feat(flow-runs): per-flow run summary, and since/flowIds on the run history

[rubenvdlinde]

What

GET /api/flow-runs/summary?flowIds=a,b&since=<ISO 8601> returns, per flow, the newest visible run (uuid, status, error, created, updated; never the log) and the number of visible runs created since the moment (default seven days ago). Every requested flow gets an entry, so a flow that never ran reads lastRun: null, runsSince: 0. The run history (GET /api/flow-runs) also accepts flowIds and since, so a "runs this week" list shows exactly the runs the summary counted. An unreadable since is a 400 on both reads.

Why

The shared flows index in @conduction/nextcloud-vue (board PqFlows, every app's Flows page) draws "Last run" and "Runs this week" per flow, a "With errors" filter and a "Runs this week" tab. Deriving those from the history read (at most 200 rows, no time filter) undercounts a busy flow and loads every run log.

Authorization

The summary is scoped exactly like the history, and the scope is decided before the read: an administrator sees all runs; anyone else counts the runs they triggered plus the runs of flows they own (same scopeToVisible predicate, same FlowCaller::idsOwnedByCaller()); a request without a session returns an empty result and issues no query.

Verified locally

• Unit: FlowRunControllerTest (32 tests, 4 new) and FlowRunMapperSummaryTest (3 new), green.
• phpcs on the changed files: no findings on changed lines.
• composer check:strict once (COMPOSER_PROCESS_TIMEOUT=0): lint, migration-version, phpcs, phpmd, psalm ("No errors found"), phpstan ("No errors") green; test:all 26,276 tests with 15 errors, all in AuditTrail* / DraftRemovalAuditRow DB tests that need the Nextcloud server's OC\DB\Schema\Table (MigratedSqliteDatabase), untouched by this change and red without it.
• Inherited: phpcs findings on untouched lines of appinfo/routes.php (line length, comment case) are not part of this change.

AI-assisted: written with Claude Code, reviewed by the lane before opening.

Consumer: ConductionNL/nextcloud-vue#1705

[github-actions]

Quality Report — ConductionNL/openregister @ bf11904

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
composer			✅	✅ 173/173
npm			✅	✅ 648/648
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 26260/26260 · 25 skipped
Newman					✅ 714/714
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-16 23:48 UTC

Download the full PDF report from the workflow artifacts.