ProcessMaker · pmPaulis · Jul 30, 2026 · Jul 31, 2026 · Jul 31, 2026 · Jul 31, 2026
diff --git a/ProcessMaker/Console/Commands/UnblockRequest.php b/ProcessMaker/Console/Commands/UnblockRequest.php
@@ -64,7 +64,7 @@ public function handle(): int
 
         $retryRequest->retry();
 
-        foreach ($retryRequest::$output as $line) {
+        foreach ($retryRequest->getOutput() as $line) {
             $this->info($line);
         }
 

diff --git a/ProcessMaker/Http/Controllers/Api/ProcessRequestController.php b/ProcessMaker/Http/Controllers/Api/ProcessRequestController.php
@@ -304,7 +304,7 @@ public function retry(ProcessRequest $request, Request $httpRequest): JsonRespon
             $retryRequest->retry();
 
             return response()->json([
-                'message' => $retryRequest::$output,
+                'message' => $retryRequest->getOutput(),
                 'success' => true,
             ]);
         } catch (Throwable $throwable) {

diff --git a/ProcessMaker/Http/Middleware/ServerTimingMiddleware.php b/ProcessMaker/Http/Middleware/ServerTimingMiddleware.php
@@ -5,22 +5,19 @@
 use Closure;
 use Illuminate\Http\Request;
 use ProcessMaker\Providers\ProcessMakerServiceProvider;
+use ProcessMaker\Services\WorkerBootTimingService;
 use Symfony\Component\HttpFoundation\Response;
 
 class ServerTimingMiddleware
 {
-    // Minimum time in ms to include a package in the Server-Timing header
-    private static $minPackageTime;
-
-    public function __construct()
+    public function __construct(private WorkerBootTimingService $workerBootTimingService)
     {
-        self::$minPackageTime = config('app.server_timing.min_package_time');
     }
 
     /**
      * Handle an incoming request.
      *
-     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     * @param  Closure(Request): (Response)  $next
      */
     public function handle(Request $request, Closure $next): Response
     {
@@ -39,7 +36,7 @@ public function handle(Request $request, Closure $next): Response
         // Calculate execution times
         $controllerTime = (microtime(true) - $startController) * 1000; // Convert to ms
         // Fetch service provider boot time
-        $serviceProviderTime = ProcessMakerServiceProvider::getBootTime() ?? 0;
+        $serviceProviderTime = $this->workerBootTimingService->getProviderBootTime() ?? 0;
         // Fetch query time
         $queryTime = ProcessMakerServiceProvider::getQueryTime() ?? 0;
 
@@ -55,13 +52,14 @@ public function handle(Request $request, Closure $next): Response
             array_unshift($serverTiming, "boot;dur={$bootTiming}");
         }
 
-        $packageTimes = ProcessMakerServiceProvider::getPackageBootTiming();
+        $packageTimes = $this->workerBootTimingService->getPackageBootTiming();
+        $minPackageTime = config('app.server_timing.min_package_time');
 
         foreach ($packageTimes as $package => $timing) {
             $time = ($timing['end'] - $timing['start']) * 1000;
 
             // Only include packages that took more than MIN_PACKAGE_TIME ms
-            if ($time > self::$minPackageTime) {
+            if ($time > $minPackageTime) {
                 $serverTiming[] = "{$package};dur={$time}";
             }
         }

diff --git a/ProcessMaker/ImportExport/Manifest.php b/ProcessMaker/ImportExport/Manifest.php
@@ -21,6 +21,12 @@ class Manifest
 
     private static $logger = null;
 
+    public static function resetRequestState(): void
+    {
+        self::$parents = null;
+        self::$logger = null;
+    }
+
     public function has(string $uuid)
     {
         return array_key_exists($uuid, $this->manifest);

diff --git a/ProcessMaker/Jobs/BpmnAction.php b/ProcessMaker/Jobs/BpmnAction.php
@@ -14,10 +14,10 @@
 use Illuminate\Support\Facades\Log;
 use ProcessMaker\BpmnEngine;
 use ProcessMaker\Exception\HttpABTestingException;
-use ProcessMaker\Listeners\HandleRedirectListener;
 use ProcessMaker\Models\Process as Definitions;
 use ProcessMaker\Models\ProcessRequest;
 use ProcessMaker\Models\ProcessRequestLock;
+use ProcessMaker\Services\RedirectToEventService;
 use Throwable;
 
