thatcher 1.0.4

package/src/lib/audit-logger.js

@@ -0,0 +1,193 @@
+import { getDatabase, genId, now } from '@/lib/database-core';
+import { Mutex } from '@/lib/hot-reload/mutex';
+
+const db = getDatabase();
+const auditMutex = new Mutex('audit-logger');
+
+export const ACTIVITY_TYPES = {
+  RFI_QUESTION_VIEW: 'rfi_question_view',
+  RFI_QUESTION_RESPOND: 'rfi_question_respond',
+  RFI_QUESTION_COMMENT: 'rfi_question_comment',
+  RFI_QUESTION_CREATE: 'rfi_question_create',
+  RFI_QUESTION_UPDATE: 'rfi_question_update',
+  RFI_QUESTION_DELETE: 'rfi_question_delete',
+  RFI_QUESTION_ASSIGN: 'rfi_question_assign',
+  RFI_QUESTION_DEADLINE: 'rfi_question_deadline',
+  HIGHLIGHT_CREATE: 'highlight_create',
+  HIGHLIGHT_RESOLVE: 'highlight_resolve',
+  HIGHLIGHT_REOPEN: 'highlight_reopen',
+  HIGHLIGHT_DELETE: 'highlight_delete',
+  REVIEW_CREATE: 'review_create',
+  REVIEW_UPDATE: 'review_update',
+  REVIEW_ARCHIVE: 'review_archive',
+  COLLABORATOR_ADD: 'collaborator_add',
+  COLLABORATOR_REMOVE: 'collaborator_remove',
+  PERMISSION_CHANGE: 'permission_change',
+  ROLE_CHANGE: 'role_change',
+};
+
+const parseJson = (val) => val ? JSON.parse(val) : null;
+
+const parseRow = (row) => row ? {
+  ...row,
+  old_permissions: parseJson(row.old_permissions),
+  new_permissions: parseJson(row.new_permissions),
+  metadata: parseJson(row.metadata),
+  before_state: parseJson(row.before_state),
+  after_state: parseJson(row.after_state),
+} : null;
+
+export const logAction = (entityType, entityId, action, userId, beforeState, afterState) => {
+  const id = genId();
+  const timestamp = now();
+  db.prepare(`
+    INSERT INTO audit_logs (id, entity_type, entity_id, action, user_id, before_state, after_state, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(id, entityType, entityId, action, userId || null,
+    beforeState ? JSON.stringify(beforeState) : null,
+    afterState ? JSON.stringify(afterState) : null,
+    timestamp
+  );
+  return { id, timestamp };
+};
+
+export const getAuditHistory = (filters = {}, page = 1, pageSize = 50) => {
+  const wc = [], params = [];
+  if (filters.entityType) { wc.push('entity_type = ?'); params.push(filters.entityType); }
+  if (filters.entityId) { wc.push('entity_id = ?'); params.push(filters.entityId); }
+  if (filters.userId) { wc.push('user_id = ?'); params.push(filters.userId); }
+  if (filters.action) { wc.push('action = ?'); params.push(filters.action); }
+  if (filters.fromDate) { wc.push('created_at >= ?'); params.push(filters.fromDate); }
+  if (filters.toDate) { wc.push('created_at <= ?'); params.push(filters.toDate); }
+  const where = wc.length ? 'WHERE ' + wc.join(' AND ') : '';
+  const { count: total } = db.prepare(`SELECT COUNT(*) as count FROM audit_logs ${where}`).get(...params);
+  const offset = (page - 1) * pageSize;
+  const items = db.prepare(`SELECT * FROM audit_logs ${where} ORDER BY created_at DESC LIMIT ? OFFSET ?`).all(...params, pageSize, offset);
+  return {
+    items: items.map(i => ({
+      id: i.id, entityType: i.entity_type, entityId: i.entity_id, action: i.action,
+      userId: i.user_id, beforeState: parseJson(i.before_state), afterState: parseJson(i.after_state), createdAt: i.created_at,
+    })),
+    pagination: { page, pageSize, total, totalPages: Math.ceil(total / pageSize) },
+  };
+};
+
+export const getEntityAuditTrail = (entityType, entityId) => {
+  return db.prepare(`SELECT * FROM audit_logs WHERE entity_type = ? AND entity_id = ? ORDER BY created_at DESC`).all(entityType, entityId)
+    .map(i => ({ id: i.id, action: i.action, userId: i.user_id, beforeState: parseJson(i.before_state), afterState: parseJson(i.after_state), createdAt: i.created_at }));
+};
+
