fix: Paket 0 – data integrity, security hardening and field usability

Backend - Backup covers every Prisma model (bundle v3); a guard test fails for any new model that is neither backed up nor explicitly excluded. Unsealed bundles may only add rows to 27 legacy master/field tables and never overwrite; counters, ledgers, settings, roles etc. need a sealed file. Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB) with warnings in log and UI; replaced document files are removed after commit. - Post-commit side effects (automation, calendar sync, webhooks) run via runAfterCommit and never turn a committed write into a 500, so retries with the same Idempotency-Key no longer create duplicates. - Calendar outbox is multi-replica safe: per-entry claims with stale takeover, revision-based settle, new Graph event only on 404/410, transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID validation for groupId, "run now" in background and resets FAILED. - Automation tasks are deduplicated under a row lock on the rule. - Update DTOs follow one null rule: omitted = unchanged, null clears a nullable field, null on a required field is a 400. - Varroa mites/day is recomputed on correction; withdrawal status is checked against the harvest date (?at=), bounded colonyIds; inspection create is audited; updates re-enqueue calendar entries. - Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS and QUEENLESS colonies as living. - Prisma errors and body-parser errors are logged without query values or request bodies. - Migration 20261012100000_calendar_sync_claims; schema index name aligned with the existing database object. Frontend - Sticky save bar sticks again (no scroll container ancestors, card uses overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms, sticky desktop sidebar. - Inspections record yes / no / not checked instead of silent defaults. - All living colonies are selectable; shared RecordSelect, EnumSelect, ChoiceGroup and TriStateField replace per-page copies; selects show names instead of ids; labels point at real controls. - Emptied optional fields are sent as null (emptyToNull) so every field can be cleared; dates default to the local day and are sent via toApiDate. - Harvest withdrawal warning uses the harvest date; backup page warns when a backup outgrows the import limit and lists skipped tables. Build and docs - Docker builds fail unless lint, typecheck and unit tests pass. - ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md for the backbone (api/worker/job roles, domain event outbox) and the feature roadmap T3-T7. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
2026-10-12 16:38:55 +02:00
1 parent f5b1964223
commit 10cbe9bf2d
@@ -1,10 +1,10 @@
-import { NotFoundException } from '@nestjs/common';
+import { Logger, NotFoundException } from '@nestjs/common';
 import { AutomationService } from './automation.service';
 import { PrismaService } from '../prisma/prisma.service';
 import { AuditLogService } from '../audit/audit-log.service';
 import { NotificationsService } from '../notifications/notifications.service';
 import { WebhooksService } from '../webhooks/webhooks.service';
-import { AutomationTriggerType } from '../../generated/prisma';
+import { AutomationTriggerType, Prisma } from '../../generated/prisma';

 describe('AutomationService', () => {
  let service: AutomationService;
@@ -17,6 +17,8 @@ describe('AutomationService', () => {
    };
    automationSequence: { upsert: jest.Mock };
    task: { create: jest.Mock; findFirst: jest.Mock };
+    $transaction: jest.Mock;
+    $queryRaw: jest.Mock;
  };
  let auditLog: { record: jest.Mock };
  let notifications: { record: jest.Mock };
@@ -57,6 +59,9 @@ describe('AutomationService', () => {
        create: jest.fn().mockResolvedValue({ id: 'task-1' }),
        findFirst: jest.fn().mockResolvedValue(null),
      },
+      // Interactive transactions run against the same mocks.
+      $transaction: jest.fn((work: (tx: unknown) => unknown) => work(prisma)),
+      $queryRaw: jest.fn().mockResolvedValue([]),
    };
    auditLog = { record: jest.fn() };
    notifications = { record: jest.fn() };
@@ -91,6 +96,122 @@ describe('AutomationService', () => {
    expect(result).toHaveLength(3);
  });

