thatcher 1.0.47 → 1.0.49

package/README.md

@@ -194,7 +194,7 @@ Each entity derives from config:
 | Config Key | Purpose |
 |-----------|---------|
 | `fields` | Column definitions (type, required, ref, enum, etc.) |
-| `permission_template` | Maps roles → allowed actions |
+| `permission_template` | Maps roles -> allowed actions |
 | `workflow` | State machine name for lifecycle |
 | `row_access` | Scoping: `team`, `assigned`, `client` |
 | `list.defaultSort` | Default list ordering |
@@ -342,30 +342,30 @@ Use via `@/lib/email-sender` (included).
 All APIs accessible via thatcher instance:
 
 ### CRUD
-- `thatcher.list(entity, where, opts)` → Array
-- `thatcher.get(entity, id)` → object
-- `thatcher.create(entity, data, user)` → object
-- `thatcher.update(entity, id, data, user)` → object
-- `thatcher.delete(entity, id)` → void
+- `thatcher.list(entity, where, opts)` -> Array
+- `thatcher.get(entity, id)` -> object
+- `thatcher.create(entity, data, user)` -> object
+- `thatcher.update(entity, id, data, user)` -> object
+- `thatcher.delete(entity, id)` -> void
 
 ### Search
-- `thatcher.search(entity, query, where, opts)` → Array (uses FTS)
+- `thatcher.search(entity, query, where, opts)` -> Array (uses FTS)
 
 ### Workflow
-- `thatcher.transition(entityType, entityId, workflowName, toState, user, reason)` → object
-- `thatcher.getAvailableTransitions(workflowName, currentState, user, record)` → Array
+- `thatcher.transition(entityType, entityId, workflowName, toState, user, reason)` -> object
+- `thatcher.getAvailableTransitions(workflowName, currentState, user, record)` -> Array
 
 ### AuthZ
-- `thatcher.can(user, spec, action)` → boolean
-- `thatcher.requirePermission(user, spec, action)` → throws if denied
+- `thatcher.can(user, spec, action)` -> boolean
+- `thatcher.requirePermission(user, spec, action)` -> throws if denied
 
 ### Config
-- `thatcher.getConfigEngine()` → ConfigGeneratorEngine
-- `thatcher.getEntitySpec(entityName)` → spec object
-- `thatcher.getAllEntities()` → Array<string>
+- `thatcher.getConfigEngine()` -> ConfigGeneratorEngine
+- `thatcher.getEntitySpec(entityName)` -> spec object
+- `thatcher.getAllEntities()` -> Array<string>
 
 ### Direct DB
-- `thatcher.withTransaction(cb)` → Promise<result>
+- `thatcher.withTransaction(cb)` -> Promise<result>
 
 ## Environment Variables
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.47",
+  "version": "1.0.49",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/index.js

@@ -63,6 +63,9 @@ export class Thatcher {
     // Load plugins
     await this.loadPlugins();
 
+    const { registerAutomationEngine } = await import(resolveModule('./lib/automation-engine.js'));
+    registerAutomationEngine();
+
     // Hot reload
     if (this.options.server.hotReload) {
       this.setupHotReload();

