fix(workflow): ADR-021 code review fixes (8 bugs)

- fix(transmittal): guard duplicate workflow instance on submit()
- fix(workflow-guard): add organizationId to context so Level-2 RBAC works
- fix(circulation): organizationId context passed relation object not INT FK
- fix(transmittal): require Idempotency-Key header on POST submit endpoint
- fix(workflow): userId non-optional in processTransition controller
- fix(circulation): auto-close counts PENDING and IN_PROGRESS tasks
- fix(transmittal): status badge uses workflowState/DRAFT not purpose field
- fix(workflow): log cache invalidation failures instead of swallowing
- fix(workflow): implement getAvailableActions endpoint stub
- fix(i18n): add removeFile key to EN/TH locales
This commit is contained in:
2026-04-17 16:25:51 +07:00
parent 3a5fc8d4af
commit 5977e48e38
10 changed files with 71 additions and 33 deletions
@@ -51,7 +51,7 @@ export class CirculationWorkflowService {
// Context — Circulation เป็น internal document ระดับ Organization (ไม่ผูก contract)
// Guard Level 2 ตรวจ organizationId; Level 2.5 (contract check) จะ skip เมื่อ contractId = null
const context: Record<string, unknown> = {
organizationId: circulation.organization,
organizationId: circulation.organizationId,
creatorId: userId,
};
@@ -325,12 +325,14 @@ export class CirculationService {
await this.routingRepo.save(routing);
// Check: ถ้าทุกคนทำเสร็จแล้ว ให้ปิดใบเวียน (Master)
const pendingCount = await this.routingRepo.count({
where: {
circulationId: routing.circulationId,
status: 'PENDING', // หรือ status ที่ยังไม่เสร็จ
},
});
// Bug 5 fix: นับทั้ง PENDING และ IN_PROGRESS — forceClose() ปิดทั้งสองสถานะ
const pendingCount = await this.routingRepo
.createQueryBuilder('r')
.where('r.circulationId = :cid', { cid: routing.circulationId })
.andWhere('r.status IN (:...statuses)', {
statuses: ['PENDING', 'IN_PROGRESS'],
})
.getCount();
if (pendingCount === 0) {
await this.circulationRepo.update(routing.circulationId, {