FOUR-30918 [EPIC] Phase 1: Platform Performance Tentpole Project

[pmPaulis]

Phase 1: Platform Performance Tentpole Project

Related Tickets & Packages

• https://processmaker.atlassian.net/browse/FOUR-30918

Code Review Checklist

• I have pulled this code locally and tested it on my instance, along with any associated packages.
• This code adheres to ProcessMaker Coding Guidelines.
• This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
• This solution fixes the bug reported in the original ticket.
• This solution does not alter the expected output of a component in a way that would break existing Processes.
• This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
• This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
• This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
• This ticket conforms to the PRD associated with this part of ProcessMaker.

ci:screen-builder:feature/FOUR-30918
ci:vue-form-elements:feature/FOUR-30918

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
34069781	Triggered	Generic Password	6072037	resources/views/auth/newLogin.blade.php	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[processmaker-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[cursor]

PR Summary

Medium Risk
Default-on optimized task queries and conditional HTML caching change hot paths; incorrect ETag invalidation or query parity could show stale UI or miss tasks until config is toggled.

Overview
Phase 1 performance work speeds up Tasks listing, the Tasks page shell, and task edit load paths.

When OPTIMIZED_TASKS_ENABLED is on (default), the main tasks API index delegates to V1_1 indexOptimized, which trims selected columns/relations, maps UI columns to DB fields, and uses a lighter nonSystem filter for tokens. A dedicated GET /api/1.1/tasks/tasksOptimized route is also exposed.

The /tasks web route switches from no-cache to tasks-page-etag middleware, which hashes stable user/permission/config/asset context and can answer matching requests with 304 plus Cache-Control: private, must-revalidate. BrowserCache no longer forces no-store when a response already has an ETag.

On the client, installApiClientCache wraps the shared Axios client (opt-in GET caching and in-flight deduplication). Task edit defers “viewed” tracking, avoids the comment lookup when the user can update, lazy-loads the Data tab/Monaco, and preloads key JS bundles.

Feature and Jest tests cover ETag behavior and the API client cache helper.

^{Reviewed by Cursor Bugbot for commit 762958b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 762958b. Configure here.}

[cursor]

Task column projection omits required fields

High Severity

The optimized task list now selects from the columns query param, but the required-field list only keeps id, process_id, and process_request_id. Default inbox columns never include assignee, so user_id and uuid are dropped. The list always asks for include=user, and row updates match on uuid, so assignees fail to load and viewed-state updates can hit the wrong row. Text search also applies a post-query view gate that reads user_id, which can empty filtered results.

Additional Locations (1)

• ProcessMaker/Traits/TaskControllerIndexMethods.php#L26-L38

 

^{Reviewed by Cursor Bugbot for commit 762958b. Configure here.}

[cursor]

Case titles lose formatted display text

Medium Severity

The optimized processRequest eager-load selects case_title but not case_title_formatted. The inbox title renderer prefers the formatted value, so case titles lose their stored highlighting and fall back to the plain title.

 

^{Reviewed by Cursor Bugbot for commit 762958b. Configure here.}