thatcher 1.0.66 → 1.0.68

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.66",
+  "version": "1.0.68",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/lib/config-generator-engine.js

@@ -106,10 +106,64 @@ function withWebhookDefaults(masterConfig) {
   return changed ? { ...masterConfig, entities } : masterConfig;
 }
 
+const LEAD_ENTITY_DEFAULT = {
+  label: 'Lead',
+  label_plural: 'Leads',
+  system_entity: true,
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+    company: { type: 'text', label: 'Company' },
+    email: { type: 'email', label: 'Email' },
+    phone: { type: 'text', label: 'Phone' },
+    source: { type: 'text', label: 'Source' },
+    status: { type: 'enum', options: ['new', 'contacted', 'qualified', 'disqualified'], default: 'new', label: 'Status' },
+    owner_id: { type: 'ref', ref: 'user', label: 'Owner' },
+    notes: { type: 'textarea', label: 'Notes' },
+  },
+};
+
+const OPPORTUNITY_PIPELINE_WORKFLOW = {
+  state_field: 'stage',
+  stages: [
+    { name: 'prospecting', label: 'Prospecting', forward: ['qualification'], backward: [] },
+    { name: 'qualification', label: 'Qualification', forward: ['proposal'], backward: ['prospecting'] },
+    { name: 'proposal', label: 'Proposal', forward: ['negotiation'], backward: ['qualification'] },
+    { name: 'negotiation', label: 'Negotiation', forward: ['won', 'lost'], backward: ['proposal'] },
+    { name: 'won', label: 'Won', forward: [], backward: [] },
+    { name: 'lost', label: 'Lost', forward: [], backward: [] },
+  ],
+};
+
+const OPPORTUNITY_ENTITY_DEFAULT = {
+  label: 'Opportunity',
+  label_plural: 'Opportunities',
+  system_entity: true,
+  workflow: 'opportunity_pipeline',
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+    lead_id: { type: 'ref', ref: 'lead', label: 'Lead' },
+    value: { type: 'currency', label: 'Value' },
+    stage: { type: 'enum', options: ['prospecting', 'qualification', 'proposal', 'negotiation', 'won', 'lost'], default: 'prospecting', label: 'Stage' },
+    expected_close_date: { type: 'date', label: 'Expected Close Date' },
+    owner_id: { type: 'ref', ref: 'user', label: 'Owner' },
+    probability: { type: 'number', min: 0, max: 100, label: 'Probability (%)' },
+  },
+};
+
+function withCrmDefaults(masterConfig) {
+  const entities = { ...(masterConfig.entities || {}) };
+  const workflows = { ...(masterConfig.workflows || {}) };
+  let changed = false;
+  if (!entities.lead) { entities.lead = LEAD_ENTITY_DEFAULT; changed = true; }
+  if (!entities.opportunity) { entities.opportunity = OPPORTUNITY_ENTITY_DEFAULT; changed = true; }
+  if (!workflows.opportunity_pipeline) { workflows.opportunity_pipeline = OPPORTUNITY_PIPELINE_WORKFLOW; changed = true; }
+  return changed ? { ...masterConfig, entities, workflows } : masterConfig;
+}
+
 export class ConfigGeneratorEngine {
   constructor(masterConfig) {
     if (!masterConfig) throw new Error('[ConfigGeneratorEngine] masterConfig is required');
-    this.masterConfig = deepFreeze(withWebhookDefaults(withMultiTenancyDefaults(masterConfig)));
+    this.masterConfig = deepFreeze(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig))));
     this.specCache = new LRUCache(100);
     this.debugMode = false;
     this._plugins = new Map();

package/src/lib/oauth-state-store.js

@@ -0,0 +1,39 @@
+import crypto from 'crypto';
+
+// Short-lived (5 min), single-use state store for OAuth CSRF protection. A
+// long-lived state (e.g. reusing the session TTL, as the orphaned
+// app/api/auth/google route did) widens the CSRF window far past what an
+// authorization-code round trip needs; 5 minutes is generous for a login flow
+// and small for an attacker to exploit.
+const TTL_MS = 5 * 60 * 1000;
+const store = new Map();
+
+let sweepHandle = null;
+function ensureSweep() {
+  if (sweepHandle) return;
+  sweepHandle = setInterval(() => {
+    const now = Date.now();
+    for (const [key, entry] of store) {
+      if (entry.expiresAt < now) store.delete(key);
+    }
+  }, TTL_MS);
+  if (sweepHandle.unref) sweepHandle.unref();
+}
+
+export function createOAuthState(data) {
+  ensureSweep();
+  const key = crypto.randomBytes(32).toString('hex');
+  store.set(key, { data, expiresAt: Date.now() + TTL_MS });
+  return key;
+}
+
+// Single-use: a matched state is deleted on first read, so a replayed
+// callback URL (e.g. from browser history or a leaked Referer) cannot
+// re-consume the same state a second time.
+export function consumeOAuthState(key) {
+  const entry = store.get(key);
+  if (!entry) return null;
+  store.delete(key);
+  if (entry.expiresAt < Date.now()) return null;
+  return entry.data;
+}

