From 0599a38657b15aa4425b48c956123e106827ffe2 Mon Sep 17 00:00:00 2001
From: Eleazar Resendez <eleazar.resendez@processmaker.com>
Date: Tue, 27 Jan 2026 12:34:01 -0600
Subject: [PATCH] fix(processes): validate owner on update and surface 422
 alerts

---
 .../Controllers/Api/ProcessController.php     | 13 +----
 .../Http/Requests/ProcessUpdateRequest.php    | 55 +++++++++++++++++++
 resources/views/processes/edit.blade.php      | 11 +++-
 3 files changed, 67 insertions(+), 12 deletions(-)
 create mode 100644 ProcessMaker/Http/Requests/ProcessUpdateRequest.php

diff --git a/ProcessMaker/Http/Controllers/Api/ProcessController.php b/ProcessMaker/Http/Controllers/Api/ProcessController.php
index e8b29b9e25..9e1e0af561 100644
--- a/ProcessMaker/Http/Controllers/Api/ProcessController.php
+++ b/ProcessMaker/Http/Controllers/Api/ProcessController.php
@@ -19,6 +19,7 @@
 use ProcessMaker\Http\Controllers\Api\GroupController;
 use ProcessMaker\Http\Controllers\Api\TemplateController;
 use ProcessMaker\Http\Controllers\Controller;
+use ProcessMaker\Http\Requests\ProcessUpdateRequest;
 use ProcessMaker\Http\Resources\ApiCollection;
 use ProcessMaker\Http\Resources\ApiResource;
 use ProcessMaker\Http\Resources\Process as Resource;
@@ -463,7 +464,7 @@ public function store(Request $request)
     /**
      * Updates the current element.
      *
-     * @param Request $request
+     * @param ProcessUpdateRequest $request
      * @param Process $process
      * @return ResponseFactory|Response
      *
@@ -494,21 +495,13 @@ public function store(Request $request)
      *     ),
      * )
      */
-    public function update(Request $request, Process $process)
+    public function update(ProcessUpdateRequest $request, Process $process)
     {
         $lastVersion = $process->getDraftOrPublishedLatestVersion();
         $process->bpmn = $lastVersion->bpmn;
         $process->alternative = $lastVersion->alternative;
         $process->stages = $lastVersion->stages;
 
-        $rules = Process::rules($process);
-        if (!$request->has('name')) {
-            unset($rules['name']);
-        }
-        if ($request->has('default_for_anon_webentry')) {
-            $rules = ['language_code' => 'required_if:default_for_anon_webentry,true'];
-        }
-        $request->validate($rules);
         $original = $process->getOriginal();
 
         // Replace html entities with the correct characters
diff --git a/ProcessMaker/Http/Requests/ProcessUpdateRequest.php b/ProcessMaker/Http/Requests/ProcessUpdateRequest.php
new file mode 100644
index 0000000000..af32e02e34
--- /dev/null
+++ b/ProcessMaker/Http/Requests/ProcessUpdateRequest.php
@@ -0,0 +1,55 @@
+<?php
+
+namespace ProcessMaker\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+use ProcessMaker\Models\Process;
+
+class ProcessUpdateRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        $process = $this->route('process');
+        $rules = Process::rules($process);
+
+        if (!$this->has('name')) {
+            unset($rules['name']);
+        }
+
+        if ($this->has('default_for_anon_webentry')) {
+            $rules = ['language_code' => 'required_if:default_for_anon_webentry,true'];
+        }
+
+        if ($this->has('user_id')) {
+            $rules['user_id'] = ['required', 'integer', 'exists:users,id'];
+        }
+
+        return $rules;
+    }
+
+    /**
+     * Get the validation messages that apply to the request.
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'user_id.required' => __('Process owner is required.'),
+            'user_id.exists' => __('Selected process owner is invalid.'),
+        ];
+    }
+}
diff --git a/resources/views/processes/edit.blade.php b/resources/views/processes/edit.blade.php
index acc1c011cb..784e0c7d3e 100644
--- a/resources/views/processes/edit.blade.php
+++ b/resources/views/processes/edit.blade.php
@@ -688,8 +688,15 @@ class="custom-control-input">
                     .catch(error => {
                         //define how display errors
                         if (error.response.status && error.response.status === 422) {
-                        // Validation error
-                        that.errors = error.response.data.errors;
+                            // Validation error
+                            that.errors = error.response.data.errors;
+                            const errors = that.errors || {};
+                            const firstFieldErrors = Object.values(errors).find(fieldErrors => Array.isArray(fieldErrors) && fieldErrors.length);
+                            const firstError = (firstFieldErrors && firstFieldErrors[0]) || error.response.data.message;
+
+                            if (firstError) {
+                                window.ProcessMaker.alert(that.$t(firstError), 'danger');
+                            }
                         }
                     });
                 },