+  // Rule evaluation runs after the triggering record is committed. A failure
+  // here must not turn that request into an error - the client would retry
+  // and store the inspection or treatment a second time.
+  describe('post-commit evaluation', () => {
+    let errorSpy: jest.SpyInstance;
+
+    beforeEach(() => {
+      errorSpy = jest
+        .spyOn(Logger.prototype, 'error')
+        .mockImplementation(() => undefined);
+      prisma.automationRule.upsert.mockRejectedValue(new Error('db down'));
+    });
+
+    afterEach(() => {
+      errorSpy.mockRestore();
+    });
+
+    const colony = { id: 'colony-1', healthStatus: 'GOOD' };
+    const evaluations: [string, string, (s: AutomationService) => unknown][] = [
+      [
+        'evaluateInspection',
+        'Inspection inspection-1',
+        (s) =>
+          s.evaluateInspection({
+            id: 'inspection-1',
+            colonyId: 'colony-1',
+          } as never),
+      ],
+      [
+        'evaluateVarroaMeasurement',
+        'VarroaMeasurement measurement-1',
+        (s) =>
+          s.evaluateVarroaMeasurement({
+            id: 'measurement-1',
+            colonyId: 'colony-1',
+          } as never),
+      ],
+      [
+        'evaluateSwarmControlCheck',
+        'SwarmControlCheck check-1',
+        (s) =>
+          s.evaluateSwarmControlCheck({
+            id: 'check-1',
+            colonyId: 'colony-1',
+          } as never),
+      ],
+      [
+        'evaluateColonyHealth',
+        'Colony colony-1',
+        (s) =>
+          s.evaluateColonyHealth(
+            colony as never,
+            { ...colony, healthStatus: 'CRITICAL' } as never,
+          ),
+      ],
+      [
+        'evaluateStockItem',
+        'StockItem item-1',
+        (s) =>
+          s.evaluateStockItem({
+            id: 'item-1',
+            quantity: 1,
+            minThreshold: 5,
+          } as never),
+      ],
+      [
+        'evaluateRawMaterialLow',
+        'RawMaterialKind BEESWAX',
+        (s) => s.evaluateRawMaterialLow('BEESWAX', 100),
+      ],
+      [
+        'evaluateTreatment',
+        'Treatment treatment-1',
+        (s) =>
+          s.evaluateTreatment({
+            id: 'treatment-1',
+            colonyId: 'colony-1',
+            date: new Date('2026-08-01'),
+            endDate: null,
+            product: 'Ameisensäure',
+          } as never),
+      ],
+      [
+        'evaluateFeeding',
+        'Feeding feeding-1',
+        (s) =>
+          s.evaluateFeeding({
+            id: 'feeding-1',
+            colonyId: 'colony-1',
+            date: new Date('2026-09-01'),
+            amount: 5,
+            unit: 'l',
+          } as never),
+      ],
+    ];
+
+    it.each(evaluations)(
+      '%s never throws and logs the failure with the record',
+      async (_name, subject, evaluate) => {
+        await expect(evaluate(service)).resolves.toBeUndefined();
+
+        expect(errorSpy).toHaveBeenCalledTimes(1);
+        const [message] = errorSpy.mock.calls[0] as [string];
+        expect(message).toContain(subject);
+        expect(message).toContain('db down');
+      },
+    );
+
+    it('still throws from generateNumber, which runs before the write', async () => {
+      await expect(
+        service.generateNumber('HONEY_BATCH_NUMBER_FORMAT'),
+      ).rejects.toThrow('db down');
+      expect(errorSpy).not.toHaveBeenCalled();
+    });
+  });
+
  describe('evaluateInspection', () => {
    it('creates a task and notification when queen not seen and no eggs present', async () => {
      prisma.automationRule.findMany.mockResolvedValue([queenlessRule]);
@@ -238,6 +359,37 @@ describe('AutomationService', () => {
        select: { id: true },
      });
    });
+
+    it('checks for an open task and creates one under a lock on the rule row', async () => {
+      prisma.automationRule.findUnique.mockResolvedValue(varroaRule);
+
+      await service.evaluateVarroaMeasurement({
+        id: 'measurement-6',
+        colonyId: 'colony-1',
+        method: 'NATURAL_MITE_FALL',
+        calculatedValue: 25,
+        miteCount: 25,
+      } as never);
+
+      expect(prisma.$transaction).toHaveBeenCalledTimes(1);
+      const [sql, ...values] = prisma.$queryRaw.mock.calls[0] as [
+        TemplateStringsArray,
+        ...unknown[],
+      ];
+      expect(sql.join('?')).toMatch(
+        /SELECT id FROM "AutomationRule" WHERE id = \? FOR UPDATE/,
+      );
+      expect(values).toEqual(['rule-3']);
+      // Lock first, then check, then create - all in that one transaction.
+      const [lockOrder] = prisma.$queryRaw.mock.invocationCallOrder;
+      const [checkOrder] = prisma.task.findFirst.mock.invocationCallOrder;
+      const [createOrder] = prisma.task.create.mock.invocationCallOrder;
+      expect(lockOrder).toBeLessThan(checkOrder);
+      expect(checkOrder).toBeLessThan(createOrder);
+      // Webhook and warning follow the commit, outside the lock.
+      const [dispatchOrder] = webhooks.dispatch.mock.invocationCallOrder;
+      expect(dispatchOrder).toBeGreaterThan(createOrder);
+    });
  });

