test(dogfood): pin the approval override composite on a real booted app (#17047)

* test(dogfood): pin the approval override composite on a real booted app

Nothing in this repository pinned the CONJUNCTION of a served `viewer`
block, served `sys_approval_request` action metadata, and a CEL verdict
evaluating one against the other, on a real booted app — each gate was
individually observable somewhere, but a change to any one of the three
could silently break the platform-admin override with every existing
test green.

Adds a purpose-built dogfood fixture (one object, one autolaunched
`approval` flow routed to a permanently-unstaffed position) and a pin
that: a plain member submits a record, opens a stranded approval; the
platform admin reads the request on both `getRequest`/`listRequests`
faces and asserts the served viewer is exactly
`{can_act:false, is_submitter:false, can_override:true}`; reads the
served `sys_approval_request` action metadata; and evaluates the served
predicates against the served viewer with `@objectstack/formula`'s
`celEngine`, asserting the four override levers (approve/reject/
reassign/recall) visible=true AND the four secondary/submitter levers
visible=false.

Also fixes `resolve.alias` in this package's `vitest.config.ts`: at the
ROOT of the config it is silently NOT inherited by `test.projects[]` on
Vitest 4.1.10 (measured — a deliberately broken replacement path still
resolved through `dist/` with zero errors), so the pre-existing
`@objectstack/metadata-core` / `@objectstack/driver-turso` aliases were
already inert at runtime despite reading as live to
`check-test-source-alias`'s static scan. Moved into the one project
whose tests actually need it, as an inline array literal (the gate
cannot see a named-constant reference).

Ablated both halves on today's head, each restored under a trap and
verified by blob-equality plus an empty `git diff HEAD`: forcing the
served viewer's `can_override` to false turns the pin red on the Gate B
viewer-equality assertion (all four levers affected together); dropping
one served action's `can_override` OR-arm turns it red on that single
lever's composite assertion alone. Distinct signatures, confirmed both
against the rebuilt `dist/` and, after the alias fix, directly against
source with no rebuild.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

* fixup(dogfood): strip a customer-facing issue-id and add tsc source-resolution paths

check:doc-authoring flagged two runtime description strings in the new
fixture carrying a bare issue-id in customer-facing prose — moved the
context into code comments instead.

check:type-source-resolution flagged the same dist-vs-source hazard
check:test-source-alias already required a vitest fix for, but for
tsc's own module resolution: added the three new dependencies
(@objectstack/formula, @objectstack/plugin-approvals,
@objectstack/trigger-record-change) as bare-name `paths` entries in
this package's tsconfig.json, matching the existing driver-turso /
organizations entries.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: Trump

packages/qa/dogfood/package.json

@@ -19,8 +19,10 @@
     "@objectstack/mcp": "workspace:*",
     "@objectstack/metadata": "workspace:*",
     "@objectstack/metadata-core": "workspace:*",
+    "@objectstack/formula": "workspace:*",
     "@objectstack/objectql": "workspace:*",
     "@objectstack/platform-objects": "workspace:*",
+    "@objectstack/plugin-approvals": "workspace:*",
     "@objectstack/plugin-audit": "workspace:*",
     "@objectstack/plugin-auth": "workspace:*",
     "@objectstack/plugin-email": "workspace:*",
@@ -31,6 +33,7 @@
     "@objectstack/service-messaging": "workspace:*",
     "@objectstack/service-storage": "workspace:*",
     "@objectstack/spec": "workspace:*",
+    "@objectstack/trigger-record-change": "workspace:*",
     "@objectstack/types": "workspace:*",
     "@objectstack/verify": "workspace:*"
   },

packages/qa/dogfood/test/approval-override-composite-pin.dogfood.test.ts

@@ -0,0 +1,176 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// #16679 — the composite pin the card's own sentence names as missing:
+// "neither is visible from inside this repository's own tests — the
+// measurement needed a real app." Each of three gates is individually
+// observable somewhere in this repo; the CONJUNCTION — a served `viewer`
+// block, served `sys_approval_request` action metadata, and a CEL verdict
+// evaluating one against the other, on a real booted app — was pinned
+// nowhere. That is the seam through which a change to any one of the three
+// could silently break the #3424 platform-admin override with every existing
+// test green.
+//
+// ## What this measures, on the wire, on a real boot
+//
+// A plain member (never the platform admin) submits a record into a flow
+// whose sole node routes to a POSITION NOBODY HOLDS — the "stranded" shape:
+// an unresolved approver slate, `lockRecord: true`, otherwise undecidable.
+// The platform admin then reads the SAME request the console's approvals
+// inbox would, on both faces (`listRequests` / `getRequest`), and the SAME
+// `sys_approval_request` action metadata `GET /meta/object` serves — then
+// evaluates the served predicates against the served viewer with
+// `@objectstack/formula`'s `celEngine`, the engine the console itself uses.
+//
+// Both halves are asserted, not just the affirmative one (#16679 ⭐): the four
+// override levers (approve/reject/reassign/recall) must evaluate `visible ===
+// true`, AND the four secondary/submitter levers (send_back/request_info/
+// remind/resubmit) must evaluate `visible === false` for this exact viewer.
+// A pin asserting only the first half would stay green if the predicate
+// degenerated to a constant `true` — precisely the failure a
+// security-adjacent lever must not have.
+//
+// See `test/fixtures/override-composite-fixture.ts` for why this boots a
+// purpose-built object + flow rather than the showcase's own
+// `showcase_budget_approval` (the flow the #16679 measurement round drove):
+// showcase's `onEnable` unconditionally STAFFS the position that flow's
+// second rung needs unstaffed.
+
+import { describe, it, expect } from 'vitest';
+import { bootStack } from '@objectstack/verify';
+import { celEngine } from '@objectstack/formula';
+import type { Expression } from '@objectstack/spec';
+import { ApprovalsServicePlugin } from '@objectstack/plugin-approvals';
+import { RecordChangeTriggerPlugin } from '@objectstack/trigger-record-change';
+import { overrideCompositeStack, overrideCompositeSecurity } from './fixtures/override-composite-fixture.js';
+
+/** The four #3424 override-admitted decision levers — served `visible` must OR in `can_override`. */
+const OVERRIDE_LEVERS = ['approval_approve', 'approval_reject', 'approval_reassign', 'approval_recall'] as const;
+
+/**
+ * The secondary approver levers (gate on `can_act` alone) and the submitter
+ * continuity levers (gate on `is_submitter` alone). Neither ORs in
+ * `can_override` (deliberate boundary, `action-predicate-sparse-face.test.ts`
+ * `:140`) — for THIS viewer (`can_act: false`, `is_submitter: false`) every
+ * one of these must evaluate `visible === false`.
+ */
+const NON_OVERRIDE_LEVERS = [
+  'approval_send_back',
+  'approval_request_info',
+  'approval_remind',
+  'approval_resubmit',
+] as const;
+
+interface ServedViewer {
+  can_act: boolean;
+  is_submitter: boolean;
+  can_override: boolean;
+}
+
+interface ServedAction {
+  name: string;
+  visible?: Expression;
+}
+
+async function bootFixture() {
+  return bootStack(overrideCompositeStack as unknown as Parameters<typeof bootStack>[0], {
+    automation: true,
+    security: overrideCompositeSecurity(),
+    extraPlugins: [new RecordChangeTriggerPlugin(), new ApprovalsServicePlugin()],
+  });
+}
+
+describe('approval override composite (#16679)', () => {
+  it(
+    'serves an override-only viewer whose CEL-evaluated actions admit exactly the four override levers',
+    async () => {
+      const stack = await bootFixture();
+      try {
+        // A plain member submits — never the admin — so the admin reading the
+        // request back is neither the approver nor the submitter: the exact
+        // `{can_act:false, is_submitter:false, can_override:true}` triple the
+        // #16679 measurement round read off the wire.
+        const memberToken = await stack.signUp('override-composite-member@example.com');
+        const createRes = await stack.apiAs(memberToken, 'POST', '/data/override_composite_request', {
+          name: 'Stranded request',
+          amount: 100,
+        });
+        expect(createRes.status).toBe(201);
+
+        const adminToken = await stack.signIn();
+
+        // ── GATE A + the stranded-scene positive control ──────────────────
+        // A zero-row list would be indistinguishable from "nothing to measure"
+        // (NOT MEASURED, never a pass) — assert the scene actually opened
+        // before reading anything off it.
+        const listRes = await stack.apiAs(adminToken, 'GET', '/approvals/requests?status=pending');
+        expect(listRes.status).toBe(200);
+        const listBody = (await listRes.json()) as { data: Array<Record<string, unknown>> };
+        expect(listBody.data.length).toBe(1);
+        const listRow = listBody.data[0];
+        expect(listRow.status).toBe('pending');
+        expect(listRow.pending_approvers).toEqual(['position:override_composite_unstaffed']);
+        expect(listRow.lock_record).toBe(true);
+        expect(listRow.viewer).toBeTruthy();
+
+        const requestId = String(listRow.id);
+        const getRes = await stack.apiAs(adminToken, 'GET', `/approvals/requests/${requestId}`);
+        expect(getRes.status).toBe(200);
+        const getRow = (await getRes.json()) as Record<string, unknown>;
+        expect(getRow.viewer).toBeTruthy();
+
+        // ── GATE B — `can_override` true on BOTH faces, and the fail-safe's
+        //    other two flags correctly false for this actor ────────────────
+        const expectedViewer: ServedViewer = { can_act: false, is_submitter: false, can_override: true };
+        expect(listRow.viewer).toEqual(expectedViewer);
+        expect(getRow.viewer).toEqual(expectedViewer);
+
+        // ── GATE C — the served action metadata ORs `can_override` in on
+        //    exactly the four core levers, and nowhere else ─────────────────
+        const metaRes = await stack.apiAs(adminToken, 'GET', '/meta/object/sys_approval_request');
+        expect(metaRes.status).toBe(200);
+        const metaBody = (await metaRes.json()) as { item?: { actions?: ServedAction[] } };
+        const actions = metaBody.item?.actions ?? [];
+        expect(actions.length).toBe(8);
+
+        const byName = new Map(actions.map((a) => [a.name, a] as const));
+        for (const name of [...OVERRIDE_LEVERS, ...NON_OVERRIDE_LEVERS]) {
+          const action = byName.get(name);
+          expect(action, `served actions must include '${name}'`).toBeTruthy();
+          expect(action?.visible?.dialect).toBe('cel');
+        }
+
+        // ── COMPOSITE — evaluate the SERVED predicates against the SERVED
+        //    viewer with @objectstack/formula's celEngine, the engine the
+        //    console itself uses (`action-predicate-sparse-face.test.ts`
+        //    treats it as the authority). `record` is the served row itself
+        //    — the same binding shape the console evaluates `visible`
+        //    against (`record.status`, `record.viewer.*`). ────────────────
+        const evaluateVisible = (action: ServedAction | undefined): boolean => {
+          if (!action?.visible) throw new Error('action carries no visible predicate');
+          const result = celEngine.evaluate(action.visible, { record: getRow });
+          if (!result.ok) {
+            throw new Error(`CEL evaluation of '${action.name}' faulted: ${JSON.stringify(result)}`);
+          }
+          return result.value === true;
+        };
+
+        // ⭐ Both halves. A pin asserting only this first loop would stay
+        // green if `visible` degenerated to a constant `true`.
+        for (const name of OVERRIDE_LEVERS) {
+          expect(evaluateVisible(byName.get(name)), `${name} must be visible=true for an override-only viewer`).toBe(
+            true,
+          );
+        }
+        for (const name of NON_OVERRIDE_LEVERS) {
+          expect(
+            evaluateVisible(byName.get(name)),
+            `${name} must stay visible=false — it must not admit an actor who is neither the approver nor the submitter`,
+          ).toBe(false);
+        }
+      } finally {
+        await stack.stop();
+      }
+    },
+    60_000,
+  );
+});