+const statsSql = (col) => `SELECT ${col}, COUNT(*) as count FROM audit_logs WHERE created_at >= ? AND created_at <= ? GROUP BY ${col} ORDER BY count DESC`;
+export const getActionStats = (fromDate, toDate) => db.prepare(statsSql('action')).all(fromDate, toDate);
+export const getUserStats = (fromDate, toDate) => db.prepare(statsSql('user_id')).all(fromDate, toDate);
+
+export const logPermissionChange = ({
+  userId, entityType, entityId, action, oldPermissions = null, newPermissions = null,
+  reason = null, reasonCode = 'other', affectedUserId = null, ipAddress = null, sessionId = null, metadata = null,
+}) => {
+  if (!userId || !entityType || !entityId || !action) throw new Error('Missing required audit fields');
+  const auditId = genId();
+  const timestamp = now();
+  db.prepare(`
+    INSERT INTO permission_audit (id, user_id, entity_type, entity_id, action, old_permissions, new_permissions,
+      reason, reason_code, timestamp, ip_address, session_id, affected_user_id, metadata, created_at, updated_at, created_by, updated_by)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(auditId, userId, entityType, entityId, action,
+    oldPermissions ? JSON.stringify(oldPermissions) : null, newPermissions ? JSON.stringify(newPermissions) : null,
+    reason, reasonCode, timestamp, ipAddress, sessionId, affectedUserId,
+    metadata ? JSON.stringify(metadata) : null, timestamp, timestamp, userId, userId
+  );
+  return auditId;
+};
+
+export const auditPermissionChange = async ({ user, entityType, entityId, action, oldPermissions = null,
+  newPermissions = null, affectedUserId = null, reason = null, reasonCode = 'admin_action', metadata = null }) => {
+  return auditMutex.runExclusive(() => {
+    try {
+      logPermissionChange({ userId: user.id, entityType, entityId, action, oldPermissions, newPermissions,
+        reason: reason || `Permission ${action}`, reasonCode, affectedUserId, metadata });
+    } catch (error) {
+      console.error('[Audit] Failed to log permission change:', error);
+    }
+  });
+};
+
+export const auditRoleChange = async ({ user, targetUserId, oldRole, newRole, reason = null, metadata = null }) => {
+  await auditPermissionChange({ user, entityType: 'user', entityId: targetUserId, action: 'role_change',
+    oldPermissions: { role: oldRole }, newPermissions: { role: newRole },
+    affectedUserId: targetUserId, reason: reason || `Role changed from ${oldRole} to ${newRole}`,
+    reasonCode: 'role_change', metadata: { ...metadata, old_role: oldRole, new_role: newRole } });
+};
+
+export const auditCollaboratorAdded = async ({ user, reviewId, collaboratorId, collaboratorUserId, permissions = null, reason = null, metadata = null }) => {
+  await auditPermissionChange({ user, entityType: 'review', entityId: reviewId, action: 'grant',
+    newPermissions: permissions || { access: 'collaborator' }, affectedUserId: collaboratorUserId,
+    reason: reason || 'Collaborator added to review', reasonCode: 'collaborator_added',
+    metadata: { ...metadata, collaborator_id: collaboratorId, review_id: reviewId } });
+};
+
+export const auditCollaboratorRemoved = async ({ user, reviewId, collaboratorId, collaboratorUserId, permissions = null, reason = null, metadata = null }) => {
+  await auditPermissionChange({ user, entityType: 'review', entityId: reviewId, action: 'revoke',
+    oldPermissions: permissions || { access: 'collaborator' }, affectedUserId: collaboratorUserId,
+    reason: reason || 'Collaborator removed from review', reasonCode: 'collaborator_removed',
+    metadata: { ...metadata, collaborator_id: collaboratorId, review_id: reviewId } });
+};
+
+export const auditLifecycleTransition = async ({ user, entityType, entityId, fromStage, toStage, metadata = null }) => {