  describe('evaluateSwarmControlCheck', () => {
@@ -412,6 +564,34 @@ describe('AutomationService', () => {
        }),
      );
    });
+
+    it('clears the config on null so the rule falls back to its defaults', async () => {
+      prisma.automationRule.findUnique.mockResolvedValue(varroaRule);
+      prisma.automationRule.update.mockResolvedValue({
+        ...varroaRule,
+        config: null,
+      });
+
+      await service.update('rule-3', { config: null as never }, 'user-1');
+
+      const [[updateArg]] = prisma.automationRule.update.mock.calls as [
+        [{ data: { config?: unknown } }],
+      ];
+      // A Json column is cleared with DbNull - a plain null fails the write.
+      expect(updateArg.data.config).toBe(Prisma.DbNull);
+    });
+
+    it('leaves the config untouched when it is omitted', async () => {
+      prisma.automationRule.findUnique.mockResolvedValue(varroaRule);
+      prisma.automationRule.update.mockResolvedValue(varroaRule);
+
+      await service.update('rule-3', { active: true }, 'user-1');
+
+      const [[updateArg]] = prisma.automationRule.update.mock.calls as [
+        [{ data: { config?: unknown } }],
+      ];
+      expect(updateArg.data.config).toBeUndefined();
+    });
  });

  describe('generateNumber', () => {
@@ -1,5 +1,6 @@
-import { Injectable, NotFoundException } from '@nestjs/common';
+import { Injectable, Logger, NotFoundException } from '@nestjs/common';
 import { PrismaService } from '../prisma/prisma.service';
+import { runAfterCommit } from '../common/after-commit';
 import { AuditLogService } from '../audit/audit-log.service';
 import { NotificationsService } from '../notifications/notifications.service';
 import { WebhooksService } from '../webhooks/webhooks.service';
@@ -164,6 +165,8 @@ function dueDateFromConfig(

@Injectable()
 export class AutomationService {
+  private readonly logger = new Logger(AutomationService.name);
+
  constructor(
    private readonly prisma: PrismaService,
    private readonly auditLog: AuditLogService,
@@ -222,7 +225,12 @@ export class AutomationService {
      where: { id },
      data: {
        ...dto,
-        config: dto.config as Prisma.InputJsonValue | undefined,
+        // null resets the rule to its defaults; a Json column is cleared
+        // with DbNull, a plain null would fail the write.
+        config:
+          dto.config === null
+            ? Prisma.DbNull
+            : (dto.config as Prisma.InputJsonValue | undefined),
      },
    });
    await this.auditLog.record({
@@ -236,109 +244,141 @@ export class AutomationService {
    return rule;
  }

