Merge pull request #8728 from ProcessMaker/feature/FOUR-29250

FOUR-29250 End Event – External URL with Mustache Support

Author: nolanpro

ProcessMaker/Models/ProcessRequestToken.php

@@ -17,6 +17,8 @@
 use ProcessMaker\Events\ActivityAssigned;
 use ProcessMaker\Events\ActivityReassignment;
 use ProcessMaker\Facades\WorkflowUserManager;
+use ProcessMaker\Managers\DataManager;
+use ProcessMaker\Models\MustacheExpressionEvaluator;
 use ProcessMaker\Nayra\Bpmn\TokenTrait;
 use ProcessMaker\Nayra\Contracts\Bpmn\ActivityInterface;
 use ProcessMaker\Nayra\Contracts\Bpmn\FlowElementInterface;
@@ -1440,6 +1442,59 @@ public function reassign($toUserId, User $requestingUser, $comments = '')
         }
     }
 
+    /**
+     * Build context for Mustache (end event external URL). Same as scripts/screens: _user, _request, process data, APP_URL.
+     */
+    private function getElementDestinationMustacheContext(): array
+    {
+        try {
+            $context = (new DataManager())->getData($this);
+        } catch (Throwable $e) {
+            Log::warning('Failed to load Mustache context via DataManager, falling back to request data', [
+                'token_id' => $this->id,
+                'error' => $e->getMessage(),
+            ]);
+            $request = $this->processRequest;
+            $context = array_merge($request->data ?? [], $request ? (new DataManager())->updateRequestMagicVariable([], $request) : []);
+            $user = $this->user ?? auth()->user();
+            if ($user) {
+                $userData = $user->attributesToArray();
+                unset($userData['remember_token']);
+                $context['_user'] = $userData;
+            }
+        }
+
+        $context['APP_URL'] = config('app.url');
+
+        // Never expose remember_token to Mustache (defense in depth; DataManager/fallback may already strip it)
+        if (isset($context['_user']) && is_array($context['_user'])) {
+            unset($context['_user']['remember_token']);
+        }
+
+        // Normalize to plain arrays/scalars so Mustache resolves all keys (common PHP idiom)
+        $json = json_encode($context, JSON_THROW_ON_ERROR);
+        $normalized = json_decode($json, true, 512, JSON_THROW_ON_ERROR);
+
+        return is_array($normalized) ? $normalized : [];
+    }
+
+    /**
+     * Resolve Mustache in end event external URL. FEEL is not supported here; use Mustache only.
+     * Context: APP_URL, _request, _user, process variables (same as getElementDestinationMustacheContext).
+     *
+     * Example (Mustache):
+     *   {{APP_URL}}/admin/users/{{_request.id}}/edit     -> https://example.com/admin/users/123/edit
+     *   {{APP_URL}}/webentry/{{_request.id}}             -> https://example.com/webentry/123
+     *   {{APP_URL}}/path/{{my_process_var}}               -> uses process variable my_process_var
+     */
+    private function resolveElementDestinationUrl(string $url): string
+    {
+        $url = html_entity_decode($url, ENT_QUOTES | ENT_HTML401, 'UTF-8');
+        $context = $this->getElementDestinationMustacheContext();
+
+        return (new MustacheExpressionEvaluator())->render($url, $context);
+    }
+
     /**
      * Determines the destination based on the type of element destination property
      *
@@ -1481,6 +1536,11 @@ private function getElementDestination($elementDestinationType, $elementDestinat
                         $elementDestination = $elementDestinationProp['value']['url'] ?? null;
                     }
                 }
+                if (is_string($elementDestination) && $elementDestination !== '') {
+                    if ($elementDestinationType === 'externalURL' || $elementDestinationType === 'customDashboard') {
+                        $elementDestination = $this->resolveElementDestinationUrl($elementDestination);
+                    }
+                }
                 break;
             case 'taskList':
                 $elementDestination = route('tasks.index');

ProcessMaker/Services/ConditionalRedirectService.php

@@ -103,6 +103,8 @@ public function __construct()
     public function resolve(array $conditionalRedirect, array $data): ?array
     {
         $this->errors = [];
+        $data = $this->normalizeDataForFeel($data);
+
         foreach ($conditionalRedirect as $item) {
             if (!isset($item['condition'])) {
                 throw new InvalidArgumentException('Condition is required');
@@ -125,6 +127,29 @@ public function resolve(array $conditionalRedirect, array $data): ?array
         return null;
     }
 
+    /**
+     * Normalize data so FEEL comparisons like form_input_1==0 work when form sends string "0".
+     * Converts numeric strings to int/float so that the first matching condition is the intended one.
+     *
+     * @param array $data
+     * @return array
+     */
+    private function normalizeDataForFeel(array $data): array
+    {
+        $normalized = [];
+        foreach ($data as $key => $value) {
+            if (is_array($value)) {
+                $normalized[$key] = $this->normalizeDataForFeel($value);
+            } elseif (is_string($value) && is_numeric($value)) {
+                $normalized[$key] = str_contains($value, '.') ? (float) $value : (int) $value;
+            } else {
+                $normalized[$key] = $value;
+            }
+        }
+
+        return $normalized;
+    }
+
     /**
      * Process conditional redirects for a specific process request token
      *