thatcher 1.0.54 → 1.0.56

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.54",
+  "version": "1.0.56",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/config/spec-helpers.js

@@ -19,6 +19,22 @@ export function getSpec(name, configEngine) {
   }
 }
 
+export function getAllEntityNames(configEngine) {
+  if (!configEngine) {
+    const g = globalThis.__thatcherConfigEngine;
+    if (g) configEngine = g;
+  }
+  if (!configEngine) return [];
+  try {
+    return configEngine.getAllEntities().filter(name => {
+      const spec = getSpec(name, configEngine);
+      return spec && !spec.embedded && !spec.system_entity;
+    });
+  } catch {
+    return [];
+  }
+}
+
 export function getNavItems(configEngine) {
   try {
     const allEntities = configEngine.getAllEntities();

package/src/lib/busybase/store.js

@@ -162,12 +162,13 @@ export async function list(entity, where = {}, options = {}) {
   rows = applyVisibility(spec, rows, where, options);
 
   // Row-access scoping: when a caller passes options.user AND the entity declares
-  // rowAccess, restrict the rows to what that user may see (their assigned cases,
-  // their team, etc.). Opt-in -- no user means the read is unchanged, so internal
-  // and admin callers are unaffected. This makes a config row_access spec actually
-  // enforced on the read path (previously list() took no user, so the spec was
-  // inert and a scoped enquiry would leak every row).
-  if (options.user && (spec.rowAccess || spec.row_access)) {
+  // rowAccess OR an organization_id field (multi-tenancy), restrict the rows to
+  // what that user may see (their assigned cases, their team, their organization).
+  // Opt-in -- no user means the read is unchanged, so internal and admin callers
+  // are unaffected. This makes a config row_access spec actually enforced on the
+  // read path (previously list() took no user, so the spec was inert and a scoped
+  // enquiry would leak every row).
+  if (options.user && (spec.rowAccess || spec.row_access || spec.fields?.organization_id)) {
     const { permissionService } = await import('../services/permission.service.js');
     rows = permissionService.filterRecords(options.user, spec, rows);
   }
@@ -203,7 +204,7 @@ export async function count(entity, where = {}, options = {}) {
   const tbl = tableName(entity);
   let rows = unwrap(await applyWhere(client().from(tbl).select('*'), where), 'count');
   rows = applyVisibility(spec, rows, where, options);
-  if (options.user && (spec.rowAccess || spec.row_access)) {
+  if (options.user && (spec.rowAccess || spec.row_access || spec.fields?.organization_id)) {
     const { permissionService } = await import('../services/permission.service.js');
     rows = permissionService.filterRecords(options.user, spec, rows);
   }
@@ -217,10 +218,15 @@ export async function listWithPagination(entity, where = {}, page = 1, pageSize
   return { items, pagination: { page: finalPage, pageSize, total, totalPages: Math.ceil(total / pageSize) } };
 }
 
-export async function get(entity, id) {
+export async function get(entity, id, options = {}) {
   const tbl = tableName(entity);
   const row = unwrap(await client().from(tbl).select('*').eq('id', id).maybeSingle(), 'get');
   if (!row) return null;
+  const spec = specOf(entity);
+  if (options.user && (spec.rowAccess || spec.row_access || spec.fields?.organization_id)) {
+    const { permissionService } = await import('../services/permission.service.js');
+    if (!permissionService.checkRowAccess(options.user, spec, row)) return null;
+  }
   const [withDisplay] = await attachRefDisplays(entity, [row]);
   return withDisplay;
 }
@@ -242,6 +248,9 @@ export async function create(entity, data, user) {
     updated_at: 0,
     status: data.status || RECORD_STATUS.ACTIVE,
   };
+  if (spec.fields?.organization_id && !record.organization_id && user?.organization_id) {
+    record.organization_id = user.organization_id;
+  }
   for (const [key, field] of Object.entries(spec.fields || {})) {
     if (field.auto === 'uuid' && !record[key]) record[key] = genId();
     if (field.auto === 'timestamp' && !record[key]) record[key] = now();

package/src/lib/config-generator-engine.js

@@ -14,15 +14,46 @@
 // central infrastructure, not a candidate for deprecation.
 import { LRUCache, deepFreeze, deepClone, recursiveResolve } from './config-helpers.js';
 
