690419:1329 feat: update CI/CD to use SSH key authentication #04
This commit is contained in:
@@ -214,19 +214,25 @@ export interface WorkflowTransitionWithAttachmentsDto {
|
||||
│
|
||||
▼
|
||||
[User clicks Approve/Reject/Return]
|
||||
→ use-workflow-action hook:
|
||||
1. Generates Idempotency-Key (UUIDv7)
|
||||
2. POST /workflow-engine/instances/:id/transition
|
||||
→ use-workflow-action hook (client-side guard):
|
||||
1. ❗️ ตรวจสอบ currentState ∈ {PENDING_REVIEW, PENDING_APPROVAL}
|
||||
└ ถ้าไม่ใช่ → ไม่ส่ง API (ปุ่ม disabled ไว้แล้ว)
|
||||
2. Generates Idempotency-Key (UUIDv7)
|
||||
3. POST /workflow-engine/instances/:id/transition
|
||||
Header: Idempotency-Key
|
||||
Body: { action, comment, attachmentPublicIds: [uuid1, uuid2] }
|
||||
│
|
||||
▼
|
||||
[WorkflowTransitionGuard] — RBAC check (4.5-Level: Superadmin / Org Admin / Level 2.5 Contract Membership / Assigned Handler)
|
||||
[WorkflowTransitionGuard] — RBAC check (4-Level: Superadmin / Org Admin / Contract Member / Assigned Handler)
|
||||
│ pass
|
||||
▼
|
||||
[WorkflowEngineService.processTransition()]
|
||||
→ Check Redis idempotency key (return cached if duplicate)
|
||||
→ ❗️ Server-side state check: currentState ∈ {PENDING_REVIEW, PENDING_APPROVAL}
|
||||
└ ถ้าไม่ใช่ → throw HTTP 409 Conflict "ไม่สามารถอัปโหลดในสถานะนี้" (Clarify Q1)
|
||||
→ Acquire Redis Redlock on instanceId
|
||||
└ Retry 3x (500ms exponential backoff)
|
||||
└ ถ้า Redis ล่ม / Lock ไม่ได้ → throw HTTP 503 "Service temporarily unavailable" (Clarify Q2 Fail-closed)
|
||||
→ Begin DB Transaction:
|
||||
1. Lock WorkflowInstance (pessimistic_write)
|
||||
2. Evaluate DSL transition
|
||||
@@ -246,6 +252,7 @@ export interface WorkflowTransitionWithAttachmentsDto {
|
||||
│
|
||||
▼
|
||||
[Frontend: invalidate TanStack Query cache → reload document + timeline]
|
||||
→ HTTP 503 → แสดง toast "ระบบยุ่ง กรุณาลองใหม่" (user may retry)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
@@ -23,7 +23,7 @@
|
||||
**Testing**: Jest (backend unit + e2e), Vitest (frontend)
|
||||
**Target Platform**: QNAP Container Station (Docker), Browser (Chrome/Edge latest)
|
||||
**Project Type**: Web application (backend/ + frontend/ monorepo)
|
||||
**Performance Goals**: Workflow history + attachment join query < 200ms p95 (mitigated by Redis Cache TTL 1h)
|
||||
**Performance Goals**: (1) Workflow history + attachment join query < 200ms p95 (mitigated by Redis Cache TTL 1h); (2) `POST /instances/:id/transition` (พร้อม file) P95 ≤ 5 วินาที สำหรับ file ≤ 10MB (รวม ClamAV + Redlock + DB transaction) — Clarify Q4
|
||||
**Constraints**: No TypeORM migrations (ADR-009); UUID via `publicId` only (ADR-019); ClamAV scan mandatory (ADR-016); BullMQ for all async jobs (ADR-008)
|
||||
**Scale/Scope**: ~50 concurrent users, documents in hundreds per project
|
||||
|
||||
@@ -45,7 +45,8 @@ _GATE: Checked against `.windsurfrules` before Phase 0. Re-verified after Phase
|
||||
| **🔴 No `any` types** | ✅ PASS | All new types fully typed — see data-model.md |