package/src/lib/workflow-engine.js

@@ -147,7 +147,12 @@ export function getTransitionStatus(record) {
 }
 
 export async function transition(entityType, entityId, workflowName, toState, user, reason = '') {
-  const record = await get(entityType, entityId);
+  // get(...,{user}) enforces the same row/org access scoping every other read
+  // path applies -- without it, a transition could read and act on a record
+  // outside the caller's org/row-access simply because this is a state-machine
+  // write rather than a plain field update, the exact bypass class bulk-ops'
+  // delete/set_field actions already close via the same call shape.
+  const record = await get(entityType, entityId, { user });
   if (!record) throw new AppError('Record not found', 'NOT_FOUND', HTTP.NOT_FOUND);
 
   validateTransition(workflowName, record.status || record.stage, toState, user);

package/src/server/server.js

@@ -119,6 +119,18 @@ export function createServer(options) {
         const id = parts[1] || null;
         const action = parts[2] || null;
 
+        if (req.method === 'GET' && entity === 'auth' && id === 'google' && !action) {
+          return await handleOAuthGoogleStart(req, res);
+        }
+
+        if (req.method === 'GET' && entity === 'auth' && id === 'google' && action === 'callback') {
+          return await handleOAuthGoogleCallback(req, res);
+        }
+
+        if (req.method === 'POST' && id && action === 'transition') {
+          return await handleEntityTransition(req, res, entity, id, thatcher, configEngine);
+        }
+
         if (req.method === 'POST' && id === 'import' && !action) {
           return await handleCsvImport(req, res, entity, thatcher, configEngine);
         }
@@ -498,6 +510,61 @@ async function handleBulkOperation(req, res, entityName, thatcher, configEngineA
   }
 }
 
+async function handleEntityTransition(req, res, entityName, id, thatcher, configEngineArg) {
+  const user = await resolveRequestUser(req);
+  if (!user) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Authentication required' }));
+    return;
+  }
+
+  let configEngine = configEngineArg || thatcher?.configEngine || globalThis.__thatcherConfigEngine;
+  if (!configEngine) {
+    const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
+    configEngine = getConfigEngineSync();
+  }
+  let spec;
+  try {
+    spec = configEngine.generateEntitySpec(entityName);
+  } catch {
+    res.writeHead(404);
+    res.end(JSON.stringify({ error: `Entity "${entityName}" not found` }));
+    return;
+  }
+
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (e) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: e.message }));
+    return;
+  }
+  const workflowName = body?.workflow || spec.workflow;
+  const toState = body?.toState;
+  if (!workflowName || !toState) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'workflow and toState required' }));
+    return;
+  }
+
+  try {
+    const { requirePermission } = await import('../lib/auth-middleware.js');
+    await requirePermission(user, spec, 'edit');
+    const { transition } = await import('../lib/workflow-engine.js');
+    // transition() itself now reads via get(...,{user}) -- the same
+    // row/org-access-scoped path every other read uses -- so a caller
+    // cannot drag-drop a record outside their access into a new stage.
+    const updated = await transition(entityName, id, workflowName, toState, user, body?.reason || '');
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, data: updated }));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(err.status || 400);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
 async function handleCreateEntityTemplate(req, res, thatcher, configEngineArg) {
   const user = await requireAuthedPartner(req, res);
   if (!user) return;
@@ -1126,6 +1193,112 @@ async function handleCsvImport(req, res, entity, thatcher, configEngineArg) {
   }
 }
 