 abstract class BpmnAction implements ShouldQueue
@@ -60,6 +60,7 @@ abstract class BpmnAction implements ShouldQueue
     public function handle()
     {
         $response = null;
+        $redirectToEventService = app(RedirectToEventService::class);
         try {
             extract($this->loadContext());
             $this->engine = $engine;
@@ -74,7 +75,7 @@ public function handle()
             // (e.g. completed, assigned, process completed, etc)
             // excluding system process (non_persistent_process)
             if ($this->processId !== 'non_persistent_process') {
-                HandleRedirectListener::sendRedirectToEvent();
+                $redirectToEventService->sendRedirectToEvent();
             }
         } catch (HttpABTestingException $exception) {
             Log::error($exception->getMessage());
@@ -87,6 +88,7 @@ public function handle()
                 $request->logError($exception, $element);
             }
         } finally {
+            $redirectToEventService->reset();
             $this->unlock();
         }
 

diff --git a/ProcessMaker/Listeners/HandleRedirectListener.php b/ProcessMaker/Listeners/HandleRedirectListener.php
@@ -2,51 +2,19 @@
 
 namespace ProcessMaker\Listeners;
 
-use ProcessMaker\Events\RedirectToEvent;
 use ProcessMaker\Models\ProcessRequest;
+use ProcessMaker\Services\RedirectToEventService;
 
 class HandleRedirectListener
 {
-    private static $processRequest = null;
-
-    protected static $redirectionMethod = '';
-
-    private static $redirectionParams = [];
-
-    protected function setRedirectTo(ProcessRequest $processRequest, string $method, ...$params): void
-    {
-        self::$processRequest = $processRequest;
-        self::$redirectionMethod = $method;
-        self::$redirectionParams = $params;
+    public function __construct(
+        private ?RedirectToEventService $redirectToEventService = null
+    ) {
     }
 
-    /**
-     * Reset the static state for Octane compatibility.
-     * This prevents data leaks between requests in long-running workers.
-     */
-    public static function reset(): void
-    {
-        self::$processRequest = null;
-        self::$redirectionMethod = '';
-        self::$redirectionParams = [];
-    }
-
-    public static function sendRedirectToEvent()
+    protected function setRedirectTo(ProcessRequest $processRequest, string $method, ...$params): void
     {
-        $method = self::$redirectionMethod;
-        $params = self::$redirectionParams;
-        $processRequest = self::$processRequest;
-
-        // Only get active tokens if there is a valid process request
-        if ($processRequest !== null) {
-            $params['activeTokens'] = ProcessRequest::getActiveTokens($processRequest);
-            $event = new RedirectToEvent($processRequest, $method, $params);
-            event($event);
-
-            // Clean params to prevent sending the same redirect multiple times
-            self::$redirectionParams = [];
-            self::$redirectionMethod = '';
-            self::$processRequest = null;
-        }
+        $this->redirectToEventService ??= app(RedirectToEventService::class);
+        $this->redirectToEventService->setRedirectTo($processRequest, $method, ...$params);
     }
 }
diff --git a/ProcessMaker/Managers/ControllerAddonsRegistry.php b/ProcessMaker/Managers/ControllerAddonsRegistry.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace ProcessMaker\Managers;
+
+class ControllerAddonsRegistry
+{
+    private $addons = [];
+
+    /**
+     * Register a controller addon.
+     */
+    public function register(string $scope, array $config): void
+    {
+        $config['scope'] = $scope;
+        $this->addons[] = $config;
+    }
+
+    /**
+     * Get configured addons for a controller.
+     */
+    public function getAddons(string $scope, string $method, array $data): array
+    {
+        $addons = [];
+
+        foreach ($this->addons as $addon) {
+            if ($addon['method'] !== $method || $addon['scope'] !== $scope) {
+                continue;
+            }
+
+            if (isset($addon['data']) && is_callable($addon['data'])) {
+                $data = call_user_func($addon['data'], $data);
+            }
+
+            $addon['content'] = isset($addon['view']) && !isset($addon['content'])
+                ? view($addon['view'], $data)->render()
+                : (isset($addon['content']) ? $addon['content'] : '');
+            $addon['script'] = isset($addon['script']) && is_string($addon['script'])
+                ? view($addon['script'], $data)->render()
+                : '';
+            $addons[] = $addon;
+        }
+
+        return $addons;
+    }
+}
diff --git a/ProcessMaker/Models/AnonymousUser.php b/ProcessMaker/Models/AnonymousUser.php
@@ -12,6 +12,12 @@ class AnonymousUser extends User
 
     protected $table = 'users';
 
+    public static function resolve(): self
+    {
+        return static::where('username', '=', static::ANONYMOUS_USERNAME)
+            ->firstOrFail();
+    }
+
     public $isAnonymous = true;
 
     public function receivesBroadcastNotificationsOn($notification)

diff --git a/ProcessMaker/Multitenancy/SwitchTenant.php b/ProcessMaker/Multitenancy/SwitchTenant.php
@@ -6,6 +6,7 @@
 use Illuminate\Contracts\Routing\UrlGenerator;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Env;
+use Illuminate\Support\Facades\Context;
 use Monolog\Handler\RotatingFileHandler;
 use ProcessMaker\Application;
 use ProcessMaker\Multitenancy\Broadcasting\TenantAwareBroadcastManager;
@@ -17,7 +18,7 @@ class SwitchTenant implements SwitchTenantTask
 {
     use UsesMultitenancyConfig;
 