|
||||
| **🟡 Thin Controller** | ✅ PASS | Controller delegates to Service; Guard handles RBAC |
|
||||
| **🟡 Test Coverage 80% business logic** | ⚠️ REQUIRED | See testing plan in Phase 3 |
|
||||
| **🔴 Redis Redlock (ADR-002)** | ✅ PASS | Redlock applied to `instanceId` during `processTransition()` — existing pattern extended |
|
||||
| **🔴 Redis Redlock (ADR-002)** | ✅ PASS | Redlock applied to `instanceId` during `processTransition()` — Fail-closed: Retry 3x (500ms exponential backoff) → HTTP 503 if Redis unavailable (Clarify Q2) |
|
||||
| **🔴 Upload State Restriction** | ✅ PASS | Step-attachment upload permitted only in `PENDING_REVIEW`/`PENDING_APPROVAL`; Terminal states (`APPROVED`,`REJECTED`,`CLOSED`) → HTTP 409 (Clarify Q1) |
|
||||
|
||||
---
|
||||
|
||||
@@ -109,10 +110,10 @@ frontend/hooks/
|
||||
└── use-workflow-action.ts [NEW — upload + transition orchestration]
|
||||
|
||||
# 🟡 Frontend — Page Refactors (use new components)
|
||||
frontend/app/(dashboard)/rfas/[uuid]/page.tsx [MODIFY — integrate IntegratedBanner + WorkflowLifecycle]
|
||||
frontend/app/(dashboard)/correspondences/[uuid]/page.tsx [MODIFY — same]
|
||||
frontend/app/(dashboard)/transmittals/[uuid]/page.tsx [MODIFY — same as RFA/Correspondence]
|
||||
frontend/app/(dashboard)/circulation/[uuid]/page.tsx [MODIFY — same as RFA/Correspondence]
|
||||
frontend/app/(dashboard)/rfas/[uuid]/page.tsx [MODIFY — integrate IntegratedBanner + WorkflowLifecycle]
|
||||
frontend/app/(dashboard)/transmittals/[uuid]/page.tsx [MODIFY — same as RFA]
|
||||
frontend/app/(dashboard)/circulation/[uuid]/page.tsx [MODIFY — same as RFA]
|
||||
# ⛔ OUT OF SCOPE (v1.8.6): correspondences/[uuid]/page.tsx — Correspondence ใช้ Circulation เป็น Routing Vehicle (Clarify Q3)
|
||||
```
|
||||
|
||||
---
|
||||
@@ -178,10 +179,12 @@ Response: WorkflowHistoryItem[] with nested attachments[] per step
|
||||
```
|
||||
<IntegratedBanner document={doc} workflowInstance={instance} onAction={...} />
|
||||
└── uses: <PriorityBadge />, <StatusBadge />, <WorkflowActionButtons />
|
||||
└── WorkflowActionButtons: disabled เมื่อ currentState ∈ {APPROVED, REJECTED, CLOSED}
|
||||
|
||||
<WorkflowLifecycle instance={instance} onFileClick={openPreview} />
|
||||
└── vertical timeline, Indigo active step (pulse animation)
|
||||
└── each step: StepCard with date, actor, comment, attachments[]
|
||||
└── Drag & Drop zone: แสดงเฉพาะเมื่อ currentState ∈ {PENDING_REVIEW, PENDING_APPROVAL}
|
||||
|
||||
<FilePreviewModal file={attachment} onClose={...} />
|
||||
└── PDF: <iframe src="/api/files/preview/:publicId" />
|
||||
@@ -190,9 +193,13 @@ Response: WorkflowHistoryItem[] with nested attachments[] per step
|
||||
|
||||
**`use-workflow-action` hook responsibilities:**
|
||||
1. Validate `Idempotency-Key` (generate UUIDv7 once per action intent)
|
||||
2. Ensure all `attachmentPublicIds` are committed (not temp) before transition
|
||||