+const ORGANIZATION_ENTITY_DEFAULT = {
+  label: 'Organization',
+  label_plural: 'Organizations',
+  system_entity: true,
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+  },
+};
+
+const USER_ORGANIZATION_ENTITY_DEFAULT = {
+  label: 'Organization Membership',
+  label_plural: 'Organization Memberships',
+  system_entity: true,
+  fields: {
+    user_id: { type: 'ref', ref: 'user', required: true },
+    organization_id: { type: 'ref', ref: 'organization', required: true },
+  },
+};
+
+function withMultiTenancyDefaults(masterConfig) {
+  if (!masterConfig?.system?.multi_tenancy?.enabled) return masterConfig;
+  const entities = { ...(masterConfig.entities || {}) };
+  if (!entities.organization) entities.organization = ORGANIZATION_ENTITY_DEFAULT;
+  if (!entities.user_organization) entities.user_organization = USER_ORGANIZATION_ENTITY_DEFAULT;
+  return { ...masterConfig, entities };
+}
+
 export class ConfigGeneratorEngine {
   constructor(masterConfig) {
     if (!masterConfig) throw new Error('[ConfigGeneratorEngine] masterConfig is required');
-    this.masterConfig = deepFreeze(masterConfig);
+    this.masterConfig = deepFreeze(withMultiTenancyDefaults(masterConfig));
     this.specCache = new LRUCache(100);
     this.debugMode = false;
     this._plugins = new Map();
   }
 
+  isMultiTenancyEnabled() {
+    return this.masterConfig?.system?.multi_tenancy?.enabled === true;
+  }
+
   registerPlugin(entityName, plugin = {}) {
     if (!entityName || typeof entityName !== 'string') {
       throw new Error('[ConfigGeneratorEngine] registerPlugin: entityName required');
@@ -315,6 +346,9 @@ export class ConfigGeneratorEngine {
       updated_at: { type: 'timestamp', readonly: true },
       status: { type: 'text' },
     };
+    if (this.isMultiTenancyEnabled() && !spec.embedded && !spec.system_entity) {
+      SYSTEM_FIELDS.organization_id = { type: 'ref', ref: 'organization', required: true, readonly: true, hidden: true };
+    }
     for (const [key, field] of Object.entries(SYSTEM_FIELDS)) {
       if (!(key in allFields)) allFields[key] = field;
     }

package/src/server/server.js

@@ -106,6 +106,14 @@ export function createServer(options) {
           return await handleCsvImport(req, res, entity, thatcher, configEngine);
         }
 
+        if (req.method === 'POST' && entity === 'organization' && id === 'switch' && !action) {
+          return await handleSwitchOrganization(req, res, thatcher, configEngine);
+        }
+
+        if (req.method === 'GET' && entity === 'organization' && id === 'memberships' && !action) {
+          return await handleListMemberships(req, res, thatcher, configEngine);
+        }
+
         // Check if user has custom route for this
         const userRoutePath = path.join(process.cwd(), 'app/api', ...parts, 'route.js');
         const routeExists = await fileExists(userRoutePath);
@@ -333,6 +341,95 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
   }
 }
 
+async function handleListMemberships(req, res, thatcher, configEngineArg) {
+  const user = await resolveRequestUser(req);
+  if (!user) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Authentication required' }));
+    return;
+  }
+
+  let configEngine = configEngineArg || thatcher?.configEngine || globalThis.__thatcherConfigEngine;
+  if (!configEngine) {
+    const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
+    configEngine = getConfigEngineSync();
+  }
+  if (!configEngine.isMultiTenancyEnabled?.()) {
+    res.writeHead(404);
+    res.end(JSON.stringify({ error: 'Multi-tenancy is not enabled' }));
+    return;
+  }
+
+  try {
+    const { list, get } = await import('../lib/busybase/store.js');
+    const memberships = await list('user_organization', { user_id: user.id });
+    const orgs = [];
+    for (const m of memberships) {
+      const org = await get('organization', m.organization_id);
+      if (org) orgs.push({ id: org.id, name: org.name });
+    }
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ organizations: orgs, active: user.organization_id || null }));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(500);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
+async function handleSwitchOrganization(req, res, thatcher, configEngineArg) {
+  const user = await resolveRequestUser(req);
+  if (!user) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Authentication required' }));
+    return;
+  }
+
+  let configEngine = configEngineArg || thatcher?.configEngine || globalThis.__thatcherConfigEngine;
+  if (!configEngine) {
+    const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
+    configEngine = getConfigEngineSync();
+  }
+  if (!configEngine.isMultiTenancyEnabled?.()) {
+    res.writeHead(404);
+    res.end(JSON.stringify({ error: 'Multi-tenancy is not enabled' }));
+    return;
+  }
+
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (e) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: e.message }));
+    return;
+  }
+  const targetOrgId = typeof body === 'object' ? body?.organization_id : null;
+  if (!targetOrgId) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'organization_id required' }));
+    return;
+  }
+
+  try {
+    const { list, update } = await import('../lib/busybase/store.js');
+    const memberships = await list('user_organization', { user_id: user.id });
+    const isMember = memberships.some(m => m.organization_id === targetOrgId);
+    if (!isMember) {
+      res.writeHead(403);
+      res.end(JSON.stringify({ error: 'Not a member of that organization' }));
+      return;
+    }
+    const updated = await update('user', user.id, { organization_id: targetOrgId });
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, organization_id: updated.organization_id }));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(500);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
 async function handleCsvImport(req, res, entity, thatcher, configEngineArg) {
   const user = await resolveRequestUser(req);
   if (!user) {