+  await auditPermissionChange({ user, entityType, entityId, action: 'modify',
+    oldPermissions: { stage: fromStage }, newPermissions: { stage: toStage },
+    reason: `Lifecycle transition: ${fromStage} -> ${toStage}`, reasonCode: 'lifecycle_transition',
+    metadata: { ...metadata, from_stage: fromStage, to_stage: toStage } });
+};
+
+export const auditPermissionModify = async ({ user, entityType, entityId, oldPermissions, newPermissions,
+  affectedUserId = null, reason = null, reasonCode = 'admin_action', metadata = null }) => {
+  await auditPermissionChange({ user, entityType, entityId, action: 'modify',
+    oldPermissions, newPermissions, affectedUserId, reason: reason || 'Permissions modified', reasonCode, metadata });
+};
+
+export const getPermissionAuditTrail = ({ entityType, entityId, userId, affectedUserId, limit = 100, offset = 0 }) => {
+  let sql = 'SELECT * FROM permission_audit WHERE 1=1';
+  const params = [];
+  if (entityType) { sql += ' AND entity_type = ?'; params.push(entityType); }
+  if (entityId) { sql += ' AND entity_id = ?'; params.push(entityId); }
+  if (userId) { sql += ' AND user_id = ?'; params.push(userId); }
+  if (affectedUserId) { sql += ' AND affected_user_id = ?'; params.push(affectedUserId); }
+  sql += ' ORDER BY timestamp DESC LIMIT ? OFFSET ?';
+  return db.prepare(sql).all(...params, limit, offset).map(parseRow);
+};
+
+export const getPermissionAuditById = (auditId) => parseRow(db.prepare('SELECT * FROM permission_audit WHERE id = ?').get(auditId));
+export const getPermissionAuditStats = () => db.prepare(`SELECT COUNT(*) as total_audits, COUNT(DISTINCT user_id) as unique_users, COUNT(DISTINCT entity_type) as entity_types, MIN(timestamp) as earliest_change, MAX(timestamp) as latest_change FROM permission_audit`).get();
+export const getPermissionAuditBreakdown = (field) => db.prepare(`SELECT ${field}, COUNT(*) as count FROM permission_audit GROUP BY ${field} ORDER BY count DESC`).all();
+
+export const searchPermissionAudit = (searchTerm, limit = 100) => {
+  const pattern = `%${searchTerm}%`;
+  return db.prepare(`SELECT * FROM permission_audit WHERE reason LIKE ? OR entity_type LIKE ? OR entity_id LIKE ? ORDER BY timestamp DESC LIMIT ?`)
+    .all(pattern, pattern, pattern, limit).map(parseRow);
+};
+
+export const getPermissionAuditByDateRange = (startDate, endDate, limit = 100) =>
+  db.prepare(`SELECT * FROM permission_audit WHERE timestamp >= ? AND timestamp <= ? ORDER BY timestamp DESC LIMIT ?`).all(startDate, endDate, limit).map(parseRow);
+
+export const exportPermissionAuditCSV = async (filters = {}) => {
+  const trail = getPermissionAuditTrail({ ...filters, limit: 10000 });
+  const h = 'Timestamp,Changed By,Entity Type,Entity ID,Action,Reason Code,Reason,Affected User,IP Address';
+  const rows = trail.map(a => [new Date(a.timestamp * 1000).toISOString(), a.user_id, a.entity_type,
+    a.entity_id, a.action, a.reason_code, a.reason || '', a.affected_user_id || '', a.ip_address || '']
+    .map(c => `"${c}"`).join(','));
+  return [h, ...rows].join('\n');
+};
+
+export const logQuestionActivity = (questionId, action, userId, details = null) => {
+  return logAction('rfi_question', questionId, action, userId, null, details);
+};
+
+export const getPermissionDiff = (oldPerms, newPerms) => {
+  const diff = { added: [], removed: [], unchanged: [] };
+  const oldSet = new Set(Array.isArray(oldPerms) ? oldPerms : []);
+  const newSet = new Set(Array.isArray(newPerms) ? newPerms : []);
+  for (const p of newSet) { if (!oldSet.has(p)) diff.added.push(p); else diff.unchanged.push(p); }
+  for (const p of oldSet) { if (!newSet.has(p)) diff.removed.push(p); }
+  return diff;
+};

