thatcher 1.0.59 → 1.0.60

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.59",
+  "version": "1.0.60",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/lib/config-generator-engine.js

@@ -64,6 +64,16 @@ export class ConfigGeneratorEngine {
     return this;
   }
 
+  updatePermissionTemplate(templateName, roleActionsMap) {
+    if (!templateName || typeof templateName !== 'string') {
+      throw new Error('[ConfigGeneratorEngine] updatePermissionTemplate: templateName required');
+    }
+    const nextTemplates = { ...(this.masterConfig.permission_templates || {}), [templateName]: roleActionsMap };
+    this.masterConfig = deepFreeze({ ...this.masterConfig, permission_templates: nextTemplates });
+    this.specCache.clear();
+    return this;
+  }
+
   registerPlugin(entityName, plugin = {}) {
     if (!entityName || typeof entityName !== 'string') {
       throw new Error('[ConfigGeneratorEngine] registerPlugin: entityName required');

package/src/server/server.js

@@ -118,6 +118,10 @@ export function createServer(options) {
           return await handleUpdateWorkflow(req, res, id, thatcher, configEngine);
         }
 
+        if (req.method === 'POST' && entity === 'permission-template' && id && action === 'update') {
+          return await handleUpdatePermissionTemplate(req, res, id, thatcher, configEngine);
+        }
+
         // Check if user has custom route for this
         const userRoutePath = path.join(process.cwd(), 'app/api', ...parts, 'route.js');
         const routeExists = await fileExists(userRoutePath);
@@ -345,6 +349,80 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
   }
 }
 
+const PERMISSION_ACTIONS = new Set(['list', 'view', 'create', 'edit', 'delete', 'archive', 'export', 'manage_settings']);
+
+async function handleUpdatePermissionTemplate(req, res, templateName, thatcher, configEngineArg) {
+  const user = await resolveRequestUser(req);
+  if (!user) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Authentication required' }));
+    return;
+  }
+  const { isPartner } = await import('../ui/permissions-ui.js');
+  if (!isPartner(user)) {
+    res.writeHead(403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Forbidden' }));
+    return;
+  }
+
+  let configEngine = configEngineArg || thatcher?.configEngine || globalThis.__thatcherConfigEngine;
+  if (!configEngine) {
+    const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
+    configEngine = getConfigEngineSync();
+  }
+  const existingTemplate = configEngine.getConfig().permission_templates?.[templateName];
+  if (!existingTemplate) {
+    res.writeHead(404);
+    res.end(JSON.stringify({ error: `Permission template "${templateName}" not found` }));
+    return;
+  }
+  const validRoles = new Set(Object.keys(configEngine.getRoles()));
+
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (e) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: e.message }));
+    return;
+  }
+  const roles = body && typeof body.roles === 'object' && !Array.isArray(body.roles) ? body.roles : null;
+  if (!roles) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'roles object required' }));
+    return;
+  }
+  for (const [roleName, actions] of Object.entries(roles)) {
+    if (!validRoles.has(roleName)) {
+      res.writeHead(400);
+      res.end(JSON.stringify({ error: `unknown role "${roleName}"` }));
+      return;
+    }
+    if (!Array.isArray(actions)) {
+      res.writeHead(400);
+      res.end(JSON.stringify({ error: `actions for role "${roleName}" must be an array` }));
+      return;
+    }
+    for (const a of actions) {
+      if (!PERMISSION_ACTIONS.has(a)) {
+        res.writeHead(400);
+        res.end(JSON.stringify({ error: `unknown action "${a}" for role "${roleName}"` }));
+        return;
+      }
+    }
+  }
+
+  try {
+    configEngine.updatePermissionTemplate(templateName, roles);
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, template: templateName, roleCount: Object.keys(roles).length }));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(500);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
 async function handleUpdateWorkflow(req, res, workflowName, thatcher, configEngineArg) {
   const user = await resolveRequestUser(req);
   if (!user) {

package/src/ui/page-handler-admin.js

@@ -7,6 +7,7 @@ import { renderSettingsNotifications, renderSettingsIntegrations, renderSettings
 import { renderChecklistsManagement } from '@/ui/checklist-renderer.js';
 import { renderJobManagement } from '@/ui/job-management-renderer.js';
 import { renderWorkflowList, renderWorkflowEditor } from '@/ui/workflow-builder-renderer.js';
+import { renderRolesList, renderTemplateList, renderPermissionMatrix } from '@/ui/rbac-renderer.js';
 import { isPartner, isManager } from '@/ui/permissions-ui.js';
 import { getSystemConfig, getSettingsCounts, getAuditData, getSystemHealth, renderBuildLogsContent } from '@/ui/page-handler-helpers.js';
 import { fileURLToPath } from 'url';
@@ -142,5 +143,25 @@ export async function handleAdminPage(normalized, segments, user) {
     if (!workflowDef) return null;
     return renderWorkflowEditor(user, segments[2], workflowDef);
   }
+  if (normalized === '/admin/roles') {
+    const { getConfigEngineSync } = await import('@/lib/config-generator-engine.js');
+    const engine = getConfigEngineSync();
+    return renderRolesList(user, engine.getRoles());
+  }
+  if (normalized === '/admin/permissions') {
+    const { getConfigEngineSync } = await import('@/lib/config-generator-engine.js');
+    const engine = getConfigEngineSync();
+    const config = engine.getConfig();
+    return renderTemplateList(user, Object.keys(config.permission_templates || {}));
+  }
+  if (segments.length === 3 && segments[1] === 'permissions') {
+    const { getConfigEngineSync } = await import('@/lib/config-generator-engine.js');
+    const engine = getConfigEngineSync();
+    const config = engine.getConfig();
+    const roleActionsMap = config.permission_templates?.[segments[2]];
+    if (!roleActionsMap) return null;
+    const roleNames = Object.keys(engine.getRoles());
+    return renderPermissionMatrix(user, segments[2], roleNames, roleActionsMap);
+  }
   return null;
 }