package/src/services/permission.service.js

@@ -26,8 +26,17 @@ class PermissionService {
     return Array.isArray(allowed) && allowed.includes(user.role);
   }
 
+  checkOrganizationAccess(user, spec, record) {
+    if (!user) return false;
+    if (!spec.fields?.organization_id) return true;
+    if (record.organization_id == null) return true;
+    return record.organization_id === user.organization_id;
+  }
+
   checkRowAccess(user, spec, record) {
     if (!user) return false;
+    if (!this.checkOrganizationAccess(user, spec, record)) return false;
+
     const rowAccess = spec.rowAccess || spec.row_access;
     if (!rowAccess) return true;
 

package/src/ui/advanced-search-renderer.js

@@ -12,14 +12,18 @@ function resultCard(item, entityType) {
   return `<div class="card-clean" style="margin-bottom:8px;cursor:pointer" data-navigate="/${entityType}/${item.id}"><div class="card-clean-body" style="padding:0.75rem"><div class="flex items-start justify-between"><div class="flex-1"><div class="flex items-center gap-2 mb-1"><span class="badge badge-sm bg-gray-100 text-gray-600">${typeLabel}</span>${sts}</div><div class="font-medium">${esc(title)}</div>${subtitle ? `<div class="text-xs text-gray-500 mt-0.5">${esc(subtitle)}</div>` : ''}</div><div class="text-xs text-gray-400">${date}</div></div></div></div>`;
 }
 
