thatcher 1.0.67 → 1.0.69

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.67",
+  "version": "1.0.69",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/index.js

@@ -305,9 +305,9 @@ export class Thatcher {
     return list(entity, where, opts);
   }
 
-  async get(entity, id) {
+  async get(entity, id, opts = {}) {
     const { get } = await import(resolveModule('./lib/busybase/store.js'));
-    return get(entity, id);
+    return get(entity, id, opts);
   }
 
   async create(entity, data, user) {

package/src/lib/config-generator-engine.js

@@ -106,10 +106,64 @@ function withWebhookDefaults(masterConfig) {
   return changed ? { ...masterConfig, entities } : masterConfig;
 }
 
+const LEAD_ENTITY_DEFAULT = {
+  label: 'Lead',
+  label_plural: 'Leads',
+  system_entity: true,
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+    company: { type: 'text', label: 'Company' },
+    email: { type: 'email', label: 'Email' },
+    phone: { type: 'text', label: 'Phone' },
+    source: { type: 'text', label: 'Source' },
+    status: { type: 'enum', options: ['new', 'contacted', 'qualified', 'disqualified'], default: 'new', label: 'Status' },
+    owner_id: { type: 'ref', ref: 'user', label: 'Owner' },
+    notes: { type: 'textarea', label: 'Notes' },
+  },
+};
+
+const OPPORTUNITY_PIPELINE_WORKFLOW = {
+  state_field: 'stage',
+  stages: [
+    { name: 'prospecting', label: 'Prospecting', forward: ['qualification'], backward: [] },
+    { name: 'qualification', label: 'Qualification', forward: ['proposal'], backward: ['prospecting'] },
+    { name: 'proposal', label: 'Proposal', forward: ['negotiation'], backward: ['qualification'] },
+    { name: 'negotiation', label: 'Negotiation', forward: ['won', 'lost'], backward: ['proposal'] },
+    { name: 'won', label: 'Won', forward: [], backward: [] },
+    { name: 'lost', label: 'Lost', forward: [], backward: [] },
+  ],
+};
+
+const OPPORTUNITY_ENTITY_DEFAULT = {
+  label: 'Opportunity',
+  label_plural: 'Opportunities',
+  system_entity: true,
+  workflow: 'opportunity_pipeline',
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+    lead_id: { type: 'ref', ref: 'lead', label: 'Lead' },
+    value: { type: 'currency', label: 'Value' },
+    stage: { type: 'enum', options: ['prospecting', 'qualification', 'proposal', 'negotiation', 'won', 'lost'], default: 'prospecting', label: 'Stage' },
+    expected_close_date: { type: 'date', label: 'Expected Close Date' },
+    owner_id: { type: 'ref', ref: 'user', label: 'Owner' },
+    probability: { type: 'number', min: 0, max: 100, label: 'Probability (%)' },
+  },
+};
+
+function withCrmDefaults(masterConfig) {
+  const entities = { ...(masterConfig.entities || {}) };
+  const workflows = { ...(masterConfig.workflows || {}) };
+  let changed = false;
+  if (!entities.lead) { entities.lead = LEAD_ENTITY_DEFAULT; changed = true; }
+  if (!entities.opportunity) { entities.opportunity = OPPORTUNITY_ENTITY_DEFAULT; changed = true; }
+  if (!workflows.opportunity_pipeline) { workflows.opportunity_pipeline = OPPORTUNITY_PIPELINE_WORKFLOW; changed = true; }
+  return changed ? { ...masterConfig, entities, workflows } : masterConfig;
+}
+
 export class ConfigGeneratorEngine {
   constructor(masterConfig) {
     if (!masterConfig) throw new Error('[ConfigGeneratorEngine] masterConfig is required');
-    this.masterConfig = deepFreeze(withWebhookDefaults(withMultiTenancyDefaults(masterConfig)));
+    this.masterConfig = deepFreeze(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig))));
     this.specCache = new LRUCache(100);
     this.debugMode = false;
     this._plugins = new Map();
@@ -459,6 +513,21 @@ export class ConfigGeneratorEngine {
       };
     }
 
+    // Field-level RBAC: a field's visible_to/editable_by (already present on
+    // spec.fields[key] via the `...field` spread above) is compiled into
+    // spec.fieldPermissions, the shape permission.service.js's checkFieldAccess
+    // already reads. A field with neither key contributes no entry here, so
+    // checkFieldAccess's `if (!perm) return true` keeps every role's access
+    // exactly as it was before this feature existed -- no regression for the
+    // overwhelming majority of fields that never set either key.
+    for (const [key, field] of Object.entries(spec.fields)) {
+      if (!field.visible_to && !field.editable_by) continue;
+      spec.fieldPermissions = spec.fieldPermissions || {};
+      spec.fieldPermissions[key] = {};
+      if (field.visible_to) spec.fieldPermissions[key].view = field.visible_to;
+      if (field.editable_by) spec.fieldPermissions[key].edit = field.editable_by;
+    }
+
     if (entityDef.permission_template) {
       const matrix = this.getPermissionTemplate(entityDef.permission_template);
       const access = {};

package/src/lib/workflow-engine.js

@@ -147,7 +147,12 @@ export function getTransitionStatus(record) {
 }
 
 export async function transition(entityType, entityId, workflowName, toState, user, reason = '') {
-  const record = await get(entityType, entityId);
+  // get(...,{user}) enforces the same row/org access scoping every other read
+  // path applies -- without it, a transition could read and act on a record
+  // outside the caller's org/row-access simply because this is a state-machine
+  // write rather than a plain field update, the exact bypass class bulk-ops'
+  // delete/set_field actions already close via the same call shape.
+  const record = await get(entityType, entityId, { user });
   if (!record) throw new AppError('Record not found', 'NOT_FOUND', HTTP.NOT_FOUND);
 
   validateTransition(workflowName, record.status || record.stage, toState, user);

package/src/server/server.js

@@ -127,6 +127,10 @@ export function createServer(options) {
           return await handleOAuthGoogleCallback(req, res);
         }
 
+        if (req.method === 'POST' && id && action === 'transition') {
+          return await handleEntityTransition(req, res, entity, id, thatcher, configEngine);
+        }
+
         if (req.method === 'POST' && id === 'import' && !action) {
           return await handleCsvImport(req, res, entity, thatcher, configEngine);
         }
@@ -378,22 +382,37 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
     let result;
     let status = 200;
 
+    const { permissionService } = await import('../services/permission.service.js');
+
     switch (req.method) {
       case 'GET':
         if (id) {
-          result = await thatcher.get(entity, id);
+          // get(...,{user}) applies the same row/org-access scoping every other
+          // read path in the codebase uses -- this generic-CRUD GET-by-id had
+          // none at all, so any authenticated user could read any record by id
+          // across organizations. filterFields then strips any field the
+          // caller's role isn't visible_to, the field-level half of this pass.
+          result = await thatcher.get(entity, id, { user });
           if (!result) {
             res.writeHead(404);
             res.end(JSON.stringify({ error: 'Not found' }));
             return;
           }
+          result = permissionService.filterFields(user, spec, result);
         } else {
           result = await thatcher.list(entity, {}, { user });
+          result = result.map(r => permissionService.filterFields(user, spec, r));
         }
         break;
 
       case 'POST':
+        // enforceEditPermissions is the authoritative field-level write check --
+        // it throws if the payload touches a field the caller's role isn't
+        // editable_by, so a hand-crafted request bypassing the rendered form
+        // cannot smuggle a restricted field in.
+        permissionService.enforceEditPermissions(user, spec, body);
         result = await thatcher.create(entity, body, user);
+        result = permissionService.filterFields(user, spec, result);
         status = 201;
         break;
 
@@ -404,7 +423,9 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
           res.end(JSON.stringify({ error: 'ID required' }));
           return;
         }
+        permissionService.enforceEditPermissions(user, spec, body);
         result = await thatcher.update(entity, id, body, user);
+        result = permissionService.filterFields(user, spec, result);
         break;
 
       case 'DELETE':
@@ -506,6 +527,61 @@ async function handleBulkOperation(req, res, entityName, thatcher, configEngineA
   }
 }
 
+async function handleEntityTransition(req, res, entityName, id, thatcher, configEngineArg) {
+  const user = await resolveRequestUser(req);
+  if (!user) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Authentication required' }));
+    return;
+  }
+
+  let configEngine = configEngineArg || thatcher?.configEngine || globalThis.__thatcherConfigEngine;
+  if (!configEngine) {
+    const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
+    configEngine = getConfigEngineSync();
+  }
+  let spec;
+  try {
+    spec = configEngine.generateEntitySpec(entityName);
+  } catch {
+    res.writeHead(404);
+    res.end(JSON.stringify({ error: `Entity "${entityName}" not found` }));
+    return;
+  }
+
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (e) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: e.message }));
+    return;
+  }
+  const workflowName = body?.workflow || spec.workflow;
+  const toState = body?.toState;
+  if (!workflowName || !toState) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'workflow and toState required' }));
+    return;
+  }
+
+  try {
+    const { requirePermission } = await import('../lib/auth-middleware.js');
+    await requirePermission(user, spec, 'edit');
+    const { transition } = await import('../lib/workflow-engine.js');
+    // transition() itself now reads via get(...,{user}) -- the same
+    // row/org-access-scoped path every other read uses -- so a caller
+    // cannot drag-drop a record outside their access into a new stage.
+    const updated = await transition(entityName, id, workflowName, toState, user, body?.reason || '');
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, data: updated }));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(err.status || 400);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
 async function handleCreateEntityTemplate(req, res, thatcher, configEngineArg) {
   const user = await requireAuthedPartner(req, res);
   if (!user) return;

package/src/ui/entity-renderer.js

@@ -1,6 +1,7 @@
 import { page, dataTable } from '@/ui/layout.js'
 import { fmtVal, TOAST_SCRIPT, esc } from '@/ui/render-helpers.js'
 import { canCreate, canEdit, canDelete } from '@/ui/permissions-ui.js'
+import { permissionService } from '@/services/permission.service.js'
 
 export function renderEntityList(entityName, items, spec, user, options = {}) {
   const label = spec?.labelPlural || spec?.label || entityName
@@ -85,7 +86,10 @@ function formatFieldValue(k, v, entityName, f) {
 
 export function renderEntityDetail(entityName, item, spec, user) {
   const label = spec?.label || entityName
-  const fields = spec?.fields || {}
+  // A field the caller's role isn't visible_to must never reach rendered HTML,
+  // not just be CSS-hidden -- filterFields drops it from `fields` entirely so
+  // it can't appear in visibleFields below however this function evolves.
+  const fields = permissionService.filterFields(user, spec || {}, spec?.fields || {})
   const userCanEdit = canEdit(user, entityName)
   const userCanDelete = canDelete(user, entityName)
 
@@ -141,7 +145,15 @@ export function renderEntityDetail(entityName, item, spec, user) {
 
 export function renderEntityForm(entityName, item, spec, user, isNew = false, refOptions = {}, templates = []) {
   const label = spec?.label || entityName
-  const fields = spec?.fields || {}
+  // A field the caller's role isn't editable_by must not be offered in the
+  // form at all -- omitting it here is UX (a clean form), the real
+  // enforcement is enforceEditPermissions rejecting the field server-side if
+  // a raw request includes it anyway.
+  const allFields = spec?.fields || {}
+  const fields = {}
+  for (const [k, f] of Object.entries(allFields)) {
+    if (permissionService.checkFieldAccess(user, spec || {}, k, 'edit')) fields[k] = f
+  }
   const lbl = (k, f, req) => `<label class="form-label" for="field-${k}">${esc(f.label||k)}${req ? '<span class="req">*</span>' : ''}</label>`
   const formFields = Object.entries(fields).filter(([k, f]) => k !== 'id' && !f.auto && !f.readOnly && !f.auto_generate && k !== 'password_hash').map(([k, f]) => {
     let val = item?.[k] ?? f.default ?? ''