package/src/lib/automation-engine.js

@@ -0,0 +1,113 @@
+import { hookEngine } from './hook-engine.js';
+import { update as updateRecord, create as createRecord } from './busybase/store.js';
+import { getConfigEngineSync } from './config-generator-engine.js';
+import { createLogger } from './logger.js';
+
+const log = createLogger('[AutomationEngine]');
+
+const OPERATORS = {
+  eq: (a, b) => a === b,
+  neq: (a, b) => a !== b,
+  gt: (a, b) => Number(a) > Number(b),
+  gte: (a, b) => Number(a) >= Number(b),
+  lt: (a, b) => Number(a) < Number(b),
+  lte: (a, b) => Number(a) <= Number(b),
+  in: (a, b) => Array.isArray(b) && b.includes(a),
+  changed: (a, b, prev, field) => prev && prev[field] !== a,
+  present: (a) => a !== null && a !== undefined && a !== '',
+};
+
+function evalCondition(cond, data, prev) {
+  const { field, op = 'eq', value } = cond;
+  const actual = data[field];
+  const fn = OPERATORS[op];
+  if (!fn) { log.error(`unknown automation operator: ${op}`); return false; }
+  return fn(actual, value, prev, field);
+}
+
+function evalConditions(conditions, data, prev) {
+  if (!conditions || !conditions.length) return true;
+  return conditions.every(c => evalCondition(c, data, prev));
+}
+
+async function runAction(action, context) {
+  const { entity, id, data, user } = context;
+  switch (action.type) {
+    case 'set_field': {
+      const patch = { [action.field]: action.value };
+      await updateRecord(entity, id, patch, user);
+      return;
+    }
+    case 'create_entity': {
+      const payload = { ...(action.data || {}) };
+      for (const [k, v] of Object.entries(payload)) {
+        if (typeof v === 'string' && v.startsWith('$')) payload[k] = data[v.slice(1)];
+      }
+      await createRecord(action.entity, payload, user);
+      return;
+    }
+    case 'notify': {
+      await hookEngine.execute('automation:notify', { entity, id, data, user, message: action.message, target: action.target });
+      return;
+    }
+    default:
+      log.error(`unknown automation action type: ${action.type}`);
+  }
+}
+
+function normalizeContext(context) {
+  const data = context.data || context.record || {};
+  const prev = context.before || context.prev || null;
+  return { ...context, data, prev, entity: context.entity, id: context.id ?? data.id };
+}
+
+async function runRule(rule, rawContext) {
+  const context = normalizeContext(rawContext);
+  if (!evalConditions(rule.when, context.data, context.prev)) return;
+  for (const action of rule.then || []) {
+    try {
+      await runAction(action, context);
+    } catch (error) {
+      log.error(`automation rule "${rule.id || rule.name}" action failed:`, { message: error.message });
+    }
+  }
+}
+
+function getRules(entityName, trigger) {
+  let config;
+  try {
+    config = getConfigEngineSync().getConfig();
+  } catch {
+    return [];
+  }
+  const rules = config?.automation?.rules || [];
+  return rules.filter(r => (!r.entity || r.entity === entityName) && (!r.trigger || r.trigger === trigger));
+}
+
+let registered = false;
+
+export function registerAutomationEngine() {
+  if (registered) return;
+  registered = true;
+
+  const config = getConfigEngineSync().getConfig();
+  const entityNames = Object.keys(config?.entities || {});
+
+  for (const entityName of entityNames) {
+    for (const trigger of ['create', 'update', 'delete']) {
+      hookEngine.register(`${trigger}:${entityName}:after`, async (context) => {
+        for (const rule of getRules(entityName, trigger)) await runRule(rule, context);
+        return context;
+      });
+    }
+    hookEngine.register(`transition:${entityName}`, async (context) => {
+      for (const rule of getRules(entityName, 'transition')) await runRule(rule, context);
+      return context;
+    });
+  }
+}
+
+export function dispatchAutomation(trigger, entity, context) {
+  const rules = getRules(entity, trigger);
+  return Promise.all(rules.map(rule => runRule(rule, context)));
+}

package/src/lib/busybase/store.js

@@ -203,13 +203,17 @@ export async function count(entity, where = {}, options = {}) {
   const tbl = tableName(entity);
   let rows = unwrap(await applyWhere(client().from(tbl).select('*'), where), 'count');
   rows = applyVisibility(spec, rows, where, options);
+  if (options.user && (spec.rowAccess || spec.row_access)) {
+    const { permissionService } = await import('../services/permission.service.js');
+    rows = permissionService.filterRecords(options.user, spec, rows);
+  }
   return rows.length;
 }
 
-export async function listWithPagination(entity, where = {}, page = 1, pageSize = 50) {
+export async function listWithPagination(entity, where = {}, page = 1, pageSize = 50, options = {}) {
   const finalPage = Math.max(1, page);
-  const total = await count(entity, where);
-  const items = await list(entity, where, { offset: (finalPage - 1) * pageSize, limit: pageSize });
+  const total = await count(entity, where, options);
+  const items = await list(entity, where, { ...options, offset: (finalPage - 1) * pageSize, limit: pageSize });
   return { items, pagination: { page: finalPage, pageSize, total, totalPages: Math.ceil(total / pageSize) } };
 }
 
@@ -337,11 +341,11 @@ export async function search(entity, query, where = {}, options = {}) {
   return matched;
 }
 