package/src/lib/auth-middleware.js

@@ -0,0 +1,102 @@
+/**
+ * Auth Middleware - Authentication and authorization utilities
+ * Adapted from moonlanding/src/lib/auth-middleware.js
+ */
+
+import { getUser, lucia } from '../engine.server.js'; // Will need to adapt
+import { getSpec } from './spec-helpers.js';
+import { can } from '../services/permission.service.js';
+import { UnauthorizedError, PermissionError, NotFoundError } from './error-handler.js';
+
+const actionMap = {
+  list: 'list',
+  get: 'view',
+  view: 'view',
+  create: 'create',
+  update: 'edit',
+  edit: 'edit',
+  delete: 'delete',
+};
+
+/**
+ * Get session token from request headers
+ * @param {object} req - HTTP request
+ * @returns {string|null}
+ */
+export function getSessionToken(req) {
+  const cookieHeader = req?.headers?.cookie || '';
+  if (!cookieHeader) return null;
+  const cookieName = lucia?.sessionCookieName || 'thatcher_session';
+  const match = cookieHeader.split(';').find(c => c.trim().startsWith(cookieName + '='));
+  if (!match) return null;
+  const value = match.split('=')[1];
+  return value ? decodeURIComponent(value.trim()) : null;
+}
+
+/**
+ * Require authentication (throws if not authenticated)
+ * @returns {Promise<object>} User object
+ */
+export async function requireAuth() {
+  const user = await getUser();
+  if (!user) throw UnauthorizedError('Authentication required');
+  return user;
+}
+
+/**
+ * Require permission for action on spec
+ * @param {object} user
+ * @param {object} spec
+ * @param {string} action
+ */
+export async function requirePermission(user, spec, action) {
+  const mapped = actionMap[action] || action;
+  if (!(await can(user, spec, mapped))) {
+    throw PermissionError(`Cannot ${action} ${spec.name}`);
+  }
+}
+
+/**
+ * Create authenticated handler wrapper
+ * @param {Function} handler
+ * @param {string} action
+ * @returns {Function}
+ */
+export function withAuth(handler, action = 'view') {
+  return async (request, context) => {
+    const user = await requireAuth();
+    const entity = context.params?.entity || context.entity;
+    const spec = entity ? getSpec(entity) : null;
+    if (spec) await requirePermission(user, spec, action);
+    return handler(request, { ...context, user, spec });
+  };
+}
+
+/**
+ * Page auth (for HTML page rendering)
+ * @param {string} entityName
+ * @param {string} action
+ * @param {object} options
+ * @returns {Promise<{user, spec}>}
+ */
+export async function withPageAuth(entityName, action = 'view', options = {}) {
+  const user = await getUser();
+  if (!user) throw UnauthorizedError('Not authenticated');
+
+  let spec;
+  try {
+    spec = getSpec(entityName);
+  } catch {
+    throw NotFoundError(`Entity ${entityName} not found`);
+  }
+
+  if (options.notEmbedded !== false && spec.embedded) {
+    throw NotFoundError('Entity is embedded');
+  }
+
+  if (!(await can(user, spec, actionMap[action] || action))) {
+    throw PermissionError(`Cannot ${action} ${entityName}`);
+  }
+
+  return { user, spec };
+}

