thatcher 1.0.58 → 1.0.60

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.58",
+  "version": "1.0.60",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/lib/config-generator-engine.js

@@ -54,6 +54,26 @@ export class ConfigGeneratorEngine {
     return this.masterConfig?.system?.multi_tenancy?.enabled === true;
   }
 
+  updateWorkflow(workflowName, updatedDef) {
+    if (!workflowName || typeof workflowName !== 'string') {
+      throw new Error('[ConfigGeneratorEngine] updateWorkflow: workflowName required');
+    }
+    const nextWorkflows = { ...(this.masterConfig.workflows || {}), [workflowName]: updatedDef };
+    this.masterConfig = deepFreeze({ ...this.masterConfig, workflows: nextWorkflows });
+    this.specCache.clear();
+    return this;
+  }
+
+  updatePermissionTemplate(templateName, roleActionsMap) {
+    if (!templateName || typeof templateName !== 'string') {
+      throw new Error('[ConfigGeneratorEngine] updatePermissionTemplate: templateName required');
+    }
+    const nextTemplates = { ...(this.masterConfig.permission_templates || {}), [templateName]: roleActionsMap };
+    this.masterConfig = deepFreeze({ ...this.masterConfig, permission_templates: nextTemplates });
+    this.specCache.clear();
+    return this;
+  }
+
   registerPlugin(entityName, plugin = {}) {
     if (!entityName || typeof entityName !== 'string') {
       throw new Error('[ConfigGeneratorEngine] registerPlugin: entityName required');

package/src/lib/workflow-engine.js

@@ -30,6 +30,11 @@ const log = createLogger('[WorkflowEngine]');
 const LOCKOUT_SECONDS = 300; // 5 minutes default
 const workflowCache = new Map();
 
+export function clearWorkflowCache(workflowName) {
+  if (workflowName) workflowCache.delete(workflowName);
+  else workflowCache.clear();
+}
+
 function getWorkflowDef(workflowName) {
   if (workflowCache.has(workflowName)) {
     return workflowCache.get(workflowName);

package/src/server/server.js

@@ -114,6 +114,14 @@ export function createServer(options) {
           return await handleListMemberships(req, res, thatcher, configEngine);
         }
 
+        if (req.method === 'POST' && entity === 'workflow' && id && action === 'update') {
+          return await handleUpdateWorkflow(req, res, id, thatcher, configEngine);
+        }
+
+        if (req.method === 'POST' && entity === 'permission-template' && id && action === 'update') {
+          return await handleUpdatePermissionTemplate(req, res, id, thatcher, configEngine);
+        }
+
         // Check if user has custom route for this
         const userRoutePath = path.join(process.cwd(), 'app/api', ...parts, 'route.js');
         const routeExists = await fileExists(userRoutePath);
@@ -341,6 +349,159 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
   }
 }
 