3. Call `POST /instances/:id/transition` with `Idempotency-Key` header
|
||||
4. Invalidate TanStack Query cache for the document + workflow instance
|
||||
2. Guard: ตรวจสอบว่า `currentState ∈ {PENDING_REVIEW, PENDING_APPROVAL}` ก่อน transition (client-side guard)
|
||||
3. Ensure all `attachmentPublicIds` are committed (not temp) before transition
|
||||
4. Call `POST /instances/:id/transition` with `Idempotency-Key` header
|
||||
5. Handle HTTP 503 (Redlock unavailable) → แสดง toast "ระบบยุ่ง กรุณาลองใหม่"
|
||||
6. Invalidate TanStack Query cache for the document + workflow instance
|
||||
|
||||
**Modules in scope (v1.8.6):** RFA, Transmittal, Circulation — ไม่รวม Correspondence (Clarify Q3)
|
||||
|
||||
---
|
||||
|
||||
@@ -222,9 +229,9 @@ Response: WorkflowHistoryItem[] with nested attachments[] per step
|
||||
| F5 | Create `WorkflowLifecycle` component (vertical timeline) | `components/workflow/workflow-lifecycle.tsx` | F1 |
|
||||
| F6 | Create `FilePreviewModal` component | `components/common/file-preview-modal.tsx` | F1 |
|
||||
| F7 | Refactor RFA detail page — integrate new components | `rfas/[uuid]/page.tsx` | F3–F6 |
|
||||
| F8 | Refactor Correspondence detail page — integrate new components | `correspondences/[uuid]/page.tsx` | F3–F6 |
|
||||
| F9 | Refactor Transmittal detail page — integrate new components | `transmittals/[uuid]/page.tsx` | F3–F6 |
|
||||
| F10 | Refactor Circulation detail page — integrate new components | `circulation/[uuid]/page.tsx` | F3–F6 |
|
||||
| F8 | Refactor Transmittal detail page — integrate new components | `transmittals/[uuid]/page.tsx` | F3–F6 |
|
||||
| F9 | Refactor Circulation detail page — integrate new components | `circulation/[uuid]/page.tsx` | F3–F6 |
|
||||
| ~~F10~~ | ~~Correspondence~~ | **OUT OF SCOPE v1.8.6** — Clarify Q3 | — |
|
||||
|
||||
### 🟢 GUIDELINES (after F7/F8)
|
||||
|
||||
@@ -278,6 +285,11 @@ cd frontend && pnpm test --run # Vitest
|
||||
- [ ] Unauthorized user (not handler, not admin) → `403 Forbidden`
|
||||
- [ ] ClamAV test file (EICAR) upload → blocked before transition
|
||||
- [ ] `attachmentPublicIds` with non-temp (already-committed) UUID → rejected
|
||||
- [ ] Upload attempt when `currentState = APPROVED/REJECTED/CLOSED` → `409 Conflict` (Clarify Q1)
|
||||
- [ ] Transition when Redis unavailable (mock Redis down) → retry 3x then `503 Service Unavailable` (Clarify Q2)
|
||||
|
||||
### Definition of Done Reference
|
||||
ดู DoD Observable Outcomes ต่อ REQ ใน [ADR-021 §9.1](../../06-Decision-Records/ADR-021-integrated-workflow-context.md%20.md#definition-of-done-observable-outcomes)
|
||||
|
||||
---
|
||||
|
||||
|
||||
@@ -201,6 +201,61 @@ The existing component is **horizontal** layout. ADR-021 §3.2 requires **Vertic
|
||||
|
||||
---
|
||||
|
||||
## Research Question 10: Redis Redlock Failure Mode During Transition
|
||||
|
||||
**Question:** If Redis is unreachable or Redlock cannot be acquired, should the system fail-open (allow transition) or fail-closed (block transition)?