package/src/lib/auth-route-helpers.js

@@ -0,0 +1,83 @@
+import { NextResponse } from '@/lib/next-polyfills';
+import { SESSION } from '@/config/auth-config';
+import { HTTP } from '@/config/constants';
+
+const oauthStateStore = new Map();
+
+setInterval(() => {
+  const now = Date.now();
+  for (const [key, data] of oauthStateStore) {
+    if (data.expiresAt < now) {
+      oauthStateStore.delete(key);
+    }
+  }
+}, 5 * 60 * 1000);
+
+export function validateOAuthProvider(provider) {
+  if (!provider) {
+    return {
+      valid: false,
+      error: 'OAuth not configured',
+    };
+  }
+  return { valid: true };
+}
+
+export async function setOAuthCookie(name, value, options = {}) {
+  const timestamp = Date.now();
+  const key = `oauth-${timestamp}-${Math.random().toString(36).substring(7)}`;
+  const expiresAt = timestamp + (SESSION.cookieMaxAge * 1000);
+
+  oauthStateStore.set(key, {
+    value,
+    expiresAt,
+    createdAt: timestamp,
+  });
+
+  return key;
+}
+
+export async function getOAuthCookie(name) {
+  const key = name;
+
+  const data = oauthStateStore.get(key);
+
+  if (!data) {
+    return null;
+  }
+
+  if (data.expiresAt < Date.now()) {
+    oauthStateStore.delete(key);
+    return null;
+  }
+
+  return data.value;
+}
+
+export async function deleteOAuthCookie(name) {
+  const key = name;
+  if (key) {
+    oauthStateStore.delete(key);
+  }
+}
+
+export function buildOAuthErrorResponse(message, request) {
+  if (request) {
+    return NextResponse.redirect(new URL(`/login?error=${message}`, request.url));
+  }
+  return NextResponse.json({ error: message }, { status: HTTP.INTERNAL_ERROR });
+}
+
+export function buildOAuthSuccessRedirect(path, request) {
+  return NextResponse.redirect(new URL(path, request.url));
+}
+
+export function validateOAuthState(code, state, storedState, storedCodeVerifier) {
+  if (!code || !state) {
+    return { valid: false, error: 'invalid_state' };
+  }
+  if (!storedState || !storedCodeVerifier) {
+    return { valid: false, error: 'state_not_found' };
+  }
+  return { valid: true };
+}

package/src/lib/business-rules-engine.js

@@ -0,0 +1,86 @@
+export class BusinessRulesEngine {
+  constructor(config = {}) {
+    this.businessRules = config.businessRules || {};
+    this.rules = new Map();
+    this.initializeDefaultRules();
+  }
+
+  initializeDefaultRules() {
+    this.registerRule('recreationAllowed', (engagement) => {
+      const rule = this.businessRules.recreationRules.engagement[engagement.repeat_interval];
+      return rule && !this.isDuplicateEngagement(engagement);
+    });
+
+    this.registerRule('daysOutstandingNotificationNeeded', (rfi) => {
+      return this.businessRules.rfiDaysOutstanding.enabled;
+    });
+
+    this.registerRule('clientCanViewRfi', (user, rfi) => {
+      if (user.type === 'client') {
+        const role = this.businessRules.clientRoles[user.role];
+        return role?.rowAccess === 'all' || rfi.assigned_to?.includes(user.id);
+      }
+      return true;
+    });
+
+    this.registerRule('clientCanRate', (user, engagement) => {
+      return user.type === 'client' && user.role === 'client_admin';
+    });
+
+    this.registerRule('tenderWarningNeeded', (review) => {
+      if (!this.businessRules.tenderDeadlines.enabled) return false;
+      if (review.type !== 'tender') return false;
+
+      const now = Date.now();
+      const deadline = review.deadline_date * 1000;
+      const daysUntil = (deadline - now) / (1000 * 60 * 60 * 24);
+
+      return daysUntil <= this.businessRules.tenderDeadlines.warningDays;
+    });
+  }
+
+  registerRule(name, evaluator) {
+    this.rules.set(name, evaluator);
+    return this;
+  }
+
+  async evaluateRule(ruleName, context) {
+    const rule = this.rules.get(ruleName);
+    if (!rule) throw new Error(`Unknown rule: ${ruleName}`);
+    return await rule(context);
+  }
+
+  getDefaultRole() {
+    return this.businessRules.defaultRoleAssignment;
+  }
+
+  getDefaultUserType() {
+    return this.businessRules.defaultUserType;
+  }
+
+  getClientRoleConfig(role) {
+    return this.businessRules.clientRoles[role];
+  }
+
+  getRecreationConfig(interval) {
+    return this.businessRules.recreationRules.engagement[interval];
+  }
+
+  isDuplicateEngagement(engagement) {
+    return false;
+  }
+
+  getDaysOutstandingConfig() {
+    return this.businessRules.rfiDaysOutstanding;
+  }
+
+  getTenderConfig() {
+    return this.businessRules.tenderDeadlines;
+  }
+
+  getGoogleDriveConfig() {
+    return this.businessRules.googleDriveIntegration;
+  }
+}
+
+export default BusinessRulesEngine;

