Add in-process script preview functionality

- Enhanced ScriptController to support a new `run_in_process` property for script previews, allowing execution via an in-process PHP runner when enabled.
- Updated TestScript job to handle the new `runInProcess` parameter, enabling direct script execution without Docker.
- Introduced `shouldPreviewInProcess` method to determine if in-process execution is applicable based on script properties and request flags.
- Added comprehensive unit tests to validate in-process execution scenarios and ensure proper handling of configuration and execution context.
- Implemented new test cases for CoreServiceTask to verify in-process script execution and error handling for various conditions.

Author: marcoAntonioNina

ProcessMaker/Http/Controllers/Api/ScriptController.php

@@ -173,6 +173,11 @@ public function index(Request $request)
      *                 property="nonce",
      *                 type="string",
      *             ),
+     *             @OA\Property(
+     *                 property="run_in_process",
+     *                 type="boolean",
+     *                 description="When true (and Core Service Task enabled), preview via in-process PHP runner instead of Docker/microservice. Also auto-enabled when the script has allow_in_process=true.",
+     *             ),
      *           ),
      *         ),
      *
@@ -189,10 +194,31 @@ public function preview(Request $request, Script $script)
         $config = $this->getRequestArray($request->get('config'));
         $code = $request->get('code');
         $nonce = $request->get('nonce');
+        $runInProcess = $this->shouldPreviewInProcess($request, $script);
+
+        TestScript::dispatch($script, $request->user(), $code, $data, $config, $nonce, $runInProcess)->onQueue('bpmn');
+
+        return ['status' => 'success', 'run_in_process' => $runInProcess];
+    }
+
+    /**
+     * Decide if script preview should use Core Service Task in-process runner.
+     */
+    private function shouldPreviewInProcess(Request $request, Script $script): bool
+    {
+        if (!config('core-service-task.enabled')) {
+            return false;
+        }
 
-        TestScript::dispatch($script, $request->user(), $code, $data, $config, $nonce)->onQueue('bpmn');
+        if (strtolower((string) $script->language) !== 'php') {
+            return false;
+        }
+
+        if ($request->boolean('run_in_process')) {
+            return true;
+        }
 
-        return ['status' => 'success'];
+        return (bool) $script->allow_in_process;
     }
 
     /**

ProcessMaker/Jobs/TestScript.php

@@ -9,8 +9,12 @@
 use Illuminate\Queue\SerializesModels;
 use ProcessMaker\Enums\ScriptExecutorType;
 use ProcessMaker\Events\ScriptResponseEvent;
+use ProcessMaker\Exception\ConfigurationException;
+use ProcessMaker\Facades\ScriptRuntime;
 use ProcessMaker\Models\Script;
 use ProcessMaker\Models\User;
+use ProcessMaker\ScriptRunners\InProcessPhpRunner;
+use ProcessMaker\ScriptRuntime\ScriptExecutionContext;
 use Throwable;
 
 class TestScript implements ShouldQueue
@@ -32,6 +36,8 @@ class TestScript implements ShouldQueue
 
     protected $nonce;
 
+    protected bool $runInProcess;
+
     /**
      * Create a new job instance to execute a script.
      *
@@ -40,15 +46,25 @@ class TestScript implements ShouldQueue
      * @param string $code
      * @param array $data
      * @param array $configuration
+     * @param string|null $nonce
+     * @param bool $runInProcess Use Core Service Task in-process runner (no Docker)
      */
-    public function __construct(Script $script, User $current_user, $code, array $data, array $configuration, $nonce = null)
-    {
+    public function __construct(
+        Script $script,
+        User $current_user,
+        $code,
+        array $data,
+        array $configuration,
+        $nonce = null,
+        bool $runInProcess = false
+    ) {
         $this->script = $script;
         $this->current_user = $current_user;
         $this->code = $code;
         $this->data = $data;
         $this->configuration = $configuration;
         $this->nonce = $nonce;
+        $this->runInProcess = $runInProcess;
     }
 
     /**
@@ -61,6 +77,15 @@ public function handle()
         try {
             // Just set the code but do not save the object (preview only)
             $this->script->code = $this->code;
+
+            if ($this->runInProcess) {
+                $response = $this->runInProcessPreview();
+                \Log::debug('Response from in-process preview: ' . print_r($response, true));
+                $this->sendResponse(200, $response);
+
+                return;
+            }
+
             $metadata = [
                 'nonce' => $this->nonce,
                 'current_user' => $this->current_user?->id,
@@ -80,6 +105,60 @@ public function handle()
         }
     }
 
+    /**
+     * Preview using ScriptRuntime modules (default) or bare InProcessPhpRunner.
+     *
+     * @return array{output: mixed}
+     */
+    private function runInProcessPreview(): array
+    {
+        if (!config('core-service-task.enabled')) {
+            throw new ConfigurationException(
+                'Core Service Task is disabled. Set CORE_SERVICE_TASK_ENABLED=true to enable.'
+            );
+        }
+
+        if (strtolower((string) $this->script->language) !== 'php') {
+            throw new ConfigurationException('In-process preview only supports PHP scripts');
+        }
+
+        $user = User::find($this->script->run_as_user_id);
+        if (!$user) {
+            throw new ConfigurationException('A user is required to run scripts');
+        }
+
+        $timeout = (int) ($this->script->timeout ?: config('core-service-task.default_timeout', 60));
+        $max = (int) config('core-service-task.max_timeout', 300);
+        if ($max > 0 && $timeout > $max) {
+            $timeout = $max;
+        }
+        $timeout = max(1, $timeout);
+
+        if (config('core-service-task.execution', 'modules') === 'modules') {
+            $context = new ScriptExecutionContext(
+                data: $this->data,
+                config: $this->configuration,
+                user: $user,
+                tokenId: '',
+                timeout: $timeout,
+                scriptId: (int) $this->script->id,
+                source: 'preview',
+            );
+            $output = ScriptRuntime::run($this->code, $context);
+        } else {
+            $output = app(InProcessPhpRunner::class)->run(
+                $this->code,
+                $this->data,
+                $this->configuration,
+                $timeout,
+                $user
+            );
+        }
+
+        // Match runScript() response shape expected by the Script Editor UI
+        return ['output' => $output];
+    }
+
     /**
      * Send a response to the user interface
      *