+  /**
+   * Every evaluate*() runs after the triggering record is committed and is
+   * called by the domain services without a guard - so it never throws (see
+   * runAfterCommit). A failed evaluation is logged, the request succeeds.
+   */
+  private evaluateAfterCommit(
+    entityType: string,
+    entityId: string,
+    evaluate: () => Promise<void>,
+  ): Promise<void> {
+    return runAfterCommit(
+      this.logger,
+      { action: 'Automation rule evaluation', entityType, entityId },
+      evaluate,
+    );
+  }
+
  async evaluateInspection(inspection: Inspection): Promise<void> {
-    await this.ensureDefaults();
-    const rules = await this.prisma.automationRule.findMany({
-      where: {
-        triggerType: { in: ['QUEENLESS_NO_EGGS', 'FEED_STATUS_CRITICAL'] },
-        active: true,
-      },
+    await this.evaluateAfterCommit('Inspection', inspection.id, async () => {
+      await this.ensureDefaults();
+      const rules = await this.prisma.automationRule.findMany({
+        where: {
+          triggerType: { in: ['QUEENLESS_NO_EGGS', 'FEED_STATUS_CRITICAL'] },
+          active: true,
+        },
+      });
+      const ruleByType = new Map(rules.map((rule) => [rule.triggerType, rule]));
+
+      const queenlessRule = ruleByType.get('QUEENLESS_NO_EGGS');
+      if (
+        queenlessRule &&
+        inspection.queenSeen === false &&
+        inspection.eggsPresent === false
+      ) {
+        await this.triggerAction(
+          queenlessRule,
+          'COLONY',
+          inspection.colonyId,
+          inspection.id,
+        );
+      }
+
+      const feedRule = ruleByType.get('FEED_STATUS_CRITICAL');
+      if (feedRule && inspection.feedStatus?.toLowerCase() === 'kritisch') {
+        await this.triggerAction(
+          feedRule,
+          'COLONY',
+          inspection.colonyId,
+          inspection.id,
+        );
+      }
    });
-    const ruleByType = new Map(rules.map((rule) => [rule.triggerType, rule]));
-
-    const queenlessRule = ruleByType.get('QUEENLESS_NO_EGGS');
-    if (
-      queenlessRule &&
-      inspection.queenSeen === false &&
-      inspection.eggsPresent === false
-    ) {
-      await this.triggerAction(
-        queenlessRule,
-        'COLONY',
-        inspection.colonyId,
-        inspection.id,
-      );
-    }
-
-    const feedRule = ruleByType.get('FEED_STATUS_CRITICAL');
-    if (feedRule && inspection.feedStatus?.toLowerCase() === 'kritisch') {
-      await this.triggerAction(
-        feedRule,
-        'COLONY',
-        inspection.colonyId,
-        inspection.id,
-      );
-    }
  }

  async evaluateVarroaMeasurement(
    measurement: VarroaMeasurement,
  ): Promise<void> {
-    await this.ensureDefaults();
-    const rule = await this.prisma.automationRule.findUnique({
-      where: { triggerType: 'VARROA_THRESHOLD' },
-    });
-    if (!rule || !rule.active) {
-      return;
-    }
-    // The threshold is a natural mite fall rate (mites per day). Only that
-    // method yields a value in this unit - a mite count from a sugar roll or
-    // wash is per bee sample and would be compared against the wrong scale,
-    // as would a raw board count without the number of days it covered.
-    if (measurement.method !== 'NATURAL_MITE_FALL') {
-      return;
-    }
-    const config = rule.config as { thresholdMitesPerDay?: number } | null;
-    const threshold = config?.thresholdMitesPerDay ?? 10;
-    const value = measurement.calculatedValue;
-    if (value !== null && value >= threshold) {
-      await this.triggerAction(rule, 'COLONY', measurement.colonyId);
-    }
+    await this.evaluateAfterCommit(
+      'VarroaMeasurement',
+      measurement.id,
+      async () => {
+        await this.ensureDefaults();
+        const rule = await this.prisma.automationRule.findUnique({
+          where: { triggerType: 'VARROA_THRESHOLD' },
+        });
+        if (!rule || !rule.active) {
+          return;
+        }
+        // The threshold is a natural mite fall rate (mites per day). Only
+        // that method yields a value in this unit - a mite count from a
+        // sugar roll or wash is per bee sample and would be compared against
+        // the wrong scale, as would a raw board count without the number of
+        // days it covered.
+        if (measurement.method !== 'NATURAL_MITE_FALL') {
+          return;
+        }
+        const config = rule.config as { thresholdMitesPerDay?: number } | null;
+        const threshold = config?.thresholdMitesPerDay ?? 10;
+        const value = measurement.calculatedValue;
+        if (value !== null && value >= threshold) {
+          await this.triggerAction(rule, 'COLONY', measurement.colonyId);
+        }
+      },
+    );
  }

  async evaluateSwarmControlCheck(check: SwarmControlCheck): Promise<void> {
-    await this.ensureDefaults();
-    const rule = await this.prisma.automationRule.findUnique({
-      where: { triggerType: 'SWARM_MOOD_HIGH' },
+    await this.evaluateAfterCommit('SwarmControlCheck', check.id, async () => {
+      await this.ensureDefaults();
+      const rule = await this.prisma.automationRule.findUnique({
+        where: { triggerType: 'SWARM_MOOD_HIGH' },
+      });
+      if (!rule || !rule.active) {
+        return;
+      }
+      if (check.swarmMood === 'HIGH') {
+        await this.triggerAction(rule, 'COLONY', check.colonyId);
+      }
    });
-    if (!rule || !rule.active) {
-      return;
-    }
-    if (check.swarmMood === 'HIGH') {
-      await this.triggerAction(rule, 'COLONY', check.colonyId);
-    }
  }

