django-forms-workflows 0.76.6__tar.gz → 0.77.0__tar.gz

{django_forms_workflows-0.76.6 → django_forms_workflows-0.77.0}/CHANGELOG.md

@@ -7,15 +7,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.77.0] - 2026-08-17
+
+Some entries below are marked *(shipped in 0.76.x)* — they describe changes that
+were released earlier but never moved out of `[Unreleased]`, so they are recorded
+here rather than lost.
+
 ### Changed
+- **`@staff_member_required` dropped from the form builder's views.**
+  All 13 views in `form_builder_views.py` no longer carry the decorator.
+  Admin URLs remain gated because `FormDefinitionAdmin.get_urls()` wraps every view in
+  `self.admin_site.admin_view(...)`, which enforces `is_staff`.
+  Any non-admin URL registrations (e.g. `form_builder_urls.py`) must now apply
+  their own staff gating if needed — no change for admin routes. A new
+  `test_..._requires_staff` test per view confirms `admin_view()` alone still
+  gates non-staff access.
+- **Workflow builder state moved behind a store.** `createWorkflowBuilderStore()`
+  is now the single owner of builder state, and `workflow-builder-api.js` was
+  extracted out of `workflow-builder.js`, so node/connection mutations go through
+  the store's setters instead of touching module-level state directly.
+- **Dependency bumps.** The pip group (15 updates) and `postcss`, via Dependabot.
 - **Form builder save logic factored into a standalone helper.**
+  *(shipped in 0.76.1)*
   `form_builder_save`'s create/update logic for `FormDefinition` and its
   `FormField`s now lives in `save_form_definition_from_builder_data()`,
   mirroring the existing `convert_visual_to_workflow` split already used by
   the workflow builder. Makes the logic callable (and unit-testable)
   independently of the `@staff_member_required`-decorated HTTP view — no
   behavior or API change.
-- **Notification rules identify their workflow in the admin.** The standalone
+- **Notification rules identify their workflow in the admin.** *(shipped in
+  0.76.0)* The standalone
   `NotificationRule` list rendered only `workflow.form_definition.name`, so a
   rule on a parent workflow and a rule on its sub-workflow both displayed the
   same form name — and for workflow-level rules the Stage column reads
@@ -28,7 +49,52 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   label so every FK picker, autocomplete result, and log entry disambiguates.
 
 ### Fixed
-- **Browser value suggestions restored on generic text fields.** The
+- **A failing notification rule no longer silences the rest of its event.**
+  `send_notification_rules` ran every matching rule in one unguarded loop, so a
+  single exception aborted the task and every remaining rule with it — and left
+  nothing behind, because `NotificationLog` rows are only written by the send
+  helpers further down. Each rule's body moved into `_apply_rule()` and the loop
+  now isolates it: a raising rule is logged with a traceback, records a
+  `status="failed"` `NotificationLog` row naming the rule and exception, and the
+  next rule still runs. This is the amplifier that turned the file-upload
+  `TypeError` below into a total blackout rather than one missing email.
+- **`ApprovalTask.reminder_sent_at` now reflects a reminder that was actually
+  dispatched.** `check_approval_deadlines` stamped it immediately after
+  `send_notification_rules.delay(...)`, but enqueuing is not sending — a task
+  lost in the broker or killed mid-flight left the reminder permanently recorded
+  as sent and never retried, with no log row to contradict it. The stamp moved
+  into `send_notification_rules`, applied once the dispatch runs to completion.
+  Completing with zero recipients still stamps, so a workflow with no reminder
+  rule doesn't re-dispatch on every sweep; a crash leaves it unset so the next
+  sweep retries, and duplicate sends are absorbed by the existing `already_sent`
+  idempotency guard. **Behaviour change:** reminders are now retried until a
+  dispatch completes, where previously they were attempted exactly once.
+- **File-upload fields no longer silence every notification for a submission.**
+  Subject answer-piping (added in 0.54.0) stringified each `form_data` value with
+  `", ".join(v) if isinstance(v, list) else str(v)`. A multi-file upload field
+  stores a *list of dicts*, so the join raised
+  `TypeError: sequence item 0: expected str instance, dict found`. That happens
+  while building `_pipe_vars` — before any email is sent and before any
+  `NotificationLog` row is written — so `send_notification_rules` died with no
+  email, no log row, and not even a `status="failed"` record. `@shared_task`
+  carries no autoretry, so the notification was lost permanently, and since
+  `form_data` is identical for every event, *all* events for that submission
+  (`submission_received`, `approval_request`, `approval_reminder`, …) failed the
+  same way — a silent, total blackout. The blackout was invisible from the data,
+  because `check_approval_deadlines` stamped `ApprovalTask.reminder_sent_at` right
+  after a successful `.delay()`, so reminders looked sent while the worker crash
+  happened later (see the `reminder_sent_at` entry above, which closes that gap).
+  Values are now stringified by `_pipe_value()`, which renders file dicts
+  as their filename (matching `_export_xlsx`), recurses into lists, coerces
+  non-string members, and never raises. The piping token itself was never the
+  trigger — any file field present in `form_data` was enough, whether or not the
+  subject referenced it.
+- **Workflow builder store-wiring fixes.** `createNode` / `createStartNode` and
+  `finishConnection` bypassed the store's setter and mutated state directly, and
+  the checkbox change handler stored the raw `"on"` string instead of a boolean.
+  Regression coverage was added alongside the fixes.
+- **Browser value suggestions restored on generic text fields.** *(shipped in
+  0.76.3)* The
   password-manager opt-out added in 0.74.15 set `autocomplete="off"` alongside
   the `data-1p-ignore` / `data-lpignore` / `data-bwignore` / `data-form-type`
   attributes on every field type in `_PM_OPT_OUT_FIELD_TYPES`. Those `data-*`
@@ -39,7 +105,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   native suggestions work again while password-manager popovers stay
   suppressed. Fields with their own suggestion UI (LDAP lookup) are unaffected
   — `ldap-lookup.js` sets `autocomplete="off"` on them directly.
-- **Diff and sync summaries no longer ignore sub-workflows.** `_build_summary`
+- **Diff and sync summaries no longer ignore sub-workflows.** *(shipped in
+  0.76.3)* `_build_summary`
   read only the `"workflow"` key, but `serialize_form` stores the first
   workflow there and every other one under `"additional_workflows"`. A
   sub-workflow's stages, settings, and notification rules were therefore
@@ -1890,7 +1957,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - psycopg2-binary >= 2.9 (for PostgreSQL)
 - mysqlclient >= 2.2 (for MySQL)
 
-[Unreleased]: https://github.com/opensensor/django-forms-workflows/compare/v0.2.2...HEAD
+[Unreleased]: https://github.com/opensensor/django-forms-workflows/compare/v0.77.0...HEAD
+[0.77.0]: https://github.com/opensensor/django-forms-workflows/compare/v0.76.6...v0.77.0
 [0.2.2]: https://github.com/opensensor/django-forms-workflows/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/opensensor/django-forms-workflows/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/opensensor/django-forms-workflows/compare/v0.1.0...v0.2.0

{django_forms_workflows-0.76.6 → django_forms_workflows-0.77.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-forms-workflows
-Version: 0.76.6
+Version: 0.77.0
 Summary: Enterprise-grade, database-driven form builder with approval workflows and external data integration
 License: LGPL-3.0-only
 License-File: LICENSE

{django_forms_workflows-0.76.6 → django_forms_workflows-0.77.0}/django_forms_workflows/form_builder_views.py

@@ -9,7 +9,6 @@ import json
 import logging
 import uuid
 
-from django.contrib.admin.views.decorators import staff_member_required
 from django.db import transaction
 from django.http import JsonResponse
 from django.shortcuts import get_object_or_404, render
@@ -31,7 +30,6 @@ from .models import (
 logger = logging.getLogger(__name__)
 
 
-@staff_member_required
 @require_GET
 def form_builder_templates(request):
     """
@@ -64,7 +62,6 @@ def form_builder_templates(request):
     )
 
 
-@staff_member_required
 @require_GET
 def form_builder_load_template(request, template_id):
     """
@@ -85,7 +82,6 @@ def form_builder_load_template(request, template_id):
     )
 
 
-@staff_member_required
 @require_POST
 def form_builder_clone(request, form_id):
     """
@@ -228,7 +224,6 @@ def form_builder_clone(request, form_id):
         )
 
 
-@staff_member_required
 @require_GET
 def form_builder_view(request, form_id=None):
     """
@@ -273,7 +268,6 @@ def form_builder_view(request, form_id=None):
     return render(request, "admin/django_forms_workflows/form_builder.html", context)
 
 
-@staff_member_required
 @require_GET
 def form_builder_load(request, form_id):
     """
@@ -358,7 +352,6 @@ def form_builder_load(request, form_id):
     return JsonResponse(form_data)
 
 
-@staff_member_required
 @require_POST
 def form_builder_save(request):
     """
@@ -610,7 +603,6 @@ def save_form_definition_from_builder_data(data, user, form_definition=None):
     return form_definition, field_id_mapping
 
 
-@staff_member_required
 @require_POST
 def form_builder_preview(request):
     """
@@ -771,7 +763,6 @@ def form_builder_preview(request):
 # ---------------------------------------------------------------------------
 
 
-@staff_member_required
 @require_GET
 def document_template_list(request, form_id):
     """List document templates for a form."""
@@ -797,7 +788,6 @@ def document_template_list(request, form_id):
     )
 
