FOUR-28840: Available self service tasks not displayed for non-admin users due to inefficient query for filtering

ProcessMaker/Http/Controllers/Api/TaskController.php

@@ -134,6 +134,14 @@ public function index(Request $request, $getTotal = false, User $user = null)
 
         $query = $this->indexBaseQuery($request);
 
+        // Get fields from request (sent by frontend)
+        // If not provided, don't apply select() to maintain backward compatibility (returns all columns)
+        $fields = $request->input('fields', '');
+        if ($fields) {
+            $selectedFields = explode(',', $fields);
+            $query = $query->select($selectedFields);
+        }
+
         $this->applyFilters($query, $request);
 
         $this->excludeNonVisibleTasks($query, $request);

ProcessMaker/Models/ProcessRequestToken.php

@@ -782,8 +782,7 @@ public function valueAliasStatus($value, $expression, $callback = null, User $us
 
                     $query->whereIn('process_request_tokens.id', $selfServiceTaskIds);
                 } elseif ($user) {
-                    $taskIds = $user->availableSelfServiceTaskIds();
-                    $query->whereIn('process_request_tokens.id', $taskIds);
+                    $query->whereIn('process_request_tokens.id', $user->availableSelfServiceTasksQuery());
                 } else {
                     $query->where('process_request_tokens.is_self_service', 1);
                 }

ProcessMaker/Models/User.php

@@ -466,11 +466,11 @@ public function removeFromGroups()
         $this->groups()->detach();
     }
 
-    public function availableSelfServiceTaskIds()
+    public function availableSelfServiceTasksQuery()
     {
         $groupIds = $this->groups()->pluck('groups.id');
 
-        $taskQuery = ProcessRequestToken::select(['id'])
+        $taskQuery = ProcessRequestToken::select(['process_request_tokens.id'])
         ->where([
             'is_self_service' => true,
             'status' => 'ACTIVE',
@@ -490,7 +490,12 @@ public function availableSelfServiceTaskIds()
             $query->orWhereJsonContains('self_service_groups->users', (string) $this->id);
         });
 
-        return $taskQuery->pluck('id');
+        return $taskQuery;
+    }
+
+    public function availableSelfServiceTaskIds()
+    {
+        return $this->availableSelfServiceTasksQuery()->pluck('id');
     }
 
     /**

ProcessMaker/Traits/TaskControllerIndexMethods.php

@@ -383,7 +383,7 @@ private function applyForCurrentUser($query, $user)
 
         $query->where(function ($query) use ($user) {
             $query->where('user_id', $user->id)
-                ->orWhereIn('id', $user->availableSelfServiceTaskIds());
+                ->orWhereIn('id', $user->availableSelfServiceTasksQuery());
         });
     }