Expand description
Non-CRUD HTTP surface for the manual-journal approval workflow.
Hand-authored (user-owned; see metaphor.codegen.yaml). Wraps JournalWorkflowService:
POST /journals/:id/submit (no body)
POST /journals/:id/approve body {}
POST /journals/:id/reject body { reason }
POST /journals/:id/void body { reason }
The person approving, rejecting or voiding is the authenticated principal, read from the
OrgContext the host’s org guard inserts, never a field of the body: a body could name
anyone as the approver. A request without that context is refused with 401. The bodies
still accept the old approved_by / rejected_by / voided_by fields so existing
callers keep working, and ignore them.
approve posts the journal to the ledger; void posts a reversal. Both flow through the
audited PostingService core (FOR UPDATE per-account lock, idempotency, immutable ledger).
Tenancy (ADR-0029): the wire carries no tenant. The composing service’s decorator scopes every read and write from the request’s own scope.
Structs§
Functions§
- create_
journal_ workflow_ routes - Route composer for the manual-journal workflow endpoints. Mount it behind the host’s org
guard: approve, reject and void read the acting user from its
OrgContext.