package/src/ui/rbac-renderer.js

@@ -0,0 +1,63 @@
+import { page } from '@/ui/layout.js';
+import { esc } from '@/ui/render-helpers.js';
+
+const ACTIONS = ['list', 'view', 'create', 'edit', 'delete', 'archive', 'export', 'manage_settings'];
+
+export function renderRolesList(user, roles) {
+  const sorted = Object.entries(roles).sort((a, b) => (a[1].hierarchy ?? 999) - (b[1].hierarchy ?? 999));
+  const rows = sorted.map(([name, def]) =>
+    `<tr data-row><td>${esc(name)}</td><td>${esc(def.label || name)}</td><td>${esc(String(def.hierarchy ?? '-'))}</td><td>${esc(def.permissions_scope || '-')}</td></tr>`
+  ).join('') || '<tr><td colspan="4">No roles configured</td></tr>';
+  const content = `<div class="page-header"><h1 class="page-title">Roles</h1></div>
+    <div class="table-wrap"><table class="data-table"><thead><tr><th>Name</th><th>Label</th><th>Hierarchy</th><th>Scope</th></tr></thead><tbody>${rows}</tbody></table></div>
+    <div style="margin-top:16px"><a href="/admin/permissions" class="btn-ghost-clean">Edit Permission Templates</a></div>`;
+  return page(user, 'Roles | Thatcher', [{ href: '/admin/settings', label: 'Settings' }, { label: 'Roles' }], content);
+}
+
+export function renderTemplateList(user, templateNames) {
+  const rows = templateNames.map(name =>
+    `<tr data-row data-navigate="/admin/permissions/${esc(name)}" style="cursor:pointer"><td>${esc(name)}</td></tr>`
+  ).join('') || '<tr><td>No permission templates configured</td></tr>';
+  const content = `<div class="page-header"><h1 class="page-title">Permission Templates</h1></div>
+    <div class="table-wrap"><table class="data-table"><thead><tr><th>Name</th></tr></thead><tbody>${rows}</tbody></table></div>`;
+  return page(user, 'Permission Templates | Thatcher', [{ href: '/admin/settings', label: 'Settings' }, { href: '/admin/roles', label: 'Roles' }, { label: 'Permission Templates' }], content);
+}
+
+export function renderPermissionMatrix(user, templateName, roleNames, roleActionsMap) {
+  const header = ACTIONS.map(a => `<th style="text-align:center">${esc(a)}</th>`).join('');
+  const rows = roleNames.map(role => {
+    const actions = roleActionsMap[role] || [];
+    const cells = ACTIONS.map(a =>
+      `<td style="text-align:center"><input type="checkbox" data-role="${esc(role)}" data-action="${esc(a)}"${actions.includes(a) ? ' checked' : ''}></td>`
+    ).join('');
+    return `<tr><td>${esc(role)}</td>${cells}</tr>`;
+  }).join('');
+
+  const content = `<div class="page-header"><h1 class="page-title">Permissions: ${esc(templateName)}</h1></div>
+    <div class="table-wrap"><table class="data-table" id="perm-matrix"><thead><tr><th>Role</th>${header}</tr></thead><tbody>${rows}</tbody></table></div>
+    <div style="margin-top:16px">
+      <button type="button" class="btn-primary-clean" data-action="savePermissions" data-args='["${esc(templateName)}"]'>Save</button>
+      <span id="save-status" style="margin-left:12px;font-size:13px"></span>
+    </div>`;
+
+  const script = `(function(){
+    window.savePermissions=function(templateName){
+      var boxes=document.querySelectorAll('#perm-matrix input[type="checkbox"]');
+      var map={};
+      boxes.forEach(function(cb){
+        var role=cb.getAttribute('data-role');
+        var action=cb.getAttribute('data-action');
+        if(!map[role])map[role]=[];
+        if(cb.checked)map[role].push(action);
+      });
+      var status=document.getElementById('save-status');
+      status.textContent='Saving...';
+      fetch('/api/permission-template/'+templateName+'/update',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({roles:map})})
+        .then(function(r){return r.json().then(function(d){return {ok:r.ok,d:d}})})
+        .then(function(res){if(res.ok){status.textContent='Saved';status.style.color='var(--color-success,#22c55e)';setTimeout(function(){location.reload()},500)}else{status.textContent='Error: '+(res.d.error||'save failed');status.style.color='var(--color-danger,#ef4444)'}})
+        .catch(function(err){status.textContent='Error: '+err.message;status.style.color='var(--color-danger,#ef4444)'});
+    };
+  })();`;
+
+  return page(user, `Permissions: ${templateName} | Thatcher`, [{ href: '/admin/settings', label: 'Settings' }, { href: '/admin/roles', label: 'Roles' }, { href: '/admin/permissions', label: 'Permission Templates' }, { label: templateName }], content, [script]);
+}