package/src/lib/compression.js

@@ -0,0 +1,44 @@
+import zlib from 'zlib';
+
+const COMPRESSION_THRESHOLD = 1024; // Only compress files >1KB
+
+export function compress(content, acceptEncoding = '') {
+  const size = Buffer.byteLength(content, 'utf-8');
+  if (size < COMPRESSION_THRESHOLD) return { content, encoding: null };
+  
+  const ae = acceptEncoding.toLowerCase();
+  
+  if (ae.includes('br')) {
+    const compressed = zlib.brotliCompressSync(content, {
+      params: {
+        [zlib.constants.BROTLI_PARAM_QUALITY]: 6,
+        [zlib.constants.BROTLI_PARAM_SIZE_HINT]: size
+      }
+    });
+    return { content: compressed, encoding: 'br' };
+  }
+  
+  if (ae.includes('gzip')) {
+    const compressed = zlib.gzipSync(content, { level: 6 });
+    return { content: compressed, encoding: 'gzip' };
+  }
+  
+  return { content, encoding: null };
+}
+
+export function getCacheHeaders(type, maxAge = 86400) {
+  if (type === 'static') {
+    return {
+      'Cache-Control': `public, max-age=${maxAge}, immutable`,
+      'Expires': new Date(Date.now() + maxAge * 1000).toUTCString()
+    };
+  }
+  if (type === 'dynamic') {
+    return {
+      'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
+      'Pragma': 'no-cache',
+      'Expires': '0'
+    };
+  }
+  return {};
+}

package/src/lib/config-field-helpers.js

@@ -0,0 +1,91 @@
+/**
+ * Config Field Helpers - Field definition processing and validation
+ */
+
+import { getSpec } from './spec-helpers.js';
+
+/**
+ * Generate fields from field overrides
+ */
+export function generateFieldsFromOverrides(overrides, baseFields) {
+  const result = { ...baseFields };
+  if (!overrides) return result;
+
+  for (const [key, def] of Object.entries(overrides)) {
+    if (def === null || def === undefined) {
+      delete result[key];
+    } else {
+      result[key] = { ...result[key], ...def };
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Generate default field definitions for implicit fields
+ */
+export function generateDefaultFields(entityDef) {
+  const defaults = {};
+
+  // Add common fields
+  if (!entityDef.fields) return defaults;
+
+  for (const [key, field] of Object.entries(entityDef.fields)) {
+    if (field.type === 'ref') {
+      defaults[`${key}_display`] = {
+        type: 'text',
+        label: field.label ? `${field.label} Name` : key,
+        computed: true,
+        hidden: true,
+      };
+    }
+  }
+
+  return defaults;
+}
+
+/**
+ * Build enum options from various sources (array, ref to status enum, etc.)
+ */
+export function buildEnumOptions(fieldDef, entityName, configEngine) {
+  if (Array.isArray(fieldDef.options)) {
+    return fieldDef.options.map(o => typeof o === 'object' ? o.value : o);
+  }
+
+  if (typeof fieldDef.options === 'string') {
+    try {
+      const spec = getSpec(entityName, configEngine);
+      const list = spec.options?.[fieldDef.options];
+      if (list) return list.map(o => typeof o === 'object' ? o.value : o);
+    } catch {
+      // fall through
+    }
+  }
+
+  if (typeof fieldDef.options === 'string' && fieldDef.options.startsWith('status:')) {
+    const statusName = fieldDef.options.replace('status:', '');
+    try {
+      const statuses = configEngine.getStatuses(statusName);
+      return Object.keys(statuses);
+    } catch {
+      // fall through
+    }
+  }
+
+  return [];
+}
+
+/**
+ * Ensure all fields have labels
+ */
+export function ensureFieldLabels(fields) {
+  const result = {};
+  for (const [key, field] of Object.entries(fields)) {
+    result[key] = {
+      ...field,
+      label: field.label || key.charAt(0).toUpperCase() + key.slice(1).replace(/_/g, ' '),
+    };
+  }
+  return result;
+}