  /** Fires only on the transition into CRITICAL, not on every edit while already critical. */
  async evaluateColonyHealth(before: Colony, after: Colony): Promise<void> {
-    await this.ensureDefaults();
-    if (
-      after.healthStatus !== 'CRITICAL' ||
-      before.healthStatus === 'CRITICAL'
-    ) {
-      return;
-    }
-    const rule = await this.prisma.automationRule.findUnique({
-      where: { triggerType: 'COLONY_HEALTH_CRITICAL' },
+    await this.evaluateAfterCommit('Colony', after.id, async () => {
+      await this.ensureDefaults();
+      if (
+        after.healthStatus !== 'CRITICAL' ||
+        before.healthStatus === 'CRITICAL'
+      ) {
+        return;
+      }
+      const rule = await this.prisma.automationRule.findUnique({
+        where: { triggerType: 'COLONY_HEALTH_CRITICAL' },
+      });
+      if (!rule || !rule.active) {
+        return;
+      }
+      await this.triggerAction(rule, 'COLONY', after.id);
    });
-    if (!rule || !rule.active) {
-      return;
-    }
-    await this.triggerAction(rule, 'COLONY', after.id);
  }

  async evaluateStockItem(item: StockItem): Promise<void> {
-    await this.ensureDefaults();
-    if (item.minThreshold === null || item.quantity >= item.minThreshold) {
-      return;
-    }
-    const rule = await this.prisma.automationRule.findUnique({
-      where: { triggerType: 'STOCK_ITEM_LOW' },
+    await this.evaluateAfterCommit('StockItem', item.id, async () => {
+      await this.ensureDefaults();
+      if (item.minThreshold === null || item.quantity >= item.minThreshold) {
+        return;
+      }
+      const rule = await this.prisma.automationRule.findUnique({
+        where: { triggerType: 'STOCK_ITEM_LOW' },
+      });
+      if (!rule || !rule.active) {
+        return;
+      }
+      await this.triggerAction(rule, 'STORAGE', item.id);
    });
-    if (!rule || !rule.active) {
-      return;
-    }
-    await this.triggerAction(rule, 'STORAGE', item.id);
  }

  /**
@@ -352,40 +392,46 @@ export class AutomationService {
    kind: RawMaterialKind,
    remainingGrams: number,
  ): Promise<void> {
-    await this.ensureDefaults();
-    const rule = await this.prisma.automationRule.findUnique({
-      where: { triggerType: 'RAW_MATERIAL_LOW' },
-    });
-    if (!rule || !rule.active) {
-      return;
-    }
-    const config = rule.config as {
-      minGrams?: Partial<Record<RawMaterialKind, unknown>>;
-    } | null;
-    const minGrams = config?.minGrams?.[kind];
-    if (typeof minGrams !== 'number' || remainingGrams >= minGrams) {
-      return;
-    }
-    await this.triggerAction(rule, 'GENERAL', kind, undefined, {
-      description: `${RAW_MATERIAL_KIND_LABELS[kind]}: noch ${remainingGrams} g auf Lager, Mindestmenge ${minGrams} g.`,
+    await this.evaluateAfterCommit('RawMaterialKind', kind, async () => {
+      await this.ensureDefaults();
+      const rule = await this.prisma.automationRule.findUnique({
+        where: { triggerType: 'RAW_MATERIAL_LOW' },
+      });
+      if (!rule || !rule.active) {
+        return;
+      }
+      const config = rule.config as {
+        minGrams?: Partial<Record<RawMaterialKind, unknown>>;
+      } | null;
+      const minGrams = config?.minGrams?.[kind];
+      if (typeof minGrams !== 'number' || remainingGrams >= minGrams) {
+        return;
+      }
+      await this.triggerAction(rule, 'GENERAL', kind, undefined, {
+        description: `${RAW_MATERIAL_KIND_LABELS[kind]}: noch ${remainingGrams} g auf Lager, Mindestmenge ${minGrams} g.`,
+      });
    });
  }