tests/Feature/Api/ScriptsTest.php

@@ -422,6 +422,69 @@ public function testPreviewScriptFail()
         });
     }
 
+    /**
+     * Preview via Core Service Task in-process runner when allow_in_process is set.
+     */
+    public function testPreviewScriptInProcess()
+    {
+        config(['core-service-task.enabled' => true]);
+        $this->withPersonalAccessClient();
+
+        Event::fake([
+            ScriptResponseEvent::class,
+        ]);
+
+        $script = $this->getScript('php');
+        $script->allow_in_process = true;
+        $script->saveOrFail();
+
+        $url = route('api.scripts.preview', $script->id);
+        $response = $this->apiCall('POST', $url, [
+            'data' => '{"ping":"1"}',
+            'code' => '<?php return ["pong" => $data["ping"]];',
+            'nonce' => 'in-process-nonce',
+        ]);
+        $response->assertStatus(200);
+        $response->assertJson(['status' => 'success', 'run_in_process' => true]);
+
+        Event::assertDispatched(ScriptResponseEvent::class, function ($event) {
+            return ($event->response['output']['pong'] ?? null) === '1'
+                && $event->nonce === 'in-process-nonce';
+        });
+    }
+
+    /**
+     * Explicit run_in_process request flag for preview (before saving allow_in_process).
+     */
+    public function testPreviewScriptInProcessWithRequestFlag()
+    {
+        config(['core-service-task.enabled' => true]);
+        $this->withPersonalAccessClient();
+
+        Event::fake([
+            ScriptResponseEvent::class,
+        ]);
+
+        $script = $this->getScript('php');
+        $script->allow_in_process = false;
+        $script->saveOrFail();
+
+        $url = route('api.scripts.preview', $script->id);
+        $response = $this->apiCall('POST', $url, [
+            'data' => '{}',
+            'code' => '<?php return ["via" => "flag"];',
+            'nonce' => 'flag-nonce',
+            'run_in_process' => true,
+        ]);
+        $response->assertStatus(200);
+        $response->assertJson(['run_in_process' => true]);
+
+        Event::assertDispatched(ScriptResponseEvent::class, function ($event) {
+            return ($event->response['output']['via'] ?? null) === 'flag'
+                && $event->nonce === 'flag-nonce';
+        });
+    }
+
     /**
      * Delete script in process
      */

tests/unit/ScriptRunners/InProcessPhpRunnerTest.php

@@ -0,0 +1,85 @@
+<?php
+
+namespace Tests\Unit\ScriptRunners;
+
+use ProcessMaker\Exception\ScriptException;
+use ProcessMaker\Exception\ScriptTimeoutException;
+use ProcessMaker\Models\User;
+use ProcessMaker\ScriptRunners\InProcessPhpRunner;
+use Tests\TestCase;
+
+class InProcessPhpRunnerTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->withPersonalAccessClient();
+    }
+
+    public function testRunsPhpScriptAndReturnsArray(): void
+    {
+        $runner = new InProcessPhpRunner();
+        $user = User::factory()->create();
+
+        $output = $runner->run(
+            '<?php return ["pong" => $data["ping"], "cfg" => $config["mode"] ?? null];',
+            ['ping' => 'hello'],
+            ['mode' => 'test'],
+            30,
+            $user
+        );
+
+        $this->assertSame('hello', $output['pong']);
+        $this->assertSame('test', $output['cfg']);
+    }
+
+    public function testThrowsOnInvalidPhp(): void
+    {
+        $this->expectException(ScriptException::class);
+
+        $runner = new InProcessPhpRunner();
+        $runner->run(
+            '<?php this is not valid php;;;',
+            [],
+            [],
+            30,
+            User::factory()->create()
+        );
+    }
+
+    public function testRespectsTimeout(): void
+    {
+        $this->expectException(ScriptTimeoutException::class);
+
+        $runner = new InProcessPhpRunner();
+        $runner->run(
+            '<?php sleep(5); return ["ok" => true];',
+            [],
+            [],
+            1,
+            User::factory()->create()
+        );
+    }
+
+    public function testExposesApiHostAndTokenViaGetenv(): void
+    {
+        config(['app.docker_host_url' => 'https://pm.example.test']);
+
+        $runner = new InProcessPhpRunner();
+        $output = $runner->run(
+            '<?php return [
+                "host" => getenv("API_HOST"),
+                "has_token" => is_string(getenv("API_TOKEN")) && getenv("API_TOKEN") !== "",
+                "app_url" => getenv("APP_URL"),
+            ];',
+            [],
+            [],
+            30,
+            User::factory()->create()
+        );
+
+        $this->assertSame('https://pm.example.test/api/1.0', $output['host']);
+        $this->assertTrue($output['has_token']);
+        $this->assertSame('https://pm.example.test', $output['app_url']);
+    }
+}