thatcher 1.0.67 → 1.0.68

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.67",
+  "version": "1.0.68",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/lib/config-generator-engine.js

@@ -106,10 +106,64 @@ function withWebhookDefaults(masterConfig) {
   return changed ? { ...masterConfig, entities } : masterConfig;
 }
 
+const LEAD_ENTITY_DEFAULT = {
+  label: 'Lead',
+  label_plural: 'Leads',
+  system_entity: true,
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+    company: { type: 'text', label: 'Company' },
+    email: { type: 'email', label: 'Email' },
+    phone: { type: 'text', label: 'Phone' },
+    source: { type: 'text', label: 'Source' },
+    status: { type: 'enum', options: ['new', 'contacted', 'qualified', 'disqualified'], default: 'new', label: 'Status' },
+    owner_id: { type: 'ref', ref: 'user', label: 'Owner' },
+    notes: { type: 'textarea', label: 'Notes' },
+  },
+};
+
+const OPPORTUNITY_PIPELINE_WORKFLOW = {
+  state_field: 'stage',
+  stages: [
+    { name: 'prospecting', label: 'Prospecting', forward: ['qualification'], backward: [] },
+    { name: 'qualification', label: 'Qualification', forward: ['proposal'], backward: ['prospecting'] },
+    { name: 'proposal', label: 'Proposal', forward: ['negotiation'], backward: ['qualification'] },
+    { name: 'negotiation', label: 'Negotiation', forward: ['won', 'lost'], backward: ['proposal'] },
+    { name: 'won', label: 'Won', forward: [], backward: [] },
+    { name: 'lost', label: 'Lost', forward: [], backward: [] },
+  ],
+};
+
+const OPPORTUNITY_ENTITY_DEFAULT = {
+  label: 'Opportunity',
+  label_plural: 'Opportunities',
+  system_entity: true,
+  workflow: 'opportunity_pipeline',
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+    lead_id: { type: 'ref', ref: 'lead', label: 'Lead' },
+    value: { type: 'currency', label: 'Value' },
+    stage: { type: 'enum', options: ['prospecting', 'qualification', 'proposal', 'negotiation', 'won', 'lost'], default: 'prospecting', label: 'Stage' },
+    expected_close_date: { type: 'date', label: 'Expected Close Date' },
+    owner_id: { type: 'ref', ref: 'user', label: 'Owner' },
+    probability: { type: 'number', min: 0, max: 100, label: 'Probability (%)' },
+  },
+};
+
+function withCrmDefaults(masterConfig) {
+  const entities = { ...(masterConfig.entities || {}) };
+  const workflows = { ...(masterConfig.workflows || {}) };
+  let changed = false;
+  if (!entities.lead) { entities.lead = LEAD_ENTITY_DEFAULT; changed = true; }
+  if (!entities.opportunity) { entities.opportunity = OPPORTUNITY_ENTITY_DEFAULT; changed = true; }
+  if (!workflows.opportunity_pipeline) { workflows.opportunity_pipeline = OPPORTUNITY_PIPELINE_WORKFLOW; changed = true; }
+  return changed ? { ...masterConfig, entities, workflows } : masterConfig;
+}
+
 export class ConfigGeneratorEngine {
   constructor(masterConfig) {
     if (!masterConfig) throw new Error('[ConfigGeneratorEngine] masterConfig is required');
-    this.masterConfig = deepFreeze(withWebhookDefaults(withMultiTenancyDefaults(masterConfig)));
+    this.masterConfig = deepFreeze(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig))));
     this.specCache = new LRUCache(100);
     this.debugMode = false;
     this._plugins = new Map();

package/src/lib/workflow-engine.js

@@ -147,7 +147,12 @@ export function getTransitionStatus(record) {
 }
 
 export async function transition(entityType, entityId, workflowName, toState, user, reason = '') {
-  const record = await get(entityType, entityId);
+  // get(...,{user}) enforces the same row/org access scoping every other read
+  // path applies -- without it, a transition could read and act on a record
+  // outside the caller's org/row-access simply because this is a state-machine
+  // write rather than a plain field update, the exact bypass class bulk-ops'
+  // delete/set_field actions already close via the same call shape.
+  const record = await get(entityType, entityId, { user });
   if (!record) throw new AppError('Record not found', 'NOT_FOUND', HTTP.NOT_FOUND);
 
   validateTransition(workflowName, record.status || record.stage, toState, user);

package/src/server/server.js

@@ -127,6 +127,10 @@ export function createServer(options) {
           return await handleOAuthGoogleCallback(req, res);
         }
 
+        if (req.method === 'POST' && id && action === 'transition') {
+          return await handleEntityTransition(req, res, entity, id, thatcher, configEngine);
+        }
+
         if (req.method === 'POST' && id === 'import' && !action) {
           return await handleCsvImport(req, res, entity, thatcher, configEngine);
         }
@@ -506,6 +510,61 @@ async function handleBulkOperation(req, res, entityName, thatcher, configEngineA
   }
 }
 
+async function handleEntityTransition(req, res, entityName, id, thatcher, configEngineArg) {
+  const user = await resolveRequestUser(req);
+  if (!user) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Authentication required' }));
+    return;
+  }
+
+  let configEngine = configEngineArg || thatcher?.configEngine || globalThis.__thatcherConfigEngine;
+  if (!configEngine) {
+    const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
+    configEngine = getConfigEngineSync();
+  }
+  let spec;
+  try {
+    spec = configEngine.generateEntitySpec(entityName);
+  } catch {
+    res.writeHead(404);
+    res.end(JSON.stringify({ error: `Entity "${entityName}" not found` }));
+    return;
+  }
+
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (e) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: e.message }));
+    return;
+  }
+  const workflowName = body?.workflow || spec.workflow;
+  const toState = body?.toState;
+  if (!workflowName || !toState) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'workflow and toState required' }));
+    return;
+  }
+
+  try {
+    const { requirePermission } = await import('../lib/auth-middleware.js');
+    await requirePermission(user, spec, 'edit');
+    const { transition } = await import('../lib/workflow-engine.js');
+    // transition() itself now reads via get(...,{user}) -- the same
+    // row/org-access-scoped path every other read uses -- so a caller
+    // cannot drag-drop a record outside their access into a new stage.
+    const updated = await transition(entityName, id, workflowName, toState, user, body?.reason || '');
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, data: updated }));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(err.status || 400);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
 async function handleCreateEntityTemplate(req, res, thatcher, configEngineArg) {
   const user = await requireAuthedPartner(req, res);
   if (!user) return;