  async evaluateTreatment(treatment: Treatment): Promise<void> {
-    await this.evaluateFollowUp(
-      'TREATMENT_FOLLOW_UP',
-      treatment.colonyId,
-      treatment.endDate ?? treatment.date,
-      `Nach Behandlung mit ${treatment.product} am ${formatDay(treatment.endDate ?? treatment.date)}.`,
+    await this.evaluateAfterCommit('Treatment', treatment.id, () =>
+      this.evaluateFollowUp(
+        'TREATMENT_FOLLOW_UP',
+        treatment.colonyId,
+        treatment.endDate ?? treatment.date,
+        `Nach Behandlung mit ${treatment.product} am ${formatDay(treatment.endDate ?? treatment.date)}.`,
+      ),
    );
  }

  async evaluateFeeding(feeding: Feeding): Promise<void> {
-    await this.evaluateFollowUp(
-      'FEEDING_FOLLOW_UP',
-      feeding.colonyId,
-      feeding.date,
-      `Nach Fütterung (${feeding.amount} ${feeding.unit}) am ${formatDay(feeding.date)}.`,
+    await this.evaluateAfterCommit('Feeding', feeding.id, () =>
+      this.evaluateFollowUp(
+        'FEEDING_FOLLOW_UP',
+        feeding.colonyId,
+        feeding.date,
+        `Nach Fütterung (${feeding.amount} ${feeding.unit}) am ${formatDay(feeding.date)}.`,
+      ),
    );
  }

@@ -507,6 +553,12 @@ export class AutomationService {
   * stock item or the check task for a colony is still open, further triggers
   * (the next removal below minimum, a second high varroa count) add nothing.
   * Repeating the same alarm would only bury the one task that matters.
+   *
+   * Check and create run in one transaction under a lock on the rule's row:
+   * two evaluations at the same moment (parallel requests, several pods)
+   * would otherwise both see "no open task" and both create one. The lock
+   * is per rule and held for two short statements; webhook, warning and
+   * audit entry follow after the commit.
   */
  private async triggerAction(
    rule: AutomationRule,
@@ -515,33 +567,38 @@ export class AutomationService {
    sourceInspectionId?: string,
    options: { baseDate?: Date; description?: string } = {},
  ): Promise<void> {
-    const alreadyOpen = await this.prisma.task.findFirst({
-      where: {
-        sourceAutomationTrigger: rule.triggerType,
-        relatedType,
-        relatedId,
-        status: { in: ['OPEN', 'IN_PROGRESS'] },
-      },
-      select: { id: true },
-    });
-    if (alreadyOpen) {
-      return;
-    }
-
    const title = rule.actionTemplate ?? 'Automatisierte Aufgabe';
    const config = rule.config as { dueInDays?: unknown } | null;
-    const task = await this.prisma.task.create({
-      data: {
-        title,
-        priority: 'HIGH',
-        relatedType,
-        relatedId,
-        sourceInspectionId,
-        sourceAutomationTrigger: rule.triggerType,
-        description: options.description,
-        dueDate: dueDateFromConfig(config?.dueInDays, options.baseDate),
-      },
+    const task = await this.prisma.$transaction(async (tx) => {
+      await tx.$queryRaw`SELECT id FROM "AutomationRule" WHERE id = ${rule.id} FOR UPDATE`;
+      const alreadyOpen = await tx.task.findFirst({
+        where: {
+          sourceAutomationTrigger: rule.triggerType,
+          relatedType,
+          relatedId,
+          status: { in: ['OPEN', 'IN_PROGRESS'] },
+        },
+        select: { id: true },
+      });
+      if (alreadyOpen) {
+        return null;
+      }
+      return tx.task.create({
+        data: {
+          title,
+          priority: 'HIGH',
+          relatedType,
+          relatedId,
+          sourceInspectionId,
+          sourceAutomationTrigger: rule.triggerType,
+          description: options.description,
+          dueDate: dueDateFromConfig(config?.dueInDays, options.baseDate),
+        },
+      });
    });
+    if (!task) {
+      return;
+    }
    await this.webhooks.dispatch('task.created', task);
    await this.notifications.record({
      priority: 'WARNUNG',
@@ -1,9 +1,10 @@
 import { ApiPropertyOptional } from '@nestjs/swagger';
 import { IsBoolean, IsObject, IsOptional, IsString } from 'class-validator';
+import { IsOptionalNotNull } from '../../common/validation/is-optional-not-null';

 export class UpdateAutomationRuleDto {
  @ApiPropertyOptional()
-  @IsOptional()
+  @IsOptionalNotNull()
  @IsBoolean()
  active?: boolean;