-function filterPanel(teams, stages) {
+function entityLabel(name) {
+  return name.charAt(0).toUpperCase() + name.slice(1).replace(/_/g, ' ');
+}
+
+function filterPanel(teams, entityNames) {
   const teamOpts = teams.map(t => `<option value="${esc(t.id)}">${esc(t.name)}</option>`).join('');
-  const stageOpts = stages.map(s => `<option value="${s}">${s.replace(/_/g, ' ').replace(/\b\w/g, c => c.toUpperCase())}</option>`).join('');
-  return `<div class="card-clean" style="margin-bottom:1.5rem"><div class="card-clean-body"><div class="grid grid-cols-1 md:grid-cols-4 gap-3"><div><label class="text-xs font-medium text-gray-600 block mb-1" for="search-query">Search</label><input type="text"  id="search-query" class="input input-bordered input-sm w-full" placeholder="Search across all entities..."/></div><div><label class="text-xs font-medium text-gray-600 block mb-1" for="filter-entity">Entity Type</label><select id="filter-entity" class="select select-bordered select-sm w-full"><option value="">All Types</option><option value="engagement">Engagements</option><option value="client">Clients</option><option value="rfi">RFIs</option><option value="review">Reviews</option><option value="user">Users</option></select></div><div><label class="text-xs font-medium text-gray-600 block mb-1" for="filter-status">Status</label><select id="filter-status" class="select select-bordered select-sm w-full"><option value="">All Statuses</option><option value="active">Active</option><option value="pending">Pending</option><option value="completed">Completed</option><option value="archived">Archived</option></select></div><div><label class="text-xs font-medium text-gray-600 block mb-1" for="filter-stage">Stage</label><select id="filter-stage" class="select select-bordered select-sm w-full"><option value="">All Stages</option>${stageOpts}</select></div></div><div class="grid grid-cols-1 md:grid-cols-4 gap-3 mt-3"><div><label class="text-xs font-medium text-gray-600 block mb-1" for="filter-team">Team</label><select id="filter-team" class="select select-bordered select-sm w-full"><option value="">All Teams</option>${teamOpts}</select></div><div><label class="text-xs font-medium text-gray-600 block mb-1" for="filter-from">Date From</label><input type="date"  id="filter-from" class="input input-bordered input-sm w-full"/></div><div><label class="text-xs font-medium text-gray-600 block mb-1" for="filter-to">Date To</label><input type="date"  id="filter-to" class="input input-bordered input-sm w-full"/></div><div class="flex items-end"><button class="btn btn-primary btn-sm w-full" data-action="doSearch">Search</button></div></div></div></div>`;
+  const entityOpts = entityNames.map(e => `<option value="${esc(e)}">${esc(entityLabel(e))}</option>`).join('');
+  return `<div class="card-clean" style="margin-bottom:1.5rem"><div class="card-clean-body"><div class="grid grid-cols-1 md:grid-cols-4 gap-3"><div><label class="text-xs font-medium text-gray-600 block mb-1" for="search-query">Search</label><input type="text"  id="search-query" class="input input-bordered input-sm w-full" placeholder="Search across all entities..."/></div><div><label class="text-xs font-medium text-gray-600 block mb-1" for="filter-entity">Entity Type</label><select id="filter-entity" class="select select-bordered select-sm w-full"><option value="">All Types</option>${entityOpts}</select></div><div><label class="text-xs font-medium text-gray-600 block mb-1" for="filter-status">Status</label><select id="filter-status" class="select select-bordered select-sm w-full"><option value="">All Statuses</option><option value="active">Active</option><option value="pending">Pending</option><option value="completed">Completed</option><option value="archived">Archived</option></select></div><div><label class="text-xs font-medium text-gray-600 block mb-1" for="filter-team">Team</label><select id="filter-team" class="select select-bordered select-sm w-full"><option value="">All Teams</option>${teamOpts}</select></div></div><div class="grid grid-cols-1 md:grid-cols-4 gap-3 mt-3"><div><label class="text-xs font-medium text-gray-600 block mb-1" for="filter-from">Date From</label><input type="date"  id="filter-from" class="input input-bordered input-sm w-full"/></div><div><label class="text-xs font-medium text-gray-600 block mb-1" for="filter-to">Date To</label><input type="date"  id="filter-to" class="input input-bordered input-sm w-full"/></div><div class="flex items-end"><button class="btn btn-primary btn-sm w-full" data-action="doSearch">Search</button></div></div></div></div>`;
 }
 
 export function renderAdvancedSearch(user, results = {}, options = {}) {
-  const { teams = [], stages = [] } = options;
+  const { teams = [], entityNames = [] } = options;
   const allResults = [];
   for (const [entityType, items] of Object.entries(results)) {
     (items || []).forEach(item => allResults.push({ ...item, _type: entityType }));
@@ -33,11 +37,11 @@ export function renderAdvancedSearch(user, results = {}, options = {}) {
 
   const resultCards = allResults.length > 0
     ? allResults.map(r => resultCard(r, r._type)).join('')
-    : emptyState('Enter a search query to find engagements, clients, RFIs, and reviews', 'search');
+    : emptyState('Enter a search query to find records across every entity', 'search');
 
-  const content = `<div class="flex justify-between items-center mb-6"><h1 class="text-2xl font-bold">Advanced Search</h1></div>${filterPanel(teams, stages)}<div class="flex items-center gap-2 mb-4"><span class="text-sm text-gray-500">${totalCount} result${totalCount !== 1 ? 's' : ''}</span>${countBadges}</div><div id="search-results">${resultCards}</div>`;
+  const content = `<div class="flex justify-between items-center mb-6"><h1 class="text-2xl font-bold">Advanced Search</h1></div>${filterPanel(teams, entityNames)}<div class="flex items-center gap-2 mb-4"><span class="text-sm text-gray-500">${totalCount} result${totalCount !== 1 ? 's' : ''}</span>${countBadges}</div><div id="search-results">${resultCards}</div>`;
 