-export async function searchWithPagination(entity, query, where = {}, page = 1, pageSize = null) {
+export async function searchWithPagination(entity, query, where = {}, page = 1, pageSize = null, options = {}) {
   const spec = specOf(entity);
   const finalPageSize = pageSize || spec.list?.pageSize || 50;
   const finalPage = Math.max(1, page);
-  const all = await search(entity, query, where);
+  const all = await search(entity, query, where, options);
   const total = all.length;
   const items = all.slice((finalPage - 1) * finalPageSize, finalPage * finalPageSize);
   return { items, pagination: { page: finalPage, pageSize: finalPageSize, total, totalPages: Math.ceil(total / finalPageSize) } };

package/src/lib/crud-handlers.js

@@ -43,7 +43,7 @@ export function createCrudHandlers(entityName, spec) {
       let items, pagination;
 
       if (q) {
-        const result = await searchWithPagination(entityName, q, {}, finalPage, finalPageSize);
+        const result = await searchWithPagination(entityName, q, {}, finalPage, finalPageSize, { user });
         items = result.items;
         pagination = result.pagination;
       } else {
@@ -54,7 +54,7 @@ export function createCrudHandlers(entityName, spec) {
             coercedFilters[key] = fd ? coerceFieldValue(value, fd.type) : value;
           }
         }
-        const result = await listWithPagination(entityName, coercedFilters, finalPage, finalPageSize);
+        const result = await listWithPagination(entityName, coercedFilters, finalPage, finalPageSize, { user });
         items = result.items;
         pagination = result.pagination;
       }
@@ -200,7 +200,7 @@ export function createCrudHandlers(entityName, spec) {
           id,
           data: { id, uploaded_files: files },
           user,
-        });
+        }).catch(e => log.error(e.message));
         return ok({ id, uploaded_files: files });
       }
 

package/src/lib/field-types.js

@@ -124,6 +124,51 @@ export const fieldRegistry = {
   }),
   image: createSimpleType('TEXT'),
   id: createSimpleType('TEXT PRIMARY KEY'),
+  people: createSimpleType('TEXT', {
+    coerce: (val) => (val === undefined || val === '' || val === null ? null : (typeof val === 'string' ? val : JSON.stringify(val))),
+    format: (val, field, spec, row) => {
+      const ids = Array.isArray(val) ? val : (val ? [val] : []);
+      if (!ids.length) return null;
+      return ids.map(id => row?.[`${id}_display`] || row?.assignee_names?.[id] || String(id));
+    },
+  }),
+  link: createSimpleType('TEXT', {
+    format: (val) => String(val ?? ''),
+    isValid: (val) => { if (!val) return true; try { new URL(String(val)); return true; } catch { return false; } },
+  }),
+  file: createSimpleType('TEXT', {
+    coerce: (val) => (val === undefined || val === '' || val === null ? null : (typeof val === 'string' ? val : JSON.stringify(val))),
+    format: (val) => {
+      if (!val) return null;
+      const obj = typeof val === 'string' ? (() => { try { return JSON.parse(val); } catch { return { name: val }; } })() : val;
+      return { name: obj.name || obj.filename || 'file', url: obj.url || null };
+    },
+  }),
+  rating: createNumberType('INTEGER', (val) => {
+    if (val === undefined || val === '' || val === null) return null;
+    const num = parseInt(val, 10);
+    if (isNaN(num)) throw new Error(`Invalid rating: ${val}`);
+    return num;
+  }, (val, field) => ({ value: Number(val) || 0, max: field?.max || 5 })),
+  progress: createNumberType('REAL', (val) => {
+    if (val === undefined || val === '' || val === null) return null;
+    const num = parseFloat(val);
+    if (isNaN(num)) throw new Error(`Invalid progress: ${val}`);
+    return num;
+  }, (val) => Math.max(0, Math.min(100, Number(val) || 0))),
+  checkbox: createSimpleType('INTEGER', {
+    coerce: (val) => (val === true || val === 'true' || val === 'on' || val === 1 ? 1 : 0),
+    format: (val) => !!val,
+  }),
+  formula: {
+    sqlType: 'TEXT',
+    coerce: () => undefined,
+    format: (val, field, spec, row) => {
+      if (typeof field?.compute !== 'function') return null;
+      try { return field.compute(row); } catch { return null; }
+    },
+    isValid: () => true,
+  },
 };
 
