Skip to content

chore(objectstack): upgrade to 7.6.0 + adopt client.approvals (resume flow); drop dead workflow code#75

Merged
xuyushun441-sys merged 1 commit into
mainfrom
chore/objectstack-7.6-upgrade
Jun 2, 2026
Merged

chore(objectstack): upgrade to 7.6.0 + adopt client.approvals (resume flow); drop dead workflow code#75
xuyushun441-sys merged 1 commit into
mainfrom
chore/objectstack-7.6-upgrade

Conversation

@xuyushun441-sys
Copy link
Copy Markdown
Contributor

Summary

Bump all @objectstack/* 7.5.0 → 7.6.0 (mobile + apps/server).

7.6 removed the dead workflow approval API from the client SDK (client.workflow.approve/reject + Workflow*Response types) and shipped the proper client.approvals namespace (framework #1515). Adapt the app:

  • Rewire useApprovals to client.approvals.{listRequests, getRequest, approve, reject}. Approve/reject now go through POST /api/v1/approvals/requests/:id/{approve,reject} → the service's decide(), which resumes the owning flow run (ADR-0019) and enforces approver authorization — instead of the old data.update(status) workaround that bypassed both. (Closes the workaround flagged in feat(approvals): review screen + cleaner inbox (no raw record id) #74.)
  • Delete the dead workflow clusteruseAutomation, useWorkflowState, WorkflowStatePanel + their tests (unused; superseded by StateMachineViewer / useApprovals / useFlowRuns; broken by the 7.6 client removal). Drop the useAutomation barrel export.

Verification (in-browser, local 7.6 server)

  • tsc --noEmit clean (mobile + server); objectstack validate passes; full jest suite green (1164).
  • ✅ Approvals inbox loads via GET /api/v1/approvals/requests (not data.find).
  • ✅ Approve hits POST /api/v1/approvals/requests/:id/approve (the canonical decide endpoint, not a data PATCH).
  • ✅ Server enforces authorization: a non-approver gets 403 FORBIDDEN ("actor is not a pending approver") — surfaced to the user as an error toast. The old data.update path silently allowed it.

Notes

  • The successful-approve + flow-resume happy path requires a flow-opened request with a resolved approver (pending_approvers is server-managed), which isn't fabricable locally with the bundled draft flows — but the endpoint + authorization path is verified.
  • workflow is still advertised as unavailable in discovery on 7.6 (the workflow CoreServiceName cleanup from #1515 hasn't shipped); harmless, no client refs remain.

🤖 Generated with Claude Code

… workflow code

Bump all @objectstack/* 7.5.0 → 7.6.0 (mobile + apps/server).

7.6 removed the dead workflow approval API from the client SDK
(`client.workflow.approve/reject` + `Workflow*Response` types) and shipped the
proper `client.approvals` namespace (framework #1515). Adapt:

- Rewire useApprovals to `client.approvals.{listRequests,getRequest,approve,
  reject}`. Approve/reject now go through `POST /api/v1/approvals/requests/:id/
  {approve,reject}` → the service's `decide()`, which resumes the owning flow run
  (ADR-0019) and enforces approver authorization — instead of the old
  `data.update(status)` workaround that bypassed both.
- Delete the dead, now-broken workflow cluster (unused, superseded by
  StateMachineViewer / useApprovals / useFlowRuns): useAutomation,
  useWorkflowState, WorkflowStatePanel, and their tests; drop the useAutomation
  barrel export.

Verified in-browser against a local 7.6 server: inbox lists via
`GET /api/v1/approvals/requests`; approve hits `POST .../:id/approve` and the
server enforces approver authorization (403 for a non-approver) — the old
data.update path silently allowed it. typecheck + server validate clean; full
suite green (1164).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@xuyushun441-sys xuyushun441-sys merged commit d8f0df3 into main Jun 2, 2026
1 of 4 checks passed
@xuyushun441-sys xuyushun441-sys deleted the chore/objectstack-7.6-upgrade branch June 2, 2026 07:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants