Merge branch 'feature/FOUR-29866' into automated-performance-tests

Author: nolanpro

ProcessMaker/Console/Commands/GenerateAccessToken.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace ProcessMaker\Console\Commands;
+
+use Illuminate\Console\Command;
+use ProcessMaker\Models\User;
+
+class GenerateAccessToken extends Command
+{
+    protected $signature = 'processmaker:generate-access-token {username : The username of the user}';
+
+    protected $description = 'Generate an API access token for a user';
+
+    public function handle(): int
+    {
+        $user = User::where('username', $this->argument('username'))->first();
+
+        if (!$user) {
+            return 1;
+        }
+
+        $tokenResult = $user->createToken('api-user-token');
+        $this->line($tokenResult->accessToken);
+
+        return 0;
+    }
+}

ProcessMaker/Models/ProcessRequestToken.php

@@ -17,6 +17,8 @@
 use ProcessMaker\Events\ActivityAssigned;
 use ProcessMaker\Events\ActivityReassignment;
 use ProcessMaker\Facades\WorkflowUserManager;
+use ProcessMaker\Managers\DataManager;
+use ProcessMaker\Models\MustacheExpressionEvaluator;
 use ProcessMaker\Nayra\Bpmn\TokenTrait;
 use ProcessMaker\Nayra\Contracts\Bpmn\ActivityInterface;
 use ProcessMaker\Nayra\Contracts\Bpmn\FlowElementInterface;
@@ -1440,6 +1442,59 @@ public function reassign($toUserId, User $requestingUser, $comments = '')
         }
     }
 
+    /**
+     * Build context for Mustache (end event external URL). Same as scripts/screens: _user, _request, process data, APP_URL.
+     */
+    private function getElementDestinationMustacheContext(): array
+    {
+        try {
+            $context = (new DataManager())->getData($this);
+        } catch (Throwable $e) {
+            Log::warning('Failed to load Mustache context via DataManager, falling back to request data', [
+                'token_id' => $this->id,
+                'error' => $e->getMessage(),
+            ]);
+            $request = $this->processRequest;
+            $context = array_merge($request->data ?? [], $request ? (new DataManager())->updateRequestMagicVariable([], $request) : []);
+            $user = $this->user ?? auth()->user();
+            if ($user) {
+                $userData = $user->attributesToArray();
+                unset($userData['remember_token']);
+                $context['_user'] = $userData;
+            }
+        }
+
+        $context['APP_URL'] = config('app.url');
+
+        // Never expose remember_token to Mustache (defense in depth; DataManager/fallback may already strip it)
+        if (isset($context['_user']) && is_array($context['_user'])) {
+            unset($context['_user']['remember_token']);
+        }
+
+        // Normalize to plain arrays/scalars so Mustache resolves all keys (common PHP idiom)
+        $json = json_encode($context, JSON_THROW_ON_ERROR);
+        $normalized = json_decode($json, true, 512, JSON_THROW_ON_ERROR);
+
+        return is_array($normalized) ? $normalized : [];
+    }
+
+    /**
+     * Resolve Mustache in end event external URL. FEEL is not supported here; use Mustache only.
+     * Context: APP_URL, _request, _user, process variables (same as getElementDestinationMustacheContext).
+     *
+     * Example (Mustache):
+     *   {{APP_URL}}/admin/users/{{_request.id}}/edit     -> https://example.com/admin/users/123/edit
+     *   {{APP_URL}}/webentry/{{_request.id}}             -> https://example.com/webentry/123
+     *   {{APP_URL}}/path/{{my_process_var}}               -> uses process variable my_process_var
+     */
+    private function resolveElementDestinationUrl(string $url): string
+    {
+        $url = html_entity_decode($url, ENT_QUOTES | ENT_HTML401, 'UTF-8');
+        $context = $this->getElementDestinationMustacheContext();
+
+        return (new MustacheExpressionEvaluator())->render($url, $context);
+    }
+
     /**
      * Determines the destination based on the type of element destination property
      *
@@ -1481,6 +1536,11 @@ private function getElementDestination($elementDestinationType, $elementDestinat
                         $elementDestination = $elementDestinationProp['value']['url'] ?? null;
                     }
                 }
+                if (is_string($elementDestination) && $elementDestination !== '') {
+                    if ($elementDestinationType === 'externalURL' || $elementDestinationType === 'customDashboard') {
+                        $elementDestination = $this->resolveElementDestinationUrl($elementDestination);
+                    }
+                }
                 break;
             case 'taskList':
                 $elementDestination = route('tasks.index');

ProcessMaker/RollbackProcessRequest.php

@@ -127,6 +127,7 @@ public function rollback(
                 break;
         }
 
+        // update the process request status to active
         $processRequest = $this->newTask->processRequest;
         $processRequest->status = 'ACTIVE';
         $process = $processRequest->process;
@@ -135,9 +136,12 @@ public function rollback(
         )->id;
         $processRequest->saveOrFail();
 
+        // update the current task status to closed
         $currentTask->status = 'CLOSED';
         $currentTask->saveOrFail();
 
+        $this->syncParentProcessStatus($processRequest);
+
         return $this->newTask;
     }
 
@@ -209,4 +213,25 @@ private function addComment() : void
             'case_number' => isset($this->currentTask->case_number) ? $this->currentTask->case_number : null,
         ]);
     }
+
+    /**
+     * When the rolled-back request is a subprocess, reactivate the parent request
+     * and the parent's call activity tokens that were in error.
+     */
+    private function syncParentProcessStatus(ProcessRequest $processRequest): void
+    {
+        $parentRequest = $processRequest->parentRequest;
+        if (!$parentRequest) {
+            return;
+        }
+
+        if (in_array($parentRequest->status, ['ERROR', 'FAILING'])) {
+            $parentRequest->status = 'ACTIVE';
+            $parentRequest->saveOrFail();
+        }
+
+        ProcessRequestToken::where('subprocess_request_id', $processRequest->id)
+            ->whereIn('status', ['ERROR', 'FAILING'])
+            ->update(['status' => 'ACTIVE']);
+    }
 }

ProcessMaker/Services/ConditionalRedirectService.php

@@ -103,6 +103,8 @@ public function __construct()
     public function resolve(array $conditionalRedirect, array $data): ?array
     {
         $this->errors = [];
+        $data = $this->normalizeDataForFeel($data);
+
         foreach ($conditionalRedirect as $item) {
             if (!isset($item['condition'])) {
                 throw new InvalidArgumentException('Condition is required');
@@ -125,6 +127,29 @@ public function resolve(array $conditionalRedirect, array $data): ?array
         return null;
     }
 
+    /**
+     * Normalize data so FEEL comparisons like form_input_1==0 work when form sends string "0".
+     * Converts numeric strings to int/float so that the first matching condition is the intended one.
+     *
+     * @param array $data
+     * @return array
+     */
+    private function normalizeDataForFeel(array $data): array
+    {
+        $normalized = [];
+        foreach ($data as $key => $value) {
+            if (is_array($value)) {
+                $normalized[$key] = $this->normalizeDataForFeel($value);
+            } elseif (is_string($value) && is_numeric($value)) {
+                $normalized[$key] = str_contains($value, '.') ? (float) $value : (int) $value;
+            } else {
+                $normalized[$key] = $value;
+            }
+        }
+
+        return $normalized;
+    }
+
     /**
      * Process conditional redirects for a specific process request token
      *

composer.json

@@ -1,6 +1,6 @@
 {
     "name": "processmaker/processmaker",
-    "version": "2026.4.5",
+    "version": "2026.5.1",
     "description": "BPM PHP Software",
     "keywords": [
         "php bpm processmaker"
@@ -108,7 +108,7 @@
             "Gmail"
         ],
         "processmaker": {
-            "build": "d3bb8c4e",
+            "build": "2cdff483",
             "cicd-enabled": true,
             "custom": {
                 "package-ellucian-ethos": "1.19.10",
@@ -159,14 +159,14 @@
                 "package-collections": "2.27.3",
                 "package-comments": "1.16.2",
                 "package-conversational-forms": "1.15.0",
-                "package-data-sources": "1.34.6",
+                "package-data-sources": "1.34.7",
                 "package-decision-engine": "1.16.1",
                 "package-dynamic-ui": "1.28.3",
                 "package-email-start-event": "1.0.9",
                 "package-files": "1.23.5",
                 "package-googleplaces": "1.12.0",
                 "package-photo-video": "1.6.1",
-                "package-pm-blocks": "1.12.7",
+                "package-pm-blocks": "1.12.8",
                 "package-process-documenter": "1.12.0",
                 "package-process-optimization": "1.10.0",
                 "package-product-analytics": "1.5.11",
@@ -180,7 +180,7 @@
                 "package-translations": "2.14.5",
                 "package-versions": "1.13.0",
                 "package-vocabularies": "2.17.1",
-                "package-webentry": "2.29.14",
+                "package-webentry": "2.29.15",
                 "package-api-testing": "1.3.1",
                 "package-variable-finder": "1.0.5",
                 "packages": "^0"

package-lock.json

@@ -1,6 +1,6 @@
 {
     "name": "@processmaker/processmaker",
-    "version": "2026.4.5",
+    "version": "2026.5.1",
     "description": "ProcessMaker 4",
     "author": "DevOps <devops@processmaker.com>",
     "license": "ISC",
@@ -61,9 +61,9 @@
         "@fortawesome/free-solid-svg-icons": "^5.15.1",
         "@fortawesome/vue-fontawesome": "^0.1.9",
         "@panter/vue-i18next": "^0.15.2",
-        "@processmaker/modeler": "1.69.31",
+        "@processmaker/modeler": "1.69.33",
         "@processmaker/processmaker-bpmn-moddle": "0.16.0",
-        "@processmaker/screen-builder": "3.8.26",
+        "@processmaker/screen-builder": "3.8.27",
         "@processmaker/vue-form-elements": "0.65.6",
         "@processmaker/vue-multiselect": "2.3.0",
         "@tinymce/tinymce-vue": "2.0.0",

package.json

@@ -353,6 +353,12 @@ export default {
     openRequest(data, index) {
       return `/requests/${data.id}`;
     },
+    openCase(data) {
+      if (data && data.case_number) {
+        return `/cases/${data.case_number}`;
+      }
+      return this.openRequest(data, 1);
+    },
     openTask(task) {
       return `/tasks/${task.id}/edit`;
     },
@@ -406,14 +412,14 @@ export default {
     },
     formatCaseNumber(value) {
       return `
-      <a href="${this.openRequest(value, 1)}"
+      <a href="${this.openCase(value)}"
          class="text-nowrap">
          # ${value.case_number}
       </a>`;
     },
     formatCaseTitle(value) {
       return `
-      <a href="${this.openRequest(value, 1)}"
+      <a href="${this.openCase(value)}"
          class="text-nowrap">
          ${value.case_title_formatted || value.case_title || value.name}
       </a>`;
@@ -457,8 +463,8 @@ export default {
       data.data = this.jsonRows(data.data);
       for (let record of data.data) {
         //format Status
-        record["case_number"] = this.formatCaseNumber(record);
         record["case_title"] = this.formatCaseTitle(record);
+        record["case_number"] = this.formatCaseNumber(record);
         if (record["active_tasks"]) {
           record["active_tasks"] = this.formatActiveTasks(record["active_tasks"]);
         }