packages/qa/dogfood/test/fixtures/override-composite-fixture.ts

@@ -0,0 +1,123 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// Minimal booted-app fixture for the #16679 composite pin.
+//
+// One object, one autolaunched `approval` flow whose sole node routes to a
+// POSITION with no holder at all — the "stranded" shape the #3424 platform
+// admin override exists to rescue (an unresolved slate, `lockRecord: true`,
+// otherwise undecidable).
+//
+// ## Why a purpose-built fixture rather than the showcase's own
+//    `showcase_budget_approval` (the flow the #16679 measurement round drove)
+//
+// `@objectstack/example-showcase`'s `onEnable` unconditionally runs
+// `registerShowcaseApprovalDemo`, which assigns the dev-seeded admin the
+// `manager` / `finance` / `legal` / `exec` positions on EVERY boot
+// (`ADMIN_APPROVAL_POSITIONS` in `seed-approval-demo.ts`) — i.e. it STAFFS
+// exactly the position `showcase_budget_approval`'s second rung needs
+// UNSTAFFED for the card's scene. A dogfood pin that re-booted showcase would
+// either race that seed step or have to disable it, coupling this pin's
+// stability to an app it does not own. A minimal object + flow answerable to
+// no app's `onEnable` keeps the "unstaffed position" precondition explicit and
+// permanent instead of incidental.
+//
+// `record-after-create` (not `-after-update`) is the trigger: the record is
+// born already routed to the gate, with no `previous` bookkeeping needed.
+
+import { defineStack, defineFlow } from '@objectstack/spec';
+import { ObjectSchema, Field } from '@objectstack/spec/data';
+import { PermissionSetSchema, type PermissionSet } from '@objectstack/spec/security';
+import { SecurityPlugin, securityDefaultPermissionSets } from '@objectstack/plugin-security';
+
+/** A position nothing in this fixture ever staffs — the stranded slate. */
+export const UNSTAFFED_POSITION = 'override_composite_unstaffed';
+
+export const OverrideCompositeRequest = ObjectSchema.create({
+  name: 'override_composite_request',
+  label: 'Override Composite Request',
+  pluralLabel: 'Override Composite Requests',
+  sharingModel: 'public_read_write',
+  fields: {
+    name: Field.text({ label: 'Name', required: true }),
+    amount: Field.number({ label: 'Amount', required: false }),
+  },
+});
+
+export const OverrideCompositeFlow = defineFlow({
+  name: 'override_composite_flow',
+  label: 'Override Composite Flow',
+  // The stranded scene, in miniature (see the module header above).
+  description: 'Fires on insert and routes straight to an UNSTAFFED position.',
+  type: 'autolaunched',
+  status: 'active',
+  nodes: [
+    {
+      id: 'start',
+      type: 'start',
+      label: 'On Create',
+      config: { objectName: 'override_composite_request', triggerType: 'record-after-create' },
+    },
+    {
+      id: 'gate',
+      type: 'approval',
+      label: 'Gate',
+      config: {
+        approvers: [{ type: 'position', value: UNSTAFFED_POSITION }],
+        behavior: 'first_response',
+        // Locked, matching the card's own scene (`showcase_budget_approval`'s
+        // `exec_review` rung) — the record must stay immovable while stuck.
+        lockRecord: true,
+      },
+    },
+    { id: 'approved', type: 'end', label: 'Approved' },
+    { id: 'rejected', type: 'end', label: 'Rejected' },
+  ],
+  edges: [
+    { id: 'e1', source: 'start', target: 'gate' },
+    { id: 'e2', source: 'gate', target: 'approved', label: 'approve' },
+    { id: 'e3', source: 'gate', target: 'rejected', label: 'reject' },
+  ],
+});
+
+export const overrideCompositeStack = defineStack({
+  manifest: {
+    id: 'com.dogfood.override_composite',
+    namespace: 'override_composite',
+    version: '0.0.0',
+    type: 'app',
+    name: 'Override Composite Fixture',
+    // The gate-composite pin's fixture app (see the module header above).
+    description: 'One object, one flow, one permanently-unstaffed position.',
+  },
+  // ADR-0097: a `record_change` trigger (the flow's `record-after-create`
+  // start node) only registers when the app declares it needs the capability.
+  requires: ['triggers'],
+  objects: [OverrideCompositeRequest],
+  flows: [OverrideCompositeFlow],
+});
+
+const FIXTURE_SUBMITTER_SET = 'override_composite_submitter';
+
+/**
+ * The fallback set a fresh (non-admin) member resolves to: create + read on
+ * `override_composite_request` only. Needed so a plain member — never the
+ * platform admin — can be the request's SUBMITTER, which is what makes
+ * `viewer.is_submitter` false for the admin reading it back (the composite
+ * pin needs `can_act: false, is_submitter: false, can_override: true`, the
+ * exact triple #16679's measurement round read off the wire).
+ */
+export const overrideCompositeSubmitterSet: PermissionSet = PermissionSetSchema.parse({
+  name: FIXTURE_SUBMITTER_SET,
+  label: 'Override Composite Submitter — create + read on override_composite_request only',
+  objects: {
+    override_composite_request: { allowRead: true, allowCreate: true, allowEdit: false, allowDelete: false },
+  },
+});
+
+/** SecurityPlugin whose fresh-member fallback is the submitter-only set above. */
+export function overrideCompositeSecurity(): SecurityPlugin {
+  return new SecurityPlugin({
+    defaultPermissionSets: [...securityDefaultPermissionSets, overrideCompositeSubmitterSet],
+    fallbackPermissionSet: overrideCompositeSubmitterSet.name,
+  });
+}

packages/qa/dogfood/tsconfig.json

@@ -47,9 +47,20 @@
     // answer this suite would want the day it really imports the package. Same
     // ONE bare-name shape as the entry above: that package's `exports` map
     // carries only `"."`.
+    //
+    // [#16679] `approval-override-composite-pin.dogfood.test.ts` and its
+    // fixture import `@objectstack/formula`, `@objectstack/plugin-approvals`
+    // and `@objectstack/trigger-record-change` as values (the CEL engine, the
+    // approvals plugin, the record-change trigger plugin) — same
+    // dist-resolved-type hazard as the driver above, this time caught by
+    // `check:type-source-resolution` rather than its vitest counterpart. Same
+    // ONE bare-name shape: each package's `exports` map carries only `"."`.
     "paths": {
       "@objectstack/driver-turso": ["../../drivers/driver-turso/src/index.ts"],
-      "@objectstack/organizations": ["../../plugins/organizations/src/index.ts"]
+      "@objectstack/organizations": ["../../plugins/organizations/src/index.ts"],
+      "@objectstack/formula": ["../../formula/src/index.ts"],
+      "@objectstack/plugin-approvals": ["../../plugins/plugin-approvals/src/index.ts"],
+      "@objectstack/trigger-record-change": ["../../triggers/trigger-record-change/src/index.ts"]
     }
   },
   "include": ["test/**/*"],