-  const searchScript = `window.doSearch=async function(){const q=document.getElementById('search-query')?.value||'';const entity=document.getElementById('filter-entity')?.value||'';const status=document.getElementById('filter-status')?.value||'';const stage=document.getElementById('filter-stage')?.value||'';const team=document.getElementById('filter-team')?.value||'';const from=document.getElementById('filter-from')?.value||'';const to=document.getElementById('filter-to')?.value||'';const params=new URLSearchParams();if(q)params.set('q',q);if(entity)params.set('entity',entity);if(status)params.set('status',status);if(stage)params.set('stage',stage);if(team)params.set('team',team);if(from)params.set('from',from);if(to)params.set('to',to);window.location='/search?'+params.toString()};document.getElementById('search-query')?.addEventListener('keydown',function(e){if(e.key==='Enter')doSearch()})`;
+  const searchScript = `window.doSearch=async function(){const q=document.getElementById('search-query')?.value||'';const entity=document.getElementById('filter-entity')?.value||'';const status=document.getElementById('filter-status')?.value||'';const team=document.getElementById('filter-team')?.value||'';const from=document.getElementById('filter-from')?.value||'';const to=document.getElementById('filter-to')?.value||'';const params=new URLSearchParams();if(q)params.set('q',q);if(entity)params.set('entity',entity);if(status)params.set('status',status);if(team)params.set('team',team);if(from)params.set('from',from);if(to)params.set('to',to);window.location='/search?'+params.toString()};document.getElementById('search-query')?.addEventListener('keydown',function(e){if(e.key==='Enter')doSearch()})`;
 
   return page(user, 'Search | Thatcher', [{ href: '/', label: 'Dashboard' }, { label: 'Search' }], content, [searchScript]);
 }

package/src/ui/layout.js

@@ -140,6 +140,7 @@ export function nav(user, pathname = '') {
       <div class="user-dropdown-email">${esc(user?.email || '')}</div>
       <div class="user-dropdown-role" style="text-transform:capitalize">${esc(user?.role || '')}</div>
     </div>
+    <div id="org-switcher" style="display:none"></div>
     <a href="/api/auth/logout" class="user-dropdown-item">
       <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true"><path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4"/><polyline points="16 17 21 12 16 7"/><line x1="21" y1="12" x2="9" y2="12"/></svg>
       Sign out
@@ -208,11 +209,13 @@ schedule()})();
 
 const NOTIF_SCRIPT = `(function(){function loadNotifCount(){fetch('/api/notifications?unread=1',{credentials:'same-origin'}).then(function(r){return r.json()}).then(function(d){var n=(d.data||[]).length;var el=document.getElementById('notif-count');if(!el)return;if(n>0){el.textContent=n>99?'99+':n;el.style.display='block'}else{el.style.display='none'}}).catch(function(){})}loadNotifCount();setInterval(loadNotifCount,60000)})();`;
 
+const ORG_SWITCHER_SCRIPT = `(function(){var loaded=false;function loadMemberships(){if(loaded)return;var el=document.getElementById('org-switcher');if(!el)return;fetch('/api/organization/memberships',{credentials:'same-origin'}).then(function(r){if(!r.ok)return null;return r.json()}).then(function(d){if(!d||!d.organizations||d.organizations.length<2){return}loaded=true;var wrap=document.createElement('div');wrap.className='user-dropdown-item';wrap.style.cursor='default';var select=document.createElement('select');select.id='org-switcher-select';select.style.width='100%';d.organizations.forEach(function(o){var opt=document.createElement('option');opt.value=o.id;opt.textContent=o.name;if(o.id===d.active)opt.selected=true;select.appendChild(opt)});wrap.appendChild(select);el.innerHTML='';el.appendChild(wrap);el.style.display='block';select.addEventListener('change',function(e){fetch('/api/organization/switch',{method:'POST',credentials:'same-origin',headers:{'Content-Type':'application/json'},body:JSON.stringify({organization_id:e.target.value})}).then(function(r){if(r.ok)location.reload()})})}).catch(function(){})}document.getElementById('user-avatar')&&document.getElementById('user-avatar').addEventListener('click',loadMemberships)})();`;
+
 export function page(user, title, bc, content, scripts = []) {
   const authData = user ? JSON.stringify({ id: user.id, name: user.name, email: user.email, role: user.role }) : 'null'
   const authScript = `window.__AUTH__=${authData};`
   const body = `<div class="min-h-screen">${nav(user)}<main id="main-content" ${role.main} class="page-shell">${breadcrumb(bc)}${content}</main></div>`
-  return generateHtml(title, body, [authScript, NOTIF_SCRIPT, ...scripts])
+  return generateHtml(title, body, [authScript, NOTIF_SCRIPT, ORG_SWITCHER_SCRIPT, ...scripts])
 }
 