+function oauthRedirectUri(req) {
+  const protocol = req.headers['x-forwarded-proto'] || 'http';
+  const host = req.headers['x-forwarded-host'] || req.headers.host || 'localhost:3000';
+  return `${protocol}://${host}/api/auth/google/callback`;
+}
+
+async function handleOAuthGoogleStart(req, res) {
+  const { getGoogle } = await import('../engine.server.js');
+  let google;
+  try {
+    google = getGoogle();
+  } catch (e) {
+    apiLog.error(e.message);
+    google = null;
+  }
+  if (!google) {
+    res.writeHead(302, { Location: '/login?error=oauth_not_configured' });
+    res.end();
+    return;
+  }
+
+  const { generateState, generateCodeVerifier } = await import('arctic');
+  const { createOAuthState } = await import('../lib/oauth-state-store.js');
+  const state = generateState();
+  const codeVerifier = generateCodeVerifier();
+  const stateKey = createOAuthState({ state, codeVerifier });
+
+  const url = google.createAuthorizationURL(state, codeVerifier, ['profile', 'email']);
+  url.searchParams.set('state', stateKey);
+
+  res.writeHead(302, { Location: url.toString() });
+  res.end();
+}
+
+async function handleOAuthGoogleCallback(req, res) {
+  const url = new URL(req.url, `http://${req.headers.host}`);
+  const code = url.searchParams.get('code');
+  const stateKey = url.searchParams.get('state');
+
+  const { consumeOAuthState } = await import('../lib/oauth-state-store.js');
+  // Single-use consume: a matched key is deleted here on first read, so a
+  // replayed callback URL cannot ride the same state twice, and a stateKey
+  // this server never issued (or one already spent) fails the lookup outright.
+  const stored = stateKey ? consumeOAuthState(stateKey) : null;
+  if (!code || !stateKey || !stored) {
+    res.writeHead(302, { Location: '/login?error=state_mismatch' });
+    res.end();
+    return;
+  }
+
+  try {
+    const { getGoogle, createSession } = await import('../engine.server.js');
+    const google = getGoogle();
+    if (!google) throw new Error('OAuth not configured');
+
+    const tokens = await google.validateAuthorizationCode(code, stored.codeVerifier);
+    const accessToken = tokens.accessToken();
+
+    const userInfoRes = await fetch('https://openidconnect.googleapis.com/v1/userinfo', {
+      headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    if (!userInfoRes.ok) throw new Error('Failed to fetch user info');
+    const googleUser = await userInfoRes.json();
+
+    // Never trust an unverified email to link/create a local account -- Google
+    // returns email_verified=false for e.g. an unverified alias, and creating
+    // or matching an account on that claim would let an attacker who controls
+    // an unverified address impersonate a real user's account.
+    if (!googleUser.email || googleUser.email_verified !== true) {
+      res.writeHead(302, { Location: '/login?error=email_not_verified' });
+      res.end();
+      return;
+    }
+
+    const { getBy, create } = await import('../lib/busybase/store.js');
+    let user = await getBy('user', 'email', googleUser.email);
+    if (!user) {
+      const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
+      const configEngine = getConfigEngineSync();
+      const roles = configEngine.getRoles();
+      const defaultRole = Object.keys(roles)[0] || 'clerk';
+      user = await create('user', {
+        email: googleUser.email,
+        name: googleUser.name || googleUser.email,
+        avatar: googleUser.picture || null,
+        type: 'auditor',
+        role: defaultRole,
+        status: 'active',
+      });
+    }
+
+    const { sessionCookie } = await createSession(user.id);
+    const cookieAttrs = [`Path=${sessionCookie.attributes.path || '/'}`, 'HttpOnly', `SameSite=${sessionCookie.attributes.sameSite || 'Lax'}`];
+    if (sessionCookie.attributes.secure) cookieAttrs.push('Secure');
+    res.writeHead(302, {
+      Location: '/',
+      'Set-Cookie': `${sessionCookie.name}=${sessionCookie.value}; ${cookieAttrs.join('; ')}`,
+    });
+    res.end();
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(302, { Location: '/login?error=oauth_failed' });
+    res.end();
+  }
+}
+
 const UPLOAD_ALLOWED_TYPES = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp', 'application/pdf', 'text/plain', 'text/csv', 'application/json']);
 const UPLOAD_MAX_SIZE = 10 * 1024 * 1024;
 const UPLOAD_DIR = path.join(process.cwd(), 'uploads');