|
||||
|
||||
**Context (Clarify Q2):** In DMS, a race condition that creates duplicate approvals is worse than temporary service unavailability. Incorrect document state corrupts audit trails and may have legal/contractual consequences.
|
||||
|
||||
### Option A: Fail-open (Rejected ❌)
|
||||
Allow transition even without a lock. Accepts Race Condition risk.
|
||||
- **Con:** Two concurrent approvals possible — violates document integrity.
|
||||
|
||||
### Option B: Retry then fail-open (Rejected ❌)
|
||||
Retry 3x then allow anyway.
|
||||
- **Con:** Still permits race condition under high load.
|
||||
|
||||
### Option C: Fail-closed — Retry then HTTP 503 (Selected ✅)
|
||||
Retry 3x with 500ms exponential backoff → if still unavailable → throw HTTP 503.
|
||||
- **Pro:** Data integrity preserved at all times.
|
||||
- **Pro:** HTTP 503 is a retryable error — client can display toast and user can retry manually.
|
||||
- **Con:** Temporary service degradation during Redis outage (~50 concurrent users; outage rare).
|
||||
|
||||
**Decision:** Option C — Fail-closed.
|
||||
**Implementation:**
|
||||
```typescript
|
||||
// ใน WorkflowEngineService.processTransition()
|
||||
// ลอง Acquire Redlock สูงสุด 3 ครั้ง
|
||||
const MAX_LOCK_RETRIES = 3;
|
||||
const LOCK_BACKOFF_MS = 500;
|
||||
|
||||
for (let attempt = 1; attempt <= MAX_LOCK_RETRIES; attempt++) {
|
||||
try {
|
||||
lock = await this.redlock.acquire([`lock:wf:${instanceId}`], 10000);
|
||||
break; // สำเร็จ
|
||||
} catch {
|
||||
if (attempt === MAX_LOCK_RETRIES) {
|
||||
throw new ServiceUnavailableException('ระบบยุ่งชั่วคราว กรุณาลองใหม่ภายหลัง');
|
||||
}
|
||||
await sleep(LOCK_BACKOFF_MS * attempt); // exponential backoff
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Research Question 11: Upload-Permitted States
|
||||
|
||||
**Question:** Which workflow states allow step-attachment upload? (Clarify Q1)
|
||||
|
||||
**Decision:** Upload permitted ONLY in `PENDING_REVIEW` and `PENDING_APPROVAL`.
|
||||
|
||||
**Rationale:** Attachments are decision-support evidence. After a terminal decision (`APPROVED`, `REJECTED`, `CLOSED`), adding attachments retroactively would contaminate the audit trail.
|
||||
|
||||
**Implementation:** Both client-side guard (disable upload UI) AND server-side validation in `processTransition()` before acquiring Redlock.
|
||||
|
||||
---
|
||||
|
||||
## Summary of All Decisions
|
||||
|
||||
| # | Decision | Chosen | Rejected |
|
||||
@@ -214,3 +269,6 @@ The existing component is **horizontal** layout. ADR-021 §3.2 requires **Vertic
|
||||
| 7 | Transition RBAC | New `WorkflowTransitionGuard` 4-Level | Extend existing `RbacGuard` |
|
||||
| 8 | Priority display | Tailwind badges from `instance.context.priority` | Hardcoded status |
|
||||
| 9 | File preview security | `Content-Disposition: inline` + permission check | Direct storage URL |
|
||||
| 10 | Redlock failure mode | Fail-closed: Retry 3x (500ms backoff) → HTTP 503 | Fail-open |
|
||||
| 11 | Upload-permitted states | `PENDING_REVIEW`, `PENDING_APPROVAL` only | All non-terminal states |
|
||||
| 12 | Module scope (v1.8.6) | RFA, Transmittal, Circulation | Including Correspondence |
|
||||
|
||||
Reference in New Issue
Block a user