 
-@staff_member_required
 @require_POST
 def document_template_save(request, form_id):
     """Create or update a document template."""
@@ -856,7 +846,6 @@ def document_template_save(request, form_id):
         )
 
 
-@staff_member_required
 @require_POST
 def document_template_delete(request, form_id, template_id):
     """Delete a document template."""
@@ -872,7 +861,6 @@ def document_template_delete(request, form_id, template_id):
 # ---------------------------------------------------------------------------
 
 
-@staff_member_required
 @require_GET
 def shared_option_list_api(request):
     """List all shared option lists (for form builder dropdowns)."""
@@ -893,7 +881,6 @@ def shared_option_list_api(request):
     )
 
 
-@staff_member_required
 @require_POST
 def shared_option_list_save(request):
     """Create or update a shared option list."""
@@ -936,7 +923,6 @@ def shared_option_list_save(request):
         )
 
 
-@staff_member_required
 @require_POST
 def shared_option_list_delete(request, list_id):
     """Delete a shared option list."""

django_forms_workflows-0.77.0/django_forms_workflows/static/django_forms_workflows/js/workflow-builder-api.js

@@ -0,0 +1,184 @@
+/**
+ * API client for the Workflow Builder: loading/saving the workflow
+ * definition, plus save-status and dirty-tracking bookkeeping around those
+ * two calls.
+ *
+ * Mixed onto WorkflowBuilder.prototype in workflow-builder.js
+ * (Object.assign), not a standalone class of its own - these methods read/
+ * write `this.nodes`/`this.connections`/`this.config` directly, plus call
+ * back into validation/canvas methods (refreshValidationState/selectNode/
+ * initializeNodeStackOrder/layoutNeedsNormalization/autoArrangeNodes/
+ * setBuilderMessage) that still live on the single WorkflowBuilder
+ * instance. Mirrors form-builder-api.js's shape/scope.
+ */
+export const apiMethods = {
+    setSaveStatus(text, tone = 'neutral') {
+        const status = document.getElementById('saveStatus');
+        if (!status) return;
+        status.textContent = text;
+        status.dataset.tone = tone;
+    },
+
+    getWorkflowSnapshot() {
+        return this.store.snapshot();
+    },
+
+    syncSavedWorkflowSnapshot() {
+        this.lastSavedWorkflowSnapshot = this.getWorkflowSnapshot();
+        this.updateDirtyState();
+    },
+
+    updateDirtyState() {
+        this.isDirty = this.lastSavedWorkflowSnapshot !== null
+            && this.getWorkflowSnapshot() !== this.lastSavedWorkflowSnapshot;
+        this.updateDirtyIndicator();
+    },
+
+    updateDirtyIndicator() {
+        const badge = document.getElementById('dirtyIndicator');
+        if (badge) {
+            badge.hidden = !this.isDirty;
+        }
+
+        if (!this.isSaving) {
+            if (this.isDirty) {
+                this.setSaveStatus('Unsaved changes', 'warning');
+            } else {
+                this.setSaveStatus('Ready', 'neutral');
+            }
+        }
+    },
+
+    async loadWorkflow() {
+        try {
+            console.log('Loading workflow from:', this.config.apiUrls.load);
+            const response = await fetch(this.config.apiUrls.load);
+            const data = await response.json();
+
+            console.log('Workflow data received:', data);
+
+            if (data.success) {
+                this.nodes = data.workflow.nodes || [];
+                this.connections = data.workflow.connections || [];
+                this.fields = data.fields || [];
+                this.groups = data.groups || [];
+                this.forms = data.forms || [];
+                this.workflowTargets = data.workflow_targets || [];
+
+                console.log('Loaded nodes:', this.nodes);
+                console.log('Loaded connections:', this.connections);
+                console.log('Available forms:', this.forms);
+
+                // Update node ID counter
+                if (this.nodes.length > 0) {
+                    this.store.seedNodeIdCounterFromNodes(this.nodes);
+                }
+
+                this.initializeNodeStackOrder();
+                if (this.layoutNeedsNormalization()) {
+                    this.autoArrangeNodes({ suppressRender: true, silent: true });
+                }
+            } else {
+                console.error('Failed to load workflow:', data.error);
+                this.setBuilderMessage('danger', 'Failed to load workflow builder data.', [data.error || 'Unknown error']);
+            }
+        } catch (error) {
+            console.error('Error loading workflow:', error);
+            this.setBuilderMessage('danger', 'Failed to load workflow builder data.', [error.message || 'Unknown error']);
+        }
+    },
+
+    async saveWorkflow() {
+        const validation = this.refreshValidationState();
+        if (validation.errors.length) {
+            this.setSaveStatus('Fix validation errors', 'danger');
+            this.setBuilderMessage(
+                'danger',
+                'Fix validation errors before saving.',
+                validation.errors
+            );
+            if (validation.firstErrorNodeId) {
+                this.selectNode(validation.firstErrorNodeId);
+            }
+            return;
+        }
+
+        const saveBtn = document.getElementById('btnSave');
+        const originalText = saveBtn.innerHTML;
+        this.isSaving = true;
+        saveBtn.disabled = true;
+        saveBtn.innerHTML = '<i class="bi bi-hourglass-split"></i> Saving...';
+        this.setSaveStatus('Saving...', 'info');
+        this.setBuilderMessage(
+            validation.warnings.length ? 'warning' : 'info',
+            validation.warnings.length
+                ? 'Saving workflow with warnings.'
+                : 'Saving workflow…',
+            validation.warnings
+        );
+
+        const workflowData = {
+            form_id: this.config.formId,
+            workflow_id: this.config.currentWorkflowId,
+            workflow: {
+                nodes: this.nodes,
+                connections: this.connections
+            }
+        };
+
+        console.log('Saving workflow data:', workflowData);
+        console.log('Nodes:', this.nodes);
+        console.log('Connections:', this.connections);
+
+        try {
+            const response = await fetch(this.config.apiUrls.save, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-CSRFToken': this.config.csrfToken
+                },
+                body: JSON.stringify(workflowData)
+            });
+
+            console.log('Response status:', response.status);
+            console.log('Response ok:', response.ok);
+
+            const result = await response.json();
+            console.log('Response data:', result);
+
+            if (!response.ok || !result.success) {
+                const error = new Error(result.error || 'Failed to save workflow');
+                error.details = result.errors || [];
+                throw error;
+            }
+
+            if (result.workflow_id) {
+                this.config.currentWorkflowId = result.workflow_id;
+            }
+
+            this.syncSavedWorkflowSnapshot();
+            this.setSaveStatus('Saved successfully', 'success');
+            this.setBuilderMessage(
+                'success',
+                'Workflow saved successfully.',
+                validation.warnings.length ? ['Saved with non-blocking warnings shown below.'] : [],
+                true
+            );
+            setTimeout(() => {
+                this.setSaveStatus('Ready', 'neutral');
+            }, 2000);
+        } catch (error) {
+            console.error('Error saving workflow:', error);
+            this.setBuilderMessage(
+                'danger',
+                `Failed to save workflow: ${error.message}`,
+                error.details || []
+            );
+            this.setSaveStatus('Error saving', 'danger');
+        } finally {
+            this.isSaving = false;
+            saveBtn.disabled = false;
+            saveBtn.innerHTML = originalText;
+        }
+    },
+};