package/src/app/api/auth/google/callback/route.js

@@ -1,97 +0,0 @@
-import { createLogger } from '@/lib/logger.js';
-import { createSession } from '@/engine.server';
-
-const log = createLogger('[OAuth]');
-import { getBy, create } from '@/engine';
-import { Google } from 'arctic';
-import { GOOGLE_APIS } from '@/config/constants';
-import { config } from '@/config';
-import { getConfigEngine } from '@/lib/config-generator-engine';
-import { globalManager } from '@/lib/hot-reload/mutex';
-import { NextResponse } from '@/lib/next-shim';
-import {
-  validateOAuthProvider,
-  getOAuthCookie,
-  deleteOAuthCookie,
-  buildOAuthErrorResponse,
-  validateOAuthState,
-} from '@/lib/auth-route-helpers';
-
-export async function GET(request) {
-  const protocol = request.headers['x-forwarded-proto'] || 'http';
-  const host = request.headers['x-forwarded-host'] || request.headers.host || 'localhost:3000';
-  const redirectUri = `${protocol}://${host}/api/auth/google/callback`;
-
-  const dynamicGoogle = new Google(
-    config.auth.google.clientId,
-    config.auth.google.clientSecret,
-    redirectUri
-  );
-
-  const { valid, error } = validateOAuthProvider(dynamicGoogle);
-  if (!valid) {
-    return buildOAuthErrorResponse(error, request);
-  }
-
-  const url = new URL(request.url);
-  const code = url.searchParams.get('code');
-  const stateKey = url.searchParams.get('state');  // Google returns the key we sent
-
-  const storedData = await getOAuthCookie(stateKey);
-  const state = storedData?.state;
-  const codeVerifier = storedData?.codeVerifier;
-
-  const stateValidation = validateOAuthState(code, stateKey, state, codeVerifier);
-  if (!stateValidation.valid) {
-    log.warn('state validation failed:', { error: stateValidation.error });
-    return buildOAuthErrorResponse(stateValidation.error, request);
-  }
-
-  try {
-    const tokens = await dynamicGoogle.validateAuthorizationCode(code, codeVerifier);
-    const accessToken = tokens.accessToken;
-
-    const googleResponse = await fetch(GOOGLE_APIS.oauth2, {
-      headers: { Authorization: `Bearer ${accessToken}` },
-    });
-
-    if (!googleResponse.ok) {
-      throw new Error('Failed to fetch user info');
-    }
-
-    const googleUser = await googleResponse.json();
-
-    const user = await globalManager.lock('oauth-user-create', async () => {
-      let existing = getBy('user', 'email', googleUser.email);
-      if (existing) return existing;
-
-      const engine = await getConfigEngine();
-      const roles = engine.getRoles();
-      const defaultRole = Object.keys(roles)[0] || 'clerk';
-
-      return create('user', {
-        email: googleUser.email,
-        name: googleUser.name,
-        avatar: googleUser.picture,
-        type: 'auditor',
-        role: defaultRole,
-        status: 'active',
-      });
-    });
-
-    const { sessionCookie } = await createSession(user.id);
-
-    await deleteOAuthCookie(stateKey);
-
-    const redirectUrl = new URL('/', request.url);
-    const response = NextResponse.redirect(redirectUrl);
-
-    const cookieValue = `${sessionCookie.value}; Path=${sessionCookie.attributes.path || '/'}; HttpOnly${sessionCookie.attributes.secure ? '; Secure' : ''}; SameSite=${sessionCookie.attributes.sameSite || 'Lax'}`;
-    response.headers.set('Set-Cookie', `${sessionCookie.name}=${cookieValue}`);
-
-    return response;
-  } catch (error) {
-    log.error('Google OAuth error:', { message: error.message });
-    return buildOAuthErrorResponse('oauth_failed', request);
-  }
-}

package/src/app/api/auth/google/route.js

@@ -1,61 +0,0 @@
-import { NextResponse } from '@/lib/next-shim';
-import { createLogger } from '@/lib/logger.js';
-
-const log = createLogger('[OAuth]');
-import { google } from '@/engine.server';
-import { Google } from 'arctic';
-import { generateState, generateCodeVerifier } from 'arctic';
-import { globalManager } from '@/lib/hot-reload/mutex';
-import { config } from '@/config';
-import { validateOAuthProvider, setOAuthCookie, buildOAuthErrorResponse } from '@/lib/auth-route-helpers';
-
-export async function GET(request) {
-  const url = new URL(request.url);
-  const isCheck = url.searchParams.get('check') === '1';
-
-  if (isCheck) {
-    const { valid } = validateOAuthProvider(google);
-    return new Response(JSON.stringify({ configured: valid }), {
-      status: 200,
-      headers: { 'Content-Type': 'application/json' }
-    });
-  }
-
-  const protocol = request.headers['x-forwarded-proto'] || 'http';
-  const host = request.headers['x-forwarded-host'] || request.headers.host || 'localhost:3000';
-  const redirectUri = `${protocol}://${host}/api/auth/google/callback`;
-
-  const dynamicGoogle = new Google(
-    config.auth.google.clientId,
-    config.auth.google.clientSecret,
-    redirectUri
-  );
-
-  const { valid, error } = validateOAuthProvider(dynamicGoogle);
-  if (!valid) {
-    return buildOAuthErrorResponse(error);
-  }
-
-  return globalManager.lock('oauth-state-init', async () => {
-    const state = generateState();
-    const codeVerifier = generateCodeVerifier();
-
-    const stateKey = await setOAuthCookie('google_oauth_state', { state, codeVerifier });
-
-    const url = await dynamicGoogle.createAuthorizationURL(stateKey, codeVerifier, {
-      scopes: ['profile', 'email'],
-    });
-
-    return NextResponse.redirect(url);
-  });
-}
-
-export async function HEAD(_request) {
-  try {
-    const { valid } = validateOAuthProvider(google);
-    return new Response(null, { status: valid ? 200 : 503 });
-  } catch (error) {
-    log.error('HEAD error:', { message: error.message });
-    return new Response(null, { status: 500 });
-  }
-}