 export function getFieldHandler(type) {

package/src/server/server.js

@@ -3,6 +3,31 @@ import path from 'path';
 import fs from 'fs';
 import { fileURLToPath } from 'url';
 import { createLogger } from '../lib/logger.js';
+import { getLucia } from '../engine.server.js';
+import { requirePermission } from '../lib/auth-middleware.js';
+
+// Request-scoped session resolution: NOT engine.server.js's getUser(), which
+// reads a module-level _currentRequest global -- unsafe here since this raw
+// http server handles requests concurrently and that global would let one
+// in-flight request's cookie leak into another's session lookup mid-await.
+// getLucia() itself holds no per-request state, so calling it directly per
+// request and validating against this request's own cookie header is safe.
+async function resolveRequestUser(req) {
+  let lucia;
+  try { lucia = getLucia(); } catch { return null; }
+  const cookieHeader = req.headers?.cookie || '';
+  if (!cookieHeader) return null;
+  const cookieName = lucia.sessionCookieName || 'thatcher_session';
+  const match = cookieHeader.split(';').find(c => c.trim().startsWith(cookieName + '='));
+  if (!match) return null;
+  const sessionId = decodeURIComponent(match.split('=')[1] || '');
+  if (!sessionId) return null;
+  try {
+    const { user, session } = await lucia.validateSession(sessionId);
+    if (!user || !session) return null;
+    return user;
+  } catch { return null; }
+}
 
 const log = createLogger('[Server]');
 const pageLog = createLogger('[Page]');
@@ -203,11 +228,12 @@ async function sendResponse(res, response) {
 }
 
 async function handleGenericCrud(req, res, entity, id, action, thatcher, configEngineArg) {
-  // Simple auth: get from cookie or header
-  let user = null;
-  // In a real implementation, we'd decode session token
-  // For now, default to system user for testing
-  user = { id: 'system', role: 'admin' };
+  const user = await resolveRequestUser(req);
+  if (!user) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Authentication required' }));
+    return;
+  }
 
   // Prefer the engine passed down from createServer options (guaranteed the
   // same instance that was initialized at startup); fall back to thatcher /
@@ -217,15 +243,23 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
     const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
     configEngine = getConfigEngineSync();
   }
+  let spec;
   try {
-    configEngine.generateEntitySpec(entity);
+    spec = configEngine.generateEntitySpec(entity);
   } catch (e) {
     res.writeHead(404);
     res.end(JSON.stringify({ error: `Entity '${entity}' not found` }));
     return;
   }
 
-  // Permission check would go here via thatcher.can(user, spec, action)
+  const methodAction = { GET: 'list', POST: 'create', PUT: 'edit', PATCH: 'edit', DELETE: 'delete' }[req.method] || 'view';
+  try {
+    await requirePermission(user, spec, id && req.method === 'GET' ? 'view' : methodAction);
+  } catch (e) {
+    res.writeHead(e?.status || 403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: e?.message || 'Forbidden' }));
+    return;
+  }
 
   let body;
   try {
@@ -250,7 +284,7 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
             return;
           }
         } else {
-          result = await thatcher.list(entity);
+          result = await thatcher.list(entity, {}, { user });
         }
         break;
 

package/src/services/permission.service.js

@@ -47,12 +47,12 @@ class PermissionService {
       return false;
     }
 
-    if (scope === 'assigned' && record[ownerField] && record[ownerField] !== user.id && user.role !== partnerRole) {
+    if (scope === 'assigned' && user.role !== partnerRole && record[ownerField] !== user.id) {
       return false;
     }
 
     if (scope === 'assigned_or_team' && user.role !== partnerRole) {
-      const assignedMatch = record[ownerField] && record[ownerField] === user.id;
+      const assignedMatch = record[ownerField] === user.id;
       const teamMatch = record.team_id && user.team_id && record.team_id === user.team_id;
       if (!assignedMatch && !teamMatch) return false;
     }

