FOUR-31145: Self Service tasks not visible to users in assigned subgroups - #9022

Issue & Reproduction Steps

A Self Service task assigned to group Main does not show for a user who is only in subgroup Sub (Sub ∈ Main). Inbox/claim compared the token’s self_service_groups to the user’s direct groups only.

The task list also broke: exclude() used $this->table (null) and generated SELECT .id, so the API returned 422 and the tab looked empty.

Repro: Homero in Sub → Sub in Main → process Self Service assigned to Main → login as Homero → Tasks → Self Service. List is empty; claim fails. To Do empty until claim is expected.

Solution

• User::selfServiceGroupIds() = direct groups + ancestors (Group::ancestorIdsFor()). Used by availableSelfServiceTasksQuery() and canSelfServe(). Token is not rewritten.
• Cache 10 min; GroupMemberObserver invalidates on membership changes.
• scopeExclude() uses getTable() so the list SELECT is valid.

How to Test

Run the unit test
./vendor/bin/phpunit tests/Feature/SelfServiceSubgroupTest.php

Related Tickets & Packages

https://processmaker.atlassian.net/browse/FOUR-31145

Code Review Checklist

• I have pulled this code locally and tested it on my instance, along with any associated packages.
• This code adheres to ProcessMaker Coding Guidelines.
• This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
• This solution fixes the bug reported in the original ticket.
• This solution does not alter the expected output of a component in a way that would break existing Processes.
• This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
• This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
• This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
• This ticket conforms to the PRD associated with this part of ProcessMaker.

ci:deploy