed`;
+  const eventKey = `task-response:${input.responseId}`;
+  const existing = await db.prepare(`SELECT id FROM workflow_event_inbox WHERE run_id = ?1 AND event_type = ?2 AND event_key = ?3 LIMIT 1`)
+    .bind(input.runId, eventType, eventKey).first<{ id: string }>();
+  const id = existing?.id ?? eventKey;
+  const payload = canonicalJson({ task_id: input.taskId, response_id: input.responseId, response: input.response });
+  const timestamp = now();
+  return { id, runId: input.runId, statements: [
+    db.prepare(`
+      INSERT OR IGNORE INTO workflow_event_inbox (
+        id, run_id, event_type, event_key, source_type, source_id, payload_json, payload_digest, received_at
+      ) SELECT ?1, ?2, ?3, ?4, 'operator', ?5, ?6, ?7, ?8
+        WHERE EXISTS (SELECT 1 FROM human_task_responses WHERE id = ?9 AND task_id = ?10)
+    `).bind(id, input.runId, eventType, eventKey, input.operatorId, payload, `sha256:${await sha256(payload)}`, timestamp, input.responseId, input.taskId),
+    db.prepare(`
+      INSERT OR IGNORE INTO workflow_dispatch_outbox (
+        id, run_id, operation, event_inbox_id, operation_key, state, available_at, created_at, updated_at
+      ) SELECT id, run_id, 'event', id, ?2, 'pending', ?3, ?3, ?3
+        FROM workflow_event_inbox WHERE id = ?1 AND delivered_at IS NULL
+    `).bind(id, `workflow-event:${input.runId}:${eventType}:${eventKey}`, timestamp),
+    db.prepare(`
+      INSERT OR IGNORE INTO audit_events (
+        id, idempotency_key, action, actor_type, actor_id, target_type, target_id, details_json, created_at
+      ) SELECT ?1, ?2, 'human_task.response_submitted', 'operator_user', ?3, 'human_task', ?4, ?5, ?6
+        WHERE EXISTS (SELECT 1 FROM human_task_responses WHERE id = ?7)
+    `).bind(crypto.randomUUID(), eventKey, input.operatorId, input.taskId, canonicalJson({ runId: input.runId, responseId: input.responseId }), timestamp, input.responseId),
+  ] };
+}
+
+async function enqueueTaskCompletion(env: Env, event: { id: string; runId: string }): Promise<boolean> {
+  const stored = await env.DB.prepare(`SELECT delivered_at FROM workflow_event_inbox WHERE id = ?1`).bind(event.id).first<{ delivered_at: string | null }>();
+  if (stored?.delivered_at) return true;
+  // The response, event and outbox already committed together. Reconciliation
+  // can recover a failed queue send even if the browser never retries.
+  await env.CONTROL_JOBS.send({ version: 1, type: "dispatch_workflow", jobId: `workflow-dispatch:${event.id}`, runId: event.runId, outboxId: event.id }, { contentType: "json" }).catch(() => {});
+  return false;
 }