-    public static $landlordValues = null;
+    private const LANDLORD_VALUES_CONTEXT_KEY = 'multitenancy.landlord_values';
 
     /**
      * Make the given tenant current.
@@ -31,9 +32,8 @@ public function makeCurrent(IsTenant $tenant): void
 
         \Log::debug('SwitchTenant: ' . $tenant->id, ['domain' => request()->getHost()]);
 
-        // Save the landlord values for later use
-        if (!self::$landlordValues) {
-            self::$landlordValues = $app->make('config')->all();
+        if (!Context::has(self::LANDLORD_VALUES_CONTEXT_KEY)) {
+            Context::add(self::LANDLORD_VALUES_CONTEXT_KEY, $app->make('config')->all());
         }
 
         // Set the tenant's domain in the request headers. Used for things like the global url() helper.
@@ -70,7 +70,7 @@ public function forgetCurrent(): void
 
     private function landlordConfig($key)
     {
-        return Arr::get(self::$landlordValues, $key);
+        return Arr::get(Context::get(self::LANDLORD_VALUES_CONTEXT_KEY), $key);
     }
 
     private function setConfig($key, $value)

diff --git a/ProcessMaker/Nayra/Repositories/EntityRepository.php b/ProcessMaker/Nayra/Repositories/EntityRepository.php
@@ -11,7 +11,7 @@
 
 abstract class EntityRepository
 {
-    private static $uid2id = ['requests' =>[], 'tokens' =>[]];
+    private $uid2id = ['requests' =>[], 'tokens' =>[]];
 
     abstract public function create(array $transaction): ? Model;
 
@@ -41,16 +41,16 @@ public function resolveId(string $uid): int
         }
 
         // Get record if is not stored previously
-        if (!isset(self::$uid2id[$type][$uid])) {
+        if (!isset($this->uid2id[$type][$uid])) {
             $record = $instance->select('id')->where('uuid', $uid)->first();
             if ($record) {
-                self::$uid2id[$type][$uid] = $record->getKey();
+                $this->uid2id[$type][$uid] = $record->getKey();
             } else {
                 throw new Exception("The uid {$uid} does not exist in the database");
             }
         }
 
-        return self::$uid2id[$type][$uid] ?? 0;
+        return $this->uid2id[$type][$uid] ?? 0;
     }
 
     /**
@@ -71,6 +71,6 @@ public function storeUid(string $uid, int $id): void
                 break;
         }
 
-        self::$uid2id[$type][$uid] = $id;
+        $this->uid2id[$type][$uid] = $id;
     }
 }
diff --git a/ProcessMaker/Observers/SettingObserver.php b/ProcessMaker/Observers/SettingObserver.php
@@ -10,7 +10,7 @@
 
 class SettingObserver
 {
-    private static $added_refresh_artisan_caches = false;
+    private bool $addedRefreshArtisanCaches = false;
 
     /**
      * Handle the setting "created" event.
@@ -95,7 +95,7 @@ private function invalidateSettingCache(Setting $setting)
 
         // Check to see if we already added the refresh to the app's terminating queue.
         // This is important for install commands when multiple settings are being created/updated.
-        if (self::$added_refresh_artisan_caches) {
+        if ($this->addedRefreshArtisanCaches) {
             return;
         }
 
@@ -106,6 +106,6 @@ private function invalidateSettingCache(Setting $setting)
             RefreshArtisanCaches::dispatchSync();
         });
 
-        self::$added_refresh_artisan_caches = true;
+        $this->addedRefreshArtisanCaches = true;
     }
 }
diff --git a/ProcessMaker/Octane/ResetRequestState.php b/ProcessMaker/Octane/ResetRequestState.php
@@ -4,14 +4,21 @@
 
 namespace ProcessMaker\Octane;
 
-use ProcessMaker\Listeners\HandleRedirectListener;
+use ProcessMaker\ImportExport\Manifest;
 use ProcessMaker\Providers\ProcessMakerServiceProvider;
+use ProcessMaker\Services\RedirectToEventService;
 
 final class ResetRequestState
 {
+    public function __construct(
+        private readonly RedirectToEventService $redirectToEventService
+    ) {
+    }
+
     public function handle(): void
     {
         ProcessMakerServiceProvider::beginRequestTiming();
-        HandleRedirectListener::reset();
+        Manifest::resetRequestState();
+        $this->redirectToEventService->reset();
     }
 }