 export function fullPage(user, title, content, scripts = []) {

package/src/ui/page-handler.js

@@ -1,6 +1,6 @@
 import { getUser, setCurrentRequest } from '@/engine.server.js';
 import { hasGoogleAuth } from '@/config/env.js';
-import { getSpec } from '@/config/spec-helpers.js';
+import { getSpec, getAllEntityNames } from '@/config/spec-helpers.js';
 import { list, get } from '@/lib/busybase/store.js';
 import { renderLogin, renderDashboard, renderAccessDenied, renderPasswordReset, renderPasswordResetConfirm, REDIRECT } from '@/ui/renderer.js';
 import { renderClientDashboard, renderClientList } from '@/ui/client-renderer.js';
@@ -63,11 +63,13 @@ async function handleSearch(user, req) {
   const url = reqUrl(req);
   const q = url.searchParams.get('q') || '', entityFilter = url.searchParams.get('entity') || '', statusFilter = url.searchParams.get('status') || '';
   let teams = []; try { teams = await list('team', {}); } catch {}
+  const allEntityNames = getAllEntityNames().filter(eName => canList(user, eName));
+  const searchableEntities = entityFilter ? allEntityNames.filter(e => e === entityFilter) : allEntityNames;
   const results = {};
-  for (const eName of (entityFilter ? [entityFilter] : ['engagement', 'client', 'rfi', 'review'])) {
-    try { let items = await list(eName, {}); if (q) items = items.filter(i => JSON.stringify(i).toLowerCase().includes(q.toLowerCase())); if (statusFilter) items = items.filter(i => i.status === statusFilter); const spec = getSpec(eName); if (spec) items = resolveRefFields(items, spec); results[eName] = items.slice(0, 50); } catch {}
+  for (const eName of searchableEntities) {
+    try { let items = await list(eName, {}, { user }); if (q) items = items.filter(i => JSON.stringify(i).toLowerCase().includes(q.toLowerCase())); if (statusFilter) items = items.filter(i => i.status === statusFilter); const spec = getSpec(eName); if (spec) items = resolveRefFields(items, spec); results[eName] = items.slice(0, 50); } catch {}
   }
-  return renderAdvancedSearch(user, results, { teams, stages: ['info_gathering', 'commencement', 'team_execution', 'partner_review', 'finalization', 'closeout'] });
+  return renderAdvancedSearch(user, results, { teams, entityNames: allEntityNames });
 }
 async function handleGenericEntityView(user, entityName, id) {
   const spec = getSpec(entityName); if (!spec) return null;
@@ -79,7 +81,7 @@ async function handleGenericEntityView(user, entityName, id) {
     return lazyEntityForm(entityName, null, resolvedSpec, user, true, await getRefOptions(resolvedSpec));
   }
   if (!canView(user, entityName)) return renderAccessDenied(user, entityName, 'view');
-  const item = await get(entityName, id); if (!item) return null;
+  const item = await get(entityName, id, { user }); if (!item) return null;
   if (item.team_id && user.team_id && item.team_id !== user.team_id && !isPartner(user)) return renderAccessDenied(user, entityName, 'view');
   if (isClientUser(user) && user.client_id && item.client_id && item.client_id !== user.client_id) return renderAccessDenied(user, entityName, 'view');
   const [resolvedItem] = resolveRefFields([item], spec);
@@ -221,7 +223,7 @@ export async function handlePage(pathname, req, res) {
     const spec = getSpec(entityName); if (!spec) return null;
     if (isClientUser(user) && !canClientAccessEntity(user, entityName)) return renderAccessDenied(user, entityName, 'list');
     if (!canList(user, entityName)) return renderAccessDenied(user, entityName, 'list');
-    let items = await list(entityName, {});
+    let items = await list(entityName, {}, { user });
     if (isClientUser(user) && user.client_id) items = items.filter(item => { if (item.client_id) return item.client_id === user.client_id; if (item.assigned_to) return item.assigned_to === user.id; return true; });
     items = resolveRefFields(items, spec);
     const params = reqUrl(req).searchParams;