django_forms_workflows-0.77.0/django_forms_workflows/static/django_forms_workflows/js/workflow-builder-store.js

@@ -0,0 +1,56 @@
+/**
+ * Single owner of Workflow Builder state, shared across extracted modules.
+ * Factory (not a singleton) since admin inlines can put two builders on one
+ * page. Extends EventTarget so modules can react to changes instead of
+ * closing over the whole WorkflowBuilder instance. Mirrors
+ * form-builder-store.js's BuilderStore/createBuilderStore shape.
+ */
+export class WorkflowBuilderStore extends EventTarget {
+    constructor({ nodes = [], connections = [], nodeIdCounter = 1 } = {}) {
+        super();
+        this.nodes = nodes;
+        this.connections = connections;
+        this.nodeIdCounter = nodeIdCounter;
+    }
+
+    setNodes(nodes) {
+        this.nodes = nodes;
+        this.dispatchEvent(new CustomEvent('nodes-changed', { detail: { nodes } }));
+    }
+
+    setConnections(connections) {
+        this.connections = connections;
+        this.dispatchEvent(new CustomEvent('connections-changed', { detail: { connections } }));
+    }
+
+    nextNodeId() {
+        const id = `node_${this.nodeIdCounter}`;
+        this.nodeIdCounter += 1;
+        return id;
+    }
+
+    // Mirrors loadWorkflow()'s existing node-id-counter-seeding logic (and
+    // form-builder-store.js's seedFieldIdCounterFromFields) — call after
+    // loading nodes from a workflow so newly-generated ids can't collide.
+    seedNodeIdCounterFromNodes(nodes) {
+        const highest = nodes.reduce((max, node) => {
+            const match = /node_(\d+)/.exec(node.id || '');
+            return match ? Math.max(max, parseInt(match[1], 10)) : max;
+        }, 0);
+        this.nodeIdCounter = highest + 1;
+    }
+
+    snapshot() {
+        return JSON.stringify({ nodes: this.nodes, connections: this.connections });
+    }
+
+    restore(snapshotJson) {
+        const { nodes, connections } = JSON.parse(snapshotJson);
+        this.setNodes(nodes);
+        this.setConnections(connections);
+    }
+}
+
+export function createWorkflowBuilderStore(initial) {
+    return new WorkflowBuilderStore(initial);
+}