Fix Property mapping /authzRoles transformation script encountered exception javax.script.ScriptException: Script status is 8

[vharseko]

samples/workflow: extract role-mapping transforms into script/*.js files

Summary

Replaces the two inline JavaScript transforms in
openidm-zip/src/main/resources/samples/workflow/conf/sync.json (mapping
systemXmlfileAccounts_managedUser, properties
roles → authzRoles and → roles) with file-based scripts under
samples/workflow/script/.

Motivation

The CI job ui-smoke-tests (17, samples/workflow) failed even though every
Playwright test passed (one was retried as flaky). The "Print openidm logs"
step found this in openidm/logs/openidm0.log.0 and exited 1:

WARNING: Property mapping /authzRoles transformation script encountered exception
javax.script.ScriptException: Script status is 8
    at org.forgerock.script.registry.ScriptRegistryImpl$LibraryRecord.invoke(ScriptRegistryImpl.java:507)
    ...
org.forgerock.openidm.sync.SynchronizationException:
    Transformation script error : Script status is 8 for attribute '/authzRoles'

8 is CompilationHandler.STARTING (UNINSTALLED=1, INSTALLED=2, RESOLVED=4, STARTING=8, ACTIVE=32). ScriptRegistryImpl#invoke:

if (null != target) return method.invoke(target, arguments);
else throw new ScriptException("Script status is " + status);

Inline scripts embedded directly in sync.json are compiled and registered
asynchronously when the mapping config is loaded. The first reconciliation
that runs immediately after boot can hit the script while it is still
transitioning STARTING → ACTIVE (target == null) and throw. The same
recon retried a few seconds later succeeds — exactly what we see in the
failed run logs.

File-based scripts are registered through the same path used by every other
OpenIDM sample (e.g. existing correlationQuery.js, usecase/.../*.js,
sample5/getEffectiveAssignments.js) and are guaranteed to be ACTIVE by
the time mappings run, so the race window does not exist.

Changes

openidm-zip/src/main/resources/samples/workflow/script/rolesToAuthzRoles.js (new)

Replaces the inline transform that turns the comma-separated XML roles
attribute into the array form expected by managed/user.authzRoles:

source.split(',').map(function (r) {
    return {'_ref' : (r.indexOf('openidm-') === 0
                          ? 'repo/internal/role/'
                          : 'managed/role/') + r };
})

The file version adds null/empty guards, so a missing <ri:roles/> no
longer throws but yields [].

openidm-zip/src/main/resources/samples/workflow/script/authzRolesToRoles.js (new)

Replaces the inline transform that flattens authzRoles back into the
comma-separated XML roles value:

openidm.query('managed/user/' + source._id + '/authzRoles',
              {'_queryFilter': 'true'})
       .result.map(function (r) { return r._ref.split('/').pop(); })
       .join(',')

Adds defensive checks for source / source._id and an empty query result.

openidm-zip/src/main/resources/samples/workflow/conf/sync.json

Two "transform" blocks updated:

-  "transform" : {
-      "type" : "text/javascript",
-      "source" : "source.split(',').map(function (r) { ... })"
-  },
+  "transform" : {
+      "type" : "text/javascript",
+      "file" : "script/rolesToAuthzRoles.js"
+  },

-  "transform" : {
-      "type" : "text/javascript",
-      "source" : "openidm.query('managed/user/' + source._id + ...).result.map(...).join(',')"
-  },
+  "transform" : {
+      "type" : "text/javascript",
+      "file" : "script/authzRolesToRoles.js"
+  },

No other changes to mappings, policies, properties or test data.

Compatibility

• Same observable behaviour: same input → same output (plus graceful
  handling of empty/null sources, which previously threw).
• Same mapping shape, same property names, no schema or config-format
  changes.
• Sample assembly already packages
  samples/workflow/script/correlationQuery.js; the two new files end up
  in samples/workflow/script/ of the distribution zip with no assembly
  changes.

Verification

• python3 -m json.tool sync.json — config still valid JSON.
• mvn -pl openidm-zip package -DskipTests — green.
• Built openidm-*.zip contains:
  • openidm/samples/workflow/script/rolesToAuthzRoles.js
  • openidm/samples/workflow/script/authzRolesToRoles.js
  • updated openidm/samples/workflow/conf/sync.json referencing both files.
• Local run of samples/workflow reconciliations (Step 2 a-d of the README)
  no longer logs Script status is 8 for attribute '/authzRoles'; the
  strict CI log scan (grep -E "ERROR|SEVERE|Exception|Throwable" over
  openidm/logs/*) is clean.