package/src/ui/board-view-renderer.js

@@ -0,0 +1,76 @@
+import { page } from '@/ui/layout.js';
+import { esc, statusPill, TABLE_SCRIPT } from '@/ui/render-helpers.js';
+import { getStateField, getStageLabels } from '@/lib/workflow-engine.js';
+
+function cardTitleField(spec) {
+  if (spec.list?.titleField) return spec.list.titleField;
+  const candidates = ['name', 'title', 'label'];
+  for (const c of candidates) if (spec.fields?.[c]) return c;
+  const first = Object.keys(spec.fields || {}).find(k => spec.fields[k]?.type === 'text');
+  return first || 'id';
+}
+
+function boardCard(entityName, record, titleField) {
+  const title = esc(record[titleField] ?? record.id);
+  const status = record.status !== undefined ? statusPill(record.status) : '';
+  return `<div class="board-card" draggable="true" data-id="${esc(record.id)}" data-navigate="/${esc(entityName)}/${esc(record.id)}">
+    <div class="board-card-title">${title}</div>
+    ${status ? `<div class="board-card-meta">${status}</div>` : ''}
+  </div>`;
+}
+
+function boardColumn(entityName, stageKey, stageLabel, records, titleField) {
+  const cards = records.map(r => boardCard(entityName, r, titleField)).join('') ||
+    `<div class="board-column-empty">No items</div>`;
+  return `<div class="board-column" data-stage="${esc(stageKey)}">
+    <div class="board-column-header"><span>${esc(stageLabel)}</span><span class="board-column-count">${records.length}</span></div>
+    <div class="board-column-body" data-drop-zone="${esc(stageKey)}">${cards}</div>
+  </div>`;
+}
+
+const BOARD_SCRIPT = `(function(){
+  document.addEventListener('dragstart',e=>{const c=e.target.closest('.board-card');if(!c)return;e.dataTransfer.setData('text/plain',c.dataset.id);c.classList.add('dragging')});
+  document.addEventListener('dragend',e=>{const c=e.target.closest('.board-card');if(c)c.classList.remove('dragging')});
+  document.addEventListener('dragover',e=>{const z=e.target.closest('[data-drop-zone]');if(z)e.preventDefault()});
+  document.addEventListener('drop',async e=>{
+    const zone=e.target.closest('[data-drop-zone]');if(!zone)return;e.preventDefault();
+    const id=e.dataTransfer.getData('text/plain');if(!id)return;
+    const toStage=zone.dataset.dropZone;
+    const board=document.getElementById('board-root');
+    const entity=board.dataset.entity, workflow=board.dataset.workflow;
+    try{
+      const r=await fetch('/api/'+entity+'/'+id+'/transition',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({workflow,toState:toStage})});
+      if(r.ok)location.reload();else{const d=await r.json().catch(()=>({}));showToast(d.error||'Transition failed','error')}
+    }catch(err){showToast(err.message,'error')}
+  });
+})();`;
+
+export function renderBoardView(user, entityName, spec, records, options = {}) {
+  const workflowName = options.workflow || spec.workflow;
+  if (!workflowName) {
+    return page(user, `${spec.labelPlural || spec.label} | Board`, null,
+      `<div class="board-empty-state">This entity has no workflow configured; board view requires a <code>workflow</code> key on the entity spec.</div>`);
+  }
+  const stateField = getStateField(workflowName);
+  const stageLabels = getStageLabels(workflowName);
+  const titleField = cardTitleField(spec);
+
+  const grouped = {};
+  for (const key of Object.keys(stageLabels)) grouped[key] = [];
+  for (const r of records) {
+    const stage = r[stateField];
+    if (!grouped[stage]) grouped[stage] = [];
+    grouped[stage].push(r);
+  }
+
+  const columns = Object.entries(stageLabels)
+    .map(([key, label]) => boardColumn(entityName, key, label, grouped[key] || [], titleField))
+    .join('');
+
+  const content = `<div class="page-header">
+      <div><h1 class="page-title">${esc(spec.labelPlural || spec.label)}</h1><p class="page-subtitle">${records.length} items</p></div>
+    </div>
+    <div id="board-root" class="board-view" data-entity="${esc(entityName)}" data-workflow="${esc(workflowName)}">${columns}</div>`;
+
+  return page(user, `${spec.labelPlural || spec.label} | Board`, null, content, [TABLE_SCRIPT, BOARD_SCRIPT]);
+}