+const PERMISSION_ACTIONS = new Set(['list', 'view', 'create', 'edit', 'delete', 'archive', 'export', 'manage_settings']);
+
+async function handleUpdatePermissionTemplate(req, res, templateName, thatcher, configEngineArg) {
+  const user = await resolveRequestUser(req);
+  if (!user) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Authentication required' }));
+    return;
+  }
+  const { isPartner } = await import('../ui/permissions-ui.js');
+  if (!isPartner(user)) {
+    res.writeHead(403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Forbidden' }));
+    return;
+  }
+
+  let configEngine = configEngineArg || thatcher?.configEngine || globalThis.__thatcherConfigEngine;
+  if (!configEngine) {
+    const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
+    configEngine = getConfigEngineSync();
+  }
+  const existingTemplate = configEngine.getConfig().permission_templates?.[templateName];
+  if (!existingTemplate) {
+    res.writeHead(404);
+    res.end(JSON.stringify({ error: `Permission template "${templateName}" not found` }));
+    return;
+  }
+  const validRoles = new Set(Object.keys(configEngine.getRoles()));
+
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (e) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: e.message }));
+    return;
+  }
+  const roles = body && typeof body.roles === 'object' && !Array.isArray(body.roles) ? body.roles : null;
+  if (!roles) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'roles object required' }));
+    return;
+  }
+  for (const [roleName, actions] of Object.entries(roles)) {
+    if (!validRoles.has(roleName)) {
+      res.writeHead(400);
+      res.end(JSON.stringify({ error: `unknown role "${roleName}"` }));
+      return;
+    }
+    if (!Array.isArray(actions)) {
+      res.writeHead(400);
+      res.end(JSON.stringify({ error: `actions for role "${roleName}" must be an array` }));
+      return;
+    }
+    for (const a of actions) {
+      if (!PERMISSION_ACTIONS.has(a)) {
+        res.writeHead(400);
+        res.end(JSON.stringify({ error: `unknown action "${a}" for role "${roleName}"` }));
+        return;
+      }
+    }
+  }
+
+  try {
+    configEngine.updatePermissionTemplate(templateName, roles);
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, template: templateName, roleCount: Object.keys(roles).length }));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(500);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
+async function handleUpdateWorkflow(req, res, workflowName, thatcher, configEngineArg) {
+  const user = await resolveRequestUser(req);
+  if (!user) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Authentication required' }));
+    return;
+  }
+  const { isPartner } = await import('../ui/permissions-ui.js');
+  if (!isPartner(user)) {
+    res.writeHead(403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Forbidden' }));
+    return;
+  }
+
+  let configEngine = configEngineArg || thatcher?.configEngine || globalThis.__thatcherConfigEngine;
+  if (!configEngine) {
+    const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
+    configEngine = getConfigEngineSync();
+  }
+  const existingDef = configEngine.getConfig().workflows?.[workflowName];
+  if (!existingDef) {
+    res.writeHead(404);
+    res.end(JSON.stringify({ error: `Workflow "${workflowName}" not found` }));
+    return;
+  }
+
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (e) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: e.message }));
+    return;
+  }
+  const stages = Array.isArray(body?.stages) ? body.stages : null;
+  if (!stages || !stages.length) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'stages array required and must be non-empty' }));
+    return;
+  }
+  const seenNames = new Set();
+  for (const s of stages) {
+    if (!s || typeof s.name !== 'string' || !s.name.trim()) {
+      res.writeHead(400);
+      res.end(JSON.stringify({ error: 'every stage requires a non-empty name' }));
+      return;
+    }
+    if (seenNames.has(s.name)) {
+      res.writeHead(400);
+      res.end(JSON.stringify({ error: `duplicate stage name "${s.name}"` }));
+      return;
+    }
+    seenNames.add(s.name);
+  }
+  const validNames = new Set(stages.map(s => s.name));
+  for (const s of stages) {
+    for (const target of (s.forward || [])) {
+      if (!validNames.has(target)) {
+        res.writeHead(400);
+        res.end(JSON.stringify({ error: `stage "${s.name}" has a forward transition to unknown stage "${target}"` }));
+        return;
+      }
+    }
+  }
+
+  try {
+    const updatedDef = { ...existingDef, stages };
+    configEngine.updateWorkflow(workflowName, updatedDef);
+    const { clearWorkflowCache } = await import('../lib/workflow-engine.js');
+    clearWorkflowCache(workflowName);
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, workflow: workflowName, stageCount: stages.length }));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(500);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
 async function handleListMemberships(req, res, thatcher, configEngineArg) {
   const user = await resolveRequestUser(req);
   if (!user) {

package/src/ui/page-handler-admin.js

@@ -6,6 +6,8 @@ import { renderSettingsTemplates, renderSettingsChecklists, renderSettingsEntity
 import { renderSettingsNotifications, renderSettingsIntegrations, renderSettingsRecreation, renderSettingsReviewSettings, renderSettingsFileReview, renderSettingsMwrPermissions } from '@/ui/settings/review.js';
 import { renderChecklistsManagement } from '@/ui/checklist-renderer.js';
 import { renderJobManagement } from '@/ui/job-management-renderer.js';
+import { renderWorkflowList, renderWorkflowEditor } from '@/ui/workflow-builder-renderer.js';
+import { renderRolesList, renderTemplateList, renderPermissionMatrix } from '@/ui/rbac-renderer.js';
 import { isPartner, isManager } from '@/ui/permissions-ui.js';
 import { getSystemConfig, getSettingsCounts, getAuditData, getSystemHealth, renderBuildLogsContent } from '@/ui/page-handler-helpers.js';
 import { fileURLToPath } from 'url';
@@ -127,5 +129,39 @@ export async function handleAdminPage(normalized, segments, user) {
     let logs = []; try { logs = (await list('job_log', {})).slice(0, 20); } catch {}
     return renderJobManagement(user, jobs, logs);
   }
+  if (normalized === '/admin/workflows') {
+    const { getConfigEngineSync } = await import('@/lib/config-generator-engine.js');
+    const engine = getConfigEngineSync();
+    const config = engine.getConfig();
+    return renderWorkflowList(user, Object.keys(config.workflows || {}));
+  }
+  if (segments.length === 3 && segments[1] === 'workflows') {
+    const { getConfigEngineSync } = await import('@/lib/config-generator-engine.js');
+    const engine = getConfigEngineSync();
+    const config = engine.getConfig();
+    const workflowDef = config.workflows?.[segments[2]];
+    if (!workflowDef) return null;
+    return renderWorkflowEditor(user, segments[2], workflowDef);
+  }
+  if (normalized === '/admin/roles') {
+    const { getConfigEngineSync } = await import('@/lib/config-generator-engine.js');
+    const engine = getConfigEngineSync();
+    return renderRolesList(user, engine.getRoles());
+  }
+  if (normalized === '/admin/permissions') {
+    const { getConfigEngineSync } = await import('@/lib/config-generator-engine.js');
+    const engine = getConfigEngineSync();
+    const config = engine.getConfig();
+    return renderTemplateList(user, Object.keys(config.permission_templates || {}));
+  }
+  if (segments.length === 3 && segments[1] === 'permissions') {
+    const { getConfigEngineSync } = await import('@/lib/config-generator-engine.js');
+    const engine = getConfigEngineSync();
+    const config = engine.getConfig();
+    const roleActionsMap = config.permission_templates?.[segments[2]];
+    if (!roleActionsMap) return null;
+    const roleNames = Object.keys(engine.getRoles());
+    return renderPermissionMatrix(user, segments[2], roleNames, roleActionsMap);
+  }
   return null;
 }

package/src/ui/rbac-renderer.js

@@ -0,0 +1,63 @@
+import { page } from '@/ui/layout.js';
+import { esc } from '@/ui/render-helpers.js';
+
+const ACTIONS = ['list', 'view', 'create', 'edit', 'delete', 'archive', 'export', 'manage_settings'];
+
+export function renderRolesList(user, roles) {
+  const sorted = Object.entries(roles).sort((a, b) => (a[1].hierarchy ?? 999) - (b[1].hierarchy ?? 999));
+  const rows = sorted.map(([name, def]) =>
+    `<tr data-row><td>${esc(name)}</td><td>${esc(def.label || name)}</td><td>${esc(String(def.hierarchy ?? '-'))}</td><td>${esc(def.permissions_scope || '-')}</td></tr>`
+  ).join('') || '<tr><td colspan="4">No roles configured</td></tr>';
+  const content = `<div class="page-header"><h1 class="page-title">Roles</h1></div>
+    <div class="table-wrap"><table class="data-table"><thead><tr><th>Name</th><th>Label</th><th>Hierarchy</th><th>Scope</th></tr></thead><tbody>${rows}</tbody></table></div>
+    <div style="margin-top:16px"><a href="/admin/permissions" class="btn-ghost-clean">Edit Permission Templates</a></div>`;
+  return page(user, 'Roles | Thatcher', [{ href: '/admin/settings', label: 'Settings' }, { label: 'Roles' }], content);
+}
+
+export function renderTemplateList(user, templateNames) {
+  const rows = templateNames.map(name =>
+    `<tr data-row data-navigate="/admin/permissions/${esc(name)}" style="cursor:pointer"><td>${esc(name)}</td></tr>`
+  ).join('') || '<tr><td>No permission templates configured</td></tr>';
+  const content = `<div class="page-header"><h1 class="page-title">Permission Templates</h1></div>
+    <div class="table-wrap"><table class="data-table"><thead><tr><th>Name</th></tr></thead><tbody>${rows}</tbody></table></div>`;
+  return page(user, 'Permission Templates | Thatcher', [{ href: '/admin/settings', label: 'Settings' }, { href: '/admin/roles', label: 'Roles' }, { label: 'Permission Templates' }], content);
+}
+
+export function renderPermissionMatrix(user, templateName, roleNames, roleActionsMap) {
+  const header = ACTIONS.map(a => `<th style="text-align:center">${esc(a)}</th>`).join('');
+  const rows = roleNames.map(role => {
+    const actions = roleActionsMap[role] || [];
+    const cells = ACTIONS.map(a =>
+      `<td style="text-align:center"><input type="checkbox" data-role="${esc(role)}" data-action="${esc(a)}"${actions.includes(a) ? ' checked' : ''}></td>`
+    ).join('');
+    return `<tr><td>${esc(role)}</td>${cells}</tr>`;
+  }).join('');
+
+  const content = `<div class="page-header"><h1 class="page-title">Permissions: ${esc(templateName)}</h1></div>
+    <div class="table-wrap"><table class="data-table" id="perm-matrix"><thead><tr><th>Role</th>${header}</tr></thead><tbody>${rows}</tbody></table></div>
+    <div style="margin-top:16px">
+      <button type="button" class="btn-primary-clean" data-action="savePermissions" data-args='["${esc(templateName)}"]'>Save</button>
+      <span id="save-status" style="margin-left:12px;font-size:13px"></span>
+    </div>`;
+
+  const script = `(function(){
+    window.savePermissions=function(templateName){
+      var boxes=document.querySelectorAll('#perm-matrix input[type="checkbox"]');
+      var map={};
+      boxes.forEach(function(cb){
+        var role=cb.getAttribute('data-role');
+        var action=cb.getAttribute('data-action');
+        if(!map[role])map[role]=[];
+        if(cb.checked)map[role].push(action);
+      });
+      var status=document.getElementById('save-status');
+      status.textContent='Saving...';
+      fetch('/api/permission-template/'+templateName+'/update',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({roles:map})})
+        .then(function(r){return r.json().then(function(d){return {ok:r.ok,d:d}})})
+        .then(function(res){if(res.ok){status.textContent='Saved';status.style.color='var(--color-success,#22c55e)';setTimeout(function(){location.reload()},500)}else{status.textContent='Error: '+(res.d.error||'save failed');status.style.color='var(--color-danger,#ef4444)'}})
+        .catch(function(err){status.textContent='Error: '+err.message;status.style.color='var(--color-danger,#ef4444)'});
+    };
+  })();`;
+
+  return page(user, `Permissions: ${templateName} | Thatcher`, [{ href: '/admin/settings', label: 'Settings' }, { href: '/admin/roles', label: 'Roles' }, { href: '/admin/permissions', label: 'Permission Templates' }, { label: templateName }], content, [script]);
+}

package/src/ui/workflow-builder-renderer.js

@@ -0,0 +1,109 @@
+import { page } from '@/ui/layout.js';
+import { esc } from '@/ui/render-helpers.js';
+
+export function renderWorkflowList(user, workflowNames) {
+  const rows = workflowNames.map(name =>
+    `<tr data-row data-navigate="/admin/workflows/${esc(name)}" style="cursor:pointer"><td>${esc(name)}</td></tr>`
+  ).join('') || '<tr><td>No workflows configured</td></tr>';
+  const content = `<div class="page-header"><h1 class="page-title">Workflows</h1></div>
+    <div class="table-wrap"><table class="data-table"><thead><tr><th>Name</th></tr></thead><tbody>${rows}</tbody></table></div>`;
+  return page(user, 'Workflows | Thatcher', [{ href: '/admin/settings', label: 'Settings' }, { label: 'Workflows' }], content);
+}
+
+function stageRow(stage, allStageNames) {
+  const forwardOpts = allStageNames.filter(n => n !== stage.name).map(n =>
+    `<label style="display:inline-flex;align-items:center;gap:4px;margin-right:10px"><input type="checkbox" name="forward_${esc(stage.name)}" value="${esc(n)}"${(stage.forward || []).includes(n) ? ' checked' : ''}>${esc(n)}</label>`
+  ).join('');
+  return `<div class="card-clean" style="margin-bottom:12px" data-stage-card="${esc(stage.name)}">
+    <div class="card-clean-body">
+      <div style="display:flex;gap:12px;align-items:center;margin-bottom:8px">
+        <input type="text" name="name_${esc(stage.name)}" value="${esc(stage.name)}" placeholder="stage name" style="width:140px" readonly>
+        <input type="text" name="label_${esc(stage.name)}" value="${esc(stage.label || '')}" placeholder="Label" style="flex:1">
+        <input type="text" name="role_${esc(stage.name)}" value="${esc((stage.requires_role || []).join(','))}" placeholder="requires_role (comma-separated)" style="width:200px">
+        <button type="button" class="btn-ghost-clean" data-action="removeStage" data-args='["${esc(stage.name)}"]'>Remove</button>
+      </div>
+      <div style="font-size:12px;color:var(--color-text-muted,#666)">Forward transitions:</div>
+      <div>${forwardOpts || '<span style="font-size:12px;color:var(--color-text-muted,#666)">(no other stages)</span>'}</div>
+    </div>
+  </div>`;
+}
+
+export function renderWorkflowEditor(user, workflowName, workflowDef) {
+  const stages = workflowDef?.stages || [];
+  const stageNames = stages.map(s => s.name);
+  const stageCards = stages.map(s => stageRow(s, stageNames)).join('');
+
+  const content = `<div class="page-header"><h1 class="page-title">Workflow: ${esc(workflowName)}</h1></div>
+    <form id="workflow-form">
+      <div id="stage-list">${stageCards}</div>
+      <div style="margin:16px 0;display:flex;gap:8px">
+        <input type="text" id="new-stage-name" placeholder="new stage name" style="width:200px">
+        <button type="button" class="btn-ghost-clean" data-action="addStage">Add Stage</button>
+      </div>
+      <button type="button" class="btn-primary-clean" data-action="saveWorkflow" data-args='["${esc(workflowName)}"]'>Save Workflow</button>
+      <span id="save-status" style="margin-left:12px;font-size:13px"></span>
+    </form>`;
+
+  const script = `(function(){
+    function collectStages(){
+      var cards=document.querySelectorAll('[data-stage-card]');
+      var stages=[];
+      cards.forEach(function(card,idx){
+        var origName=card.getAttribute('data-stage-card');
+        var nameInput=card.querySelector('input[name^="name_"]');
+        var labelInput=card.querySelector('input[name^="label_"]');
+        var roleInput=card.querySelector('input[name^="role_"]');
+        var checked=Array.prototype.slice.call(card.querySelectorAll('input[type="checkbox"]:checked')).map(function(cb){return cb.value});
+        var roles=(roleInput.value||'').split(',').map(function(s){return s.trim()}).filter(Boolean);
+        stages.push({name:origName,label:labelInput.value||origName,order:idx,forward:checked,requires_role:roles});
+      });
+      return stages;
+    }
+    window.addStage=function(){
+      var input=document.getElementById('new-stage-name');
+      var name=(input.value||'').trim();
+      if(!name)return;
+      if(document.querySelector('[data-stage-card="'+name+'"]')){alert('Stage already exists');return}
+      var div=document.createElement('div');
+      div.className='card-clean';
+      div.style.marginBottom='12px';
+      div.setAttribute('data-stage-card',name);
+      var body=document.createElement('div');
+      body.className='card-clean-body';
+      var row=document.createElement('div');
+      row.style.cssText='display:flex;gap:12px;align-items:center;margin-bottom:8px';
+      var nameInput=document.createElement('input');
+      nameInput.type='text';nameInput.name='name_'+name;nameInput.value=name;nameInput.readOnly=true;nameInput.style.width='140px';
+      var labelInput=document.createElement('input');
+      labelInput.type='text';labelInput.name='label_'+name;labelInput.placeholder='Label';labelInput.style.flex='1';
+      var roleInput=document.createElement('input');
+      roleInput.type='text';roleInput.name='role_'+name;roleInput.placeholder='requires_role (comma-separated)';roleInput.style.width='200px';
+      var removeBtn=document.createElement('button');
+      removeBtn.type='button';removeBtn.className='btn-ghost-clean';removeBtn.textContent='Remove';
+      removeBtn.addEventListener('click',function(){window.removeStage(name)});
+      row.appendChild(nameInput);row.appendChild(labelInput);row.appendChild(roleInput);row.appendChild(removeBtn);
+      var hint=document.createElement('div');
+      hint.style.cssText='font-size:12px;color:var(--color-text-muted,#666)';
+      hint.textContent='Forward transitions: (save and reload to link)';
+      body.appendChild(row);body.appendChild(hint);
+      div.appendChild(body);
+      document.getElementById('stage-list').appendChild(div);
+      input.value='';
+    };
+    window.removeStage=function(name){
+      var card=document.querySelector('[data-stage-card="'+name+'"]');
+      if(card)card.remove();
+    };
+    window.saveWorkflow=function(workflowName){
+      var stages=collectStages();
+      var status=document.getElementById('save-status');
+      status.textContent='Saving...';
+      fetch('/api/workflow/'+workflowName+'/update',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({stages:stages})})
+        .then(function(r){return r.json().then(function(d){return {ok:r.ok,d:d}})})
+        .then(function(res){if(res.ok){status.textContent='Saved';status.style.color='var(--color-success,#22c55e)';setTimeout(function(){location.reload()},500)}else{status.textContent='Error: '+(res.d.error||'save failed');status.style.color='var(--color-danger,#ef4444)'}})
+        .catch(function(err){status.textContent='Error: '+err.message;status.style.color='var(--color-danger,#ef4444)'});
+    };
+  })();`;
+
+  return page(user, `Workflow: ${workflowName} | Thatcher`, [{ href: '/admin/settings', label: 'Settings' }, { href: '/admin/workflows', label: 'Workflows' }, { label